This Privacy Policy explains what information Flowcept collects, why we collect it, and how we handle it. We believe in being straightforward — no legalese walls, no hidden data grabs.

1. Information We Collect

Account Information

When you sign up, we collect your name and email address. If you register with a password, it is hashed before storage — we never store or see your actual password.

If you sign in with Google or GitHub, we receive your name, email, and profile picture from those services. We also store the provider-specific account identifier so you can sign in again. We request only the minimum scopes needed: openid email profile for Google and read:user user:email for GitHub.

Content You Create

Projects, tasks, comments, scratchpad notes, and any files you upload are stored to provide the service. This data belongs to you.

Usage & Technical Data

We automatically collect basic technical information when you use Flowcept, including your IP address, browser type, operating system, and the pages you visit. This helps us monitor performance, debug issues, and understand how the product is used.

Payment Information

If you subscribe to Pro or purchase project slots, payment is processed by our payment provider. We store a reference to your subscription and purchase status, but we do not store your credit card number, bank details, or any full payment credentials on our servers.

2. How We Use Your Information

To operate Flowcept — authenticating you, displaying your projects, sending task notifications and team invitations.
To communicate with you — account verification emails, OTP codes, password reset links, and occasional product updates. We do not send marketing emails without your consent.
To improve the product — analysing aggregate usage patterns to identify bugs, improve performance, and prioritise features. We do not build advertising profiles.
To process payments — managing your subscription status and purchase history.
To provide integrations — if you connect Google Calendar, we use a stored refresh token to sync tasks to your calendar. This token is stored securely and is only used for the calendar integration.

3. Third-Party Services

Flowcept relies on the following third-party services to function. Each has its own privacy policy:

MongoDB Atlas — cloud database hosting for your account and project data.
Vercel — application hosting and deployment.
Google OAuth & GitHub OAuth — for social sign-in. We only request the permissions listed above.
Google Calendar API — optional integration to sync tasks to your calendar.
Nodemailer / SMTP — for sending transactional emails (verification, invites, password resets).

We do not sell, rent, or trade your personal information to any third party. We do not use third-party advertising trackers.

4. Cookies

Flowcept uses cookies strictly for functionality:

Session cookie — an HTTP-only, secure cookie that keeps you logged in. It expires when your session ends or after a set period.
Theme preference — stores your light/dark mode choice locally.

We do not use analytics cookies, tracking pixels, or fingerprinting. There is no third-party cookie usage.

5. Data Retention

We retain your account data and content for as long as your account is active. If you delete your account, we will permanently remove your personal data and content from our systems within 30 days, unless we are legally obligated to retain certain records (e.g., payment transaction records for tax purposes).

Activity logs related to your projects (e.g., "Task X was marked complete") are deleted along with the associated project data when you delete your account.

6. Data Security

We take reasonable measures to protect your data, including encrypting data in transit via TLS, hashing passwords with bcrypt, and restricting database access. However, no system is 100% secure. For a more detailed view of our security practices, see our Security Policy.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and data.
Export your project data.

To exercise any of these rights, email us at the address below. We will respond within 30 days.

8. Children's Privacy

Flowcept is not intended for children under 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected data from a child under 16, we will delete it promptly.

9. Changes to This Policy

If we make material changes to this policy, we will update the effective date at the top and, where practical, notify you via email or an in-app notice.

10. Contact

For any questions or concerns about this Privacy Policy or your data, contact us at akshumahajan2004@gmail.com.