Privacy Policy
At Flowline, protecting your personal data is a priority. This policy transparently explains how we handle your information.
1. Introduction
Flowline is a productivity app: tasks and lists, calendar and meetings, habits, focus timer, shared workspaces and teams. This policy explains what personal data we process, why, for how long, who receives it and what your rights are, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
2. Data Controller
The controller is Sophie WODEY EI, 2b rue Lucien Marcollet, 63450 Tallende, France (see our Legal Notice). For any question about your data or to exercise your rights: support@flowlineworkspace.com.
3. Data We Collect
3.1 Data you give us
- Account: name, email address, password (stored only as a hash), profile picture, timezone.
- Your content: tasks, subtasks, lists, comments and mentions, tags, calendar events and categories, meetings and your answers to invitations, habits and their tracking values, focus sessions and timer settings.
- Collaboration: the workspaces, teams and lists you belong to, your role and nickname in them, your contacts and the invitations you send or receive.
- Billing: your plan, subscription status and Stripe customer reference. Your card details are entered on Stripe's page and never reach us.
3.2 Data collected automatically
- Sign-in sessions: the IP address and browser of each sign-in, to keep you signed in and protect your account.
- Hosting logs (IP address, pages requested, errors), kept by our host for a short time for security and troubleshooting.
- Audience measurement and performance metrics (Vercel Web Analytics and Speed Insights): pages visited, referrer, country, device type and loading times. They work without cookies, don't identify you and are only used as aggregated statistics.
3.3 Data from Google
If you sign in with Google: your name, email address and profile picture. If you connect Google Calendar: see section 10.
4. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Providing the app: account, content, workspaces, collaboration | Contract (our Terms) |
| Paid plans, billing, launch offer | Contract |
| Service emails: verification, invitations, reminders, billing | Contract |
| Keeping accounts and the service secure, preventing abuse | Legitimate interest |
| Aggregated audience and performance statistics | Legitimate interest |
| Google Calendar connection | Your consent (you can withdraw it at any time) |
| Newsletter | Your consent (unsubscribe at any time) |
| Keeping invoices and accounting records | Legal obligation |
6. Transfers Outside the EU
Our database is hosted in the European Union, but some providers are located in, or may access data from, the United States or the United Kingdom. These transfers are covered by an adequacy decision (the EU-U.S. Data Privacy Framework for certified companies, and the UK adequacy decision) or by the European Commission's Standard Contractual Clauses.
7. How Long We Keep Data
| Data | Retention |
|---|---|
| Account and content | Until you delete your account (deletion is immediate) |
| Tasks in the trash | 15 days, then permanently deleted |
| Archived habits | 30 days, then permanently deleted |
| Sign-in sessions (IP address, browser) | Until the session expires (7 days without use), then deleted |
| Verification and password-reset links | 1 hour, then deleted |
| Google Calendar connection | Until you disconnect it or delete your account |
| Hosting logs | A few days, at most 30 days |
| Invoices and accounting records (kept by Stripe) | 10 years (French Commercial Code, art. L. 123-22) |
| Newsletter subscription | Until you unsubscribe or delete your account |
8. Security
- Encrypted connections (HTTPS/TLS) everywhere
- Passwords stored only as hashes
- Sessions in httpOnly, secure cookies
- Google tokens and API keys kept server-side only
- Access to each piece of content checked against workspace, list and team roles
- Card payments handled entirely by Stripe (PCI-DSS certified)
9. Your Rights
Access and portability
Download all your data from your profile (“Export my data”)
Rectification
Edit your profile and content in the app
Erasure
Delete your account from your profile
Objection
Object to processing based on our legitimate interest
Restriction
Ask us to restrict processing in certain cases
Withdraw consent
Disconnect Google Calendar, unsubscribe from the newsletter
Post-mortem instructions
Tell us what to do with your data after your death
For anything you can't do yourself in the app, write to support@flowlineworkspace.com. We answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL, or the authority of your country.
10. Google Calendar and Google User Data
When you sign in with Google, Google asks you to also allow read-only access to your calendar, so that it can be shown in Flowline. With that access:
- Flowline asks for read-only access (scopes
calendar.readonlyandcalendar.events.readonly): it can never create, change or delete anything in your Google Calendar. - Your events are fetched when you open your calendar and shown only to you; they are not stored in our database.
- We store only what's needed to keep the connection working: your access and refresh tokens, the list of your calendars (name, color, whether you show it) and a synchronization marker.
- Disconnecting Google Calendar in the app stops the synchronization and removes the calendar data above. To withdraw the access itself, remove Flowline from your Google account at any time; deleting your Flowline account also deletes your tokens.
Flowline's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to show your calendar to you in Flowline; it is not used for advertising, not sold, not used to train AI models, and not read by humans except with your permission, for security reasons or when required by law.
12. Deleting Your Account
You can delete your account at any time from your profile. Deletion immediately:
- erases your profile and all your content;
- deletes the workspaces you own with their content, for all their members, and removes you from the others;
- cancels your subscription and removes your Google connection and tokens;
- removes your profile picture and your newsletter subscription.
Only invoices are kept, by Stripe, for the period required by law. Download your data first if you want to keep a copy — deletion can't be undone.
13. Minors
Flowline is not intended for people under 16. If you believe a minor has given us personal data, contact us at support@flowlineworkspace.com and we will delete it.
14. Changes to This Policy
We may update this policy. For material changes, we will notify you by email or in the app before they take effect. The date of the last update is shown at the top of this page.