Privacy Policy

Legal

Effective 9 August 2026

The short version: the apps run on your machine and your working data never leaves it. The website collects the minimum needed to run accounts, billing and the email list — and nothing is sold or used for advertising. The operator of johflow.com is the data controller; reach us via the contact section.

1. What we collect, and why

Account. Signing in with Google gives us your email address, name and avatar. We store them to run your account (legal basis: performance of a contract).

Billing. Payments run through Stripe. Stripe processes your payment details; we store only your subscription status and plan. We never see your card number.

Device pairing. When you sign a desktop app in, we store the device label and platform the app reports, and a salted hash of the IP address that paired it (never the address itself), to run licensing and let you review and revoke devices (legal bases: contract, and our legitimate interest in preventing abuse).

Email list. If you join the list, we store your email address, when you consented, where the signup came from, and a salted hash of the requesting IP as proof of consent (legal basis: your consent, which you can withdraw anytime — every email includes an unsubscribe link, and one click removes you). Signups from the homepage are confirmed by a link sent to the address first; nothing is sent to an unconfirmed address beyond that one confirmation email.

The apps. Your working data — files, transcripts, tracking history, knowledge base — lives on your machine and is never uploaded. The desktop apps contact our servers only to verify your plan.

2. Who processes it

Four processors run the infrastructure, each bound by a data processing agreement: Supabase (accounts and database), Stripe (payments), Resend (the email list, EU region), and Cloudflare(website hosting, which processes IP addresses in server logs as any host does). We do not sell data, run ads, or use third-party analytics or tracking cookies. The website sets no cookies at all; sign-in state lives in your browser's local storage.

3. How long we keep it

Account data lives as long as the account. Billing records are kept as long as tax law requires. Email-list records are kept while you are subscribed, plus the consent proof for as long as we could be asked to show it. Delete your account or ask us to, and everything not legally required to be retained is removed.

4. Your rights

Under the GDPR you can ask for access to your data, correction, deletion, a portable copy, and restriction of or objection to processing; where processing rests on consent you can withdraw it with effect for the future. Contact us and we'll handle it. You also have the right to complain to a data protection supervisory authority.