Privacy and your data

This page is the practical companion to the Privacy Policy. It explains, without the legal phrasing, what flowss collects, where your work goes and who else can see part of it, what stays only in your browser, how long each kind of record is kept, and every control you have — switching off usage measurement, downloading everything held about you, managing email, and asking for corrections or deletion. Where this page and the policy differ, the policy is the binding text; where you need the mechanisms behind these promises, see Security at flowss.

At a glance

Who is responsible for your data

flowss is operated by Voranox Inc., which is accountable for the personal information described here — the data controller, in GDPR terms. Privacy questions, data requests and complaints go to hello@flowss.ai, a monitored mailbox read by the people who build flowss; the contact page has a Privacy and your data card that opens an email with the subject already set.

Because Voranox Inc. is a Canadian company, requests are handled under PIPEDA. If you are not satisfied with an answer, you can complain to the Office of the Privacy Commissioner of Canada. Being outside Canada does not remove your rights: where the GDPR or a comparable law gives you more, flowss applies the stronger one.

flowss runs on infrastructure in more than one region. By using the service you consent to your data being processed there; where local law requires it, flowss relies on standard contractual clauses. If your work must stay in one jurisdiction, ask before you upload it — data-residency options are listed for Enterprise as "At GA" on the pricing page and are not available today.

What flowss collects

What flowss does not do

• Train AI models on your diagrams.
• Sell or rent your data.
• Use third-party analytics, advertising trackers or cross-site tracking of any kind.
• Read your synced diagrams except to render them back to you.
• Store your AI provider key in plain text, or log it.
• Collect referrers, campaign tags or other acquisition data, or join anonymous usage to billing accounts.
• Add you to a mailing list because you wrote to support.

Where your work lives

flowss saves your work in two places at once:

1. Your browser. Every studio writes your work to this browser's own storage as you go.
2. Your account. While you are signed in, your whole workspace — the source of each figure, every studio's open document and your Vault snapshots — is pushed to our database about a second after each edit, again every 20 seconds, and when you leave the page. That is what restores your work on another device.

There is no switch to stop the second copy: every studio needs an account, and every signed-in workspace syncs. Until a cloud save succeeds, the browser may hold the only copy — an expired session, a network problem or a rejected save can interrupt backup — so check the sync status and keep exports of important work. The details are in Cloud sync, offline work and devices.

Some things stay only in your browser and are never uploaded:

You can see every item stored under the glyph prefix, with its size, in a studio's Settings → Personalization & privacy → What stays here, and what we store.

AI features and your data

When you use an AI feature, your prompt and the relevant part of the diagram are sent to the AI provider handling the request, and that provider's own policy covers that leg of the call.

flowss does not keep the prompt or the answer after returning it to you, with one exception: each agent run keeps a short record — the first 280 characters of what you typed, the tools it called, how it ended and the points it cost — so your account page can show you what ran. It never holds the model's reasoning, your diagram or your key, and it is deleted after 90 days.

Automatic repair is the one AI feature that runs without being asked. It is on by default: when a diagram fails to render, its whole source and the error are sent to the AI provider and the editor is updated with the fix (you can undo it). To stop it, open the Studio's Settings (from its menu or by typing "Settings" in the command palette) → Personalization & privacy → Repair broken diagrams automatically and choose Turn auto-repair off. With it off, the card reads "Off — a diagram that fails to render stays exactly as you wrote it, and the error is reported instead." The choice is stored in this browser, so repeat it on each browser you use.

Converting to LaTeX/TikZ is an AI feature, not a compiler. The diagram source goes to the AI provider, which writes the LaTeX; nothing on flowss runs LaTeX. You compile the output yourself.

Your own AI key

On Starter and above you can bring your own key. By default it stays in your browser's storage and is attached to each AI request; our server holds it in memory for that one request and never writes it down. If you choose Save key on your account page, it is encrypted with AES-256-GCM and only the ciphertext is stored, with the first 8 characters kept readable so you can see which key is saved. Delete it from the same panel at any time. In both modes the request to your provider is made from our server. See Bring your own AI key.

Who else can see part of your data

Running flowss means relying on other companies for parts of the job. This table lists who receives what. "Your browser" means your browser contacts them directly, so they also see your IP address; "our server" means flowss relays the request, so they see our address instead of yours.

Every other diagram engine draws in your browser or on our own server, with no third party involved. DBML database schemas, for example, are drawn locally. Study's read-aloud voice is currently switched off, so its speech model is not downloaded and Hugging Face receives nothing.

Share links and embeds

A share link or embed link carries the compressed diagram inside the link itself. We do not host a copy, index it or record who opened it, but the link's contents reach our servers every time it is opened — our server decodes it to build the page title and the link preview — and it can appear in our hosting provider's request logs. Anyone holding the link holds the diagram. See Sharing and permissions.

Exports

Copy and download of a diagram's source never leave your browser. Image and PDF exports are produced in your browser too; if your browser cannot rasterise a very large PNG, the export falls back to our server's rasteriser, which returns the image without storing it. A PlantUML export is rendered by the PlantUML server. Each export records one usage event with the format and the engine, and nothing of the diagram itself. See Exporting your work.

Usage measurement

flowss measures product use with its own first-party events — there is no third-party analytics SDK anywhere in the product. A usage event contains only:

flowss does not store your IP address, browser string, referrer, full address or any query string with these events, and they are never linked to your account. Diagram source, notes and file contents are never sent. The requests carry no account cookies and no referrer, and the server discards any batch that arrives with either. Page-speed measurements from these events are what the public status page summarises.

Switching it off

1. Open the Privacy Policy and scroll to section 4.
2. Find Anonymous usage measurement on this browser. Its status line reads "On. No account identifiers or content are collected." while it is on.
3. Choose Turn usage measurement off. The status changes to "Off. New events and pending events are discarded."

The choice applies to that browser and you can reverse it with Turn usage measurement on. It "does not subscribe you to email". If your browser sends Do-Not-Track or Global Privacy Control, measurement is already off, the status reads "Off — your browser privacy signal is respected.", and the button is disabled; the server honours those signals as well. You, or an IT administrator, can also switch it off permanently on a browser by setting glyph:telemetry:disabled to 1 in its local storage. Turning it off discards events that were still waiting to be sent.

Feedback, support and crash reports

Feedback

Feedback at the foot of the Flow Dock (⌘J) sends a message of up to 2,000 characters with the page path you sent it from. If you are signed in, your account id and email are attached so we can reply — signed-in feedback is identifiable, not anonymous. To send something anonymously, sign out first (the Flow Dock is still available on the Library page when you are signed out). Feedback carries no usage-measurement id and is kept until we have acted on it.

Support requests

A request sent from Send a private support request on the contact page is stored in our database and a receipt is sent to your account email. It is visible to you and to authorised support staff, included in your account export and removed with your account. Copies of emails held by our email provider and the support mailbox follow those services' own retention. Do not include passwords, API keys, payment card details or confidential project content.

The help assistant

The help page at /support first matches your question to reviewed flowss guidance on your own device. If AI help is available and you are signed in, you can tick "Use the flowss Support Agent to select a help topic…" to send one general question of up to 500 characters to Anthropic, which only picks a help topic. No account identifiers, email addresses, projects, tickets, conversation history or saved keys are sent; questions are not saved and do not go into usage measurement. Questions that look like they contain credentials, an email address or a card number, that mention a security problem, or that ask for a person are never sent — the page says "This question is better handled privately by a person. Nothing was sent to the AI provider." When AI help is switched off for the service, the page says so and all matching happens in your browser.

Optional voice input ("Enable local voice for this visit") needs your consent on each visit, uses only on-device English speech recognition, stops after 30 seconds, and never records or uploads audio. The transcript stays in the box for you to review, and reaches Anthropic only if you also opted into AI help and submit it.

Crash reports

When something crashes, the report described in the table above is recorded so it can be fixed. Stack traces can incidentally contain identifiers from what you were doing at the time. Reports are used only to find and fix bugs — never for analytics, profiling, marketing or automated decisions — are readable only by the server, and are deleted after 90 days. A copy also reaches our hosting provider's server logs, and the error-monitoring service when one is configured; those copies age out on their own schedules.

Cookies and browser storage

flowss uses only cookies that are strictly necessary: the session cookie that keeps you signed in, a short-lived cookie (one hour) that ties an emailed link or a GitHub or Google sign-in to the browser that started it, and cookies that remember your preferences. There are no analytics or advertising cookies; if that ever changes, you will be asked first with a consent banner.

Most of what flowss keeps on your device is in browser storage rather than cookies: your local copy of your work, personalisation, the usage-measurement id and, by default, your own AI key. Signing out clears your personalisation, any AI key kept in the browser and the cached plan and points, but leaves documents untouched.

Email

Every commercial email has an Email preferences link and a one-click unsubscribe; neither needs you to sign in. The preferences page lets you Unsubscribe from or Resubscribe to each list. Your unsubscribe and spam-complaint records are kept indefinitely against your address, so we never mail you again by mistake — even after an account is deleted.

How long things are kept

Warning: cloud sync is not a backup service. flowss does not offer point-in-time recovery or a restore guarantee. Keep your own exports of anything you cannot afford to lose.

Your rights and controls

Download everything flowss holds about you

1. Sign in and open your account page.
2. Scroll to Your data (or go to /account#account-data).
3. Under Export everything, choose Download my data. The button reads "Building your file…" while it works.
4. The file downloads, named like flowss-account-export-2026-10-04.json, and the panel confirms "Downloaded" with the file name.

The file holds every row in our account-data inventory attributed to your account or email address, table by table, each with a sentence saying what it is — including the tables that hold nothing, and the full contents of research atlases you own. Nobody reviews or approves the request first. Three kinds of thing are held back, and the file says so where it happens:

Email delivery records are listed separately in the export's privacy-review notice, because one record can refer to several recipients. Email hello@flowss.ai for an individually redacted copy or an erasure review.

You can export every diagram from the studio it lives in as well — SVG, PNG, PDF, TikZ and JSON source, and the JSON round-trips back in. See Exporting your work.

Delete your account

Self-service account deletion is temporarily unavailable while protection for shared work is improved. On the account page, Account deletion says so and offers three links: Contact support about deletion, Export my data and Manage billing.

1. Download your data first (above). A completed deletion cannot be undone, and deleted accounts are not restored from backups.
2. Use the support form with the topic Privacy, or email hello@flowss.ai, to request deletion. Say whether you own shared projects, teams or classes, or made an earlier deletion request that did not finish.
3. Cancel your subscription separately with Manage billing if you want it stopped now. Sending a request does not delete your account or cancel your subscription.

Support reviews each request and confirms the outcome; a request is not confirmation that erasure has happened. The intended erasure process, which support follows when it resumes, works like this:

The full lists, with the reason for each item kept, are in section 11 of the Privacy Policy.

Correct, object, or erase something specific

Email hello@flowss.ai to:

• correct anything flowss holds about you;
• ask for something the erasure process keeps to be deleted — the text of a feedback message, for instance;
• object to, or ask flowss to stop, any of the collection described here.

flowss answers within 30 days and confirms when it is done. Usage measurement you can switch off yourself, as described above.

Privacy controls in Settings

The Studio's Settings → Personalization & privacy holds the controls for what lives in your browser:

Children

flowss is not directed at children under 13, and does not knowingly collect data from them. You must be at least 13, and old enough to form a binding contract where you live, to use it. Teachers running classes should read Classrooms, cohorts and assignments.

Changes to these practices

Material changes to the Privacy Policy are announced at least 14 days before they take effect. The date the policy was last updated is shown at the top of /privacy.

Tips

• Sign out before sending feedback if you want it to be anonymous.
• Switch off automatic repair if you work on material that must not reach an AI provider, and avoid AI features for that work altogether.
• For confidential diagrams, prefer engines that draw locally over PlantUML and the Kroki-backed engines.
• Invite named people into a project rather than sending share links, which carry the whole diagram.
• Download your account data once in a while; it is the most complete copy of what flowss holds about you.
• Keep your own AI key in the browser unless you need it on several devices.

Limits and known constraints

• Cloud sync cannot be switched off while you are signed in, and there is no anonymous studio.
• Self-service account deletion is paused; deletion goes through support.
• Deleted data remains in daily database backups until they age out; there is no point-in-time recovery.
• There is no signed data-processing agreement, BAA or HIPAA/FERPA commitment. Do not upload identifiable patient data, student records or anything a data agreement governs.
• No data-residency choice is available.
• Your own AI key passes through our server on every AI request.
• Some engines send diagram source to an outside render service, and share links send the diagram to our servers each time they are opened.
• Pictures on Study cards are not synced between devices.
• Email delivery records are not included automatically in the account export, and they are not removed with account data; they expire on their own 14-day schedule.
• Usage-measurement, auto-repair and personalisation choices are stored per browser; set them again on each browser you use.

Troubleshooting

Related pages

• Security at flowss
• Reliability, status and support
• Account settings and your data
• Cloud sync, offline work and devices
• Bring your own AI key
• AI in flowss
• Exporting your work
• Sharing and permissions
• Managing your subscription
• Copyright, licences and attributions