Privacy Policy

1. Who we are

Flow State is a focus timer and productivity tool. When we say "we", "us", or "Flow State", we mean the team behind this app. You can reach us at hello@flowstate.app.

2. What data we collect

We only collect data that is directly necessary for the app to function:

• Account information — your name and email address when you create an account or sign in with Google. This is used solely to identify your account and display your name in the app.
• Session data — the focus sessions you complete: duration, date, and the task label you optionally assign. This powers your dashboard stats, streak, and activity heatmap.
• Stats — aggregate counts like total sessions, total focus time, tasks done, and your streak. These are stored per account and used exclusively to display your personal dashboard.

We do not collect browsing history, device information, IP addresses for tracking purposes, or any data unrelated to your productivity activity in this app.

3. How we use your data

Your data is used for exactly one purpose: showing you your own productivity stats and history inside Flow State. Specifically:

• Your email is used to authenticate you — nothing else.
• Your session history is used to build your dashboard, heatmap, and streak count.
• Your stats are synced across your devices so your progress is always up to date.

We do not use your data for advertising, profiling, analytics resale, or any other commercial purpose.

4. What we never do

• We never sell your data to third parties.
• We never send marketing emails, newsletters, or promotional messages. The only email you may receive from us is a one-time account confirmation email when you register — that's it.
• We never share your personal data with advertisers.
• We never track you across other websites or apps.

5. Data storage and security

Your data is stored securely using Supabase, a Postgres-based backend with row-level security. This means your data is locked to your account — no other user can access it, and neither can we without deliberate effort. Supabase is SOC 2 compliant and encrypts data at rest and in transit.

Your timer preferences and tasks are also stored in your browser's local storage and never leave your device unless you are signed in.

6. Google Sign-In

If you choose to sign in with Google, we receive your name and email address from Google's OAuth service. We do not receive your Google password, contacts, calendar, or any other Google account data. Your use of Google Sign-In is also subject to Google's Privacy Policy.

7. Data retention and deletion

Your data is retained as long as your account is active. If you want your data deleted, email us at hello@flowstate.app with the subject "Delete my account" and we will permanently delete all your data within 7 days.

8. Children's privacy

Flow State is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

9. Changes to this policy

If we make meaningful changes to this policy, we will update the date at the top. Continued use of the app after changes means you accept the updated policy.

10. Contact

Questions about this policy? Email us at hello@flowstate.app.