Skip to content
flowss
Start freeChecking your session

Legal

Our subprocessors

Last reviewed October 26, 2026

These are the outside services that receive some of your data when you use flowss. For each one we say what it does for us, what it sees, when it is involved and, where we have confirmed it, where it handles data.

Running the service

The services that run flowss itself.

  • Vercel

    Hosts the website and runs our servers

    What they see: Everything that passes between your browser and our servers: your IP address, browser details, the full web address, and what you send us, such as the documents you save, your AI requests and your uploads. A share or embed link carries its diagram inside the web address. From your IP address it also works out your approximate location.

    When
    Every visit
    Where
    Our servers run in the United States. Each request first reaches Vercel's nearest network location, which can be in another country.

  • Supabase

    Our database, accounts and realtime service

    What they see: Everything flowss keeps for you online. That includes your account; the copy of your workspace synced while you are signed in; shared projects and their comments; Evidence projects; Study cards and review history; flowss Academy progress and certificates; classroom work; your support requests and feedback; error reports (the error, the page path, your browser details and your account id); the first 280 characters of each request you give an AI agent; any AI key you save, encrypted; and a record of security-sensitive account actions, such as signing out everywhere or creating an API key, with the IP address and browser they came from. Your IP address when your browser connects to it. Live sessions, including the messages that set up a voice call, pass through its realtime service.

    When
    Always
    Where
    United States (AWS us-west-2, Oregon)

  • Upstash

    Short-lived counters, locks, the security block list and the list of who is on the site right now

    What they see: Counter names and counts. A counter name can include your IP address or network, your account id, or a scrambled (hashed) value. While you have one of our pages open, a short record of your visit: your full IP address, your approximate location, the page path, your browser family, and your account id and email address if you are signed in. That record is deleted 5 minutes after your last activity. Never your documents, prompts or passwords.

    When
    Always
    Where
    Not recorded

  • Resend

    Sends our emails

    What they see: Your email address, each email we send you (including sign-in, confirmation and password-reset emails), and whether it was delivered.

    When
    When we email you
    Where
    Not recorded

  • Zoho Mail

    Hosts our support mailbox

    What they see: Any email you send us, and our replies.

    When
    When you email us
    Where
    Canada

  • Sentry

    Collects error reports

    What they see: When something goes wrong on our servers or in your browser: the error message and where in the code it happened, the page path (without its query string), the app version, a few diagnostic details, and your account id if you were signed in. Our server sends these reports, not your browser.

    When
    When an error is reported
    Where
    Not recorded

  • Cloudflare Turnstile

    Checks that a person, not a bot, is using a form

    What they see: Your IP address and the browser signals its check collects, on the forms that use it, such as sign-in and sign-up.

    When
    When a form shows the check
    Where
    Not recorded

Signing in

Only involved if you sign in this way.

  • GitHub

    Sign-in with a GitHub account

    What they see: That you are signing in to flowss, and your IP address. GitHub tells us your email address, name, username and a link to your profile picture, which your browser loads from GitHub when it is shown.

    When
    When you sign in with GitHub
    Where
    Not recorded

  • Google

    Sign-in with a Google account

    What they see: That you are signing in to flowss, and your IP address. Google tells us your email address, name and a link to your profile picture, which your browser loads from Google when it is shown.

    When
    When you sign in with Google
    Where
    Not recorded

Features

Only involved when you use the feature named.

  • Stripe

    Takes payments and runs subscriptions

    What they see: Your email address and flowss account id, the payment and billing details you enter on Stripe's own checkout page, and your plan, payments and invoices. Card numbers never reach our servers.

    When
    When you buy, change or cancel a plan, or buy points
    Where
    Not recorded

  • Anthropic

    Runs AI features (one of our two AI providers)

    What they see: Each AI request it handles: what you asked, and the diagram, document or picture sent with it, such as a photo, screenshot, sketch or handwriting you ask us to turn into a diagram. If you use your own Anthropic key, it also receives that key.

    When
    When you use an AI feature
    Where
    Not recorded

  • OpenAI

    Runs AI features (one of our two AI providers)

    What they see: Each AI request it handles: what you asked, and the diagram, document or picture sent with it, such as a photo, screenshot, sketch or handwriting you ask us to turn into a diagram. If you use your own OpenAI key, it also receives that key.

    When
    When you use an AI feature
    Where
    Not recorded

  • Google (Gemini), DeepSeek, Alibaba (Qwen), Zhipu (GLM), Moonshot (Kimi) and Mistral

    AI providers you can use with your own key

    What they see: Only if you add your own key for one of them: each AI request you send to that provider, with its diagram, document or picture, and your key. Nothing is sent to them otherwise.

    When
    Only when you choose one and add your key
    Where
    Not recorded

  • PlantUML (plantuml.com)

    Draws PlantUML diagrams

    What they see: The PlantUML source of a diagram when it is drawn, or exported as PNG or PDF. Our server sends it, so they see our address, not yours.

    When
    When a PlantUML diagram is drawn
    Where
    Not recorded

  • Kroki (kroki.io)

    Draws the diagram types we do not draw ourselves

    What they see: The source of a diagram in one of these engines when it is drawn: Bytefield, Structurizr DSL, SVGBob (ASCII), ERD, Excalidraw, WireViz, Ditaa (ASCII), Symbolator (HDL), Network (nwdiag), Packet diagrams (packetdiag), Pikchr. Our server sends it, so Kroki sees our address, not yours.

    When
    When a diagram in one of these engines is drawn
    Where
    Not recorded

  • Iconify

    Icon search and icon pictures

    What they see: The words you type into an icon search and the names of the icons shown. Our server asks Iconify or its official mirrors, so they do not see your IP address. If a document itself contains an Iconify picture link, your browser loads that picture from Iconify directly.

    When
    When you search for or show online icons
    Where
    Not recorded

  • RCSB Protein Data Bank

    Protein structures for the molecule engine

    What they see: The id of the structure you load, and your IP address, because your browser fetches the file directly.

    When
    When you load a protein structure by its id
    Where
    Not recorded

  • OpenAlex

    Research-paper search in the Evidence studio

    What they see: The words of your literature searches, and the DOIs of papers you paste or import. Our server sends them, so OpenAlex does not see your IP address or who you are.

    When
    When you search for or import papers
    Where
    Not recorded

  • UniProt, HGNC, EMBL-EBI (ChEBI) and NCBI (PubChem, Taxonomy and nucleotide records)

    Public science databases that Science looks entities and sequence records up in

    What they see: The identifier or name you look up, which starts as the label of the entity on your figure, or the accession of a sequence record you fetch. Our server sends it, so these databases see our address, not yours. No account details are sent, and nothing else from your figure.

    When
    When you press Resolve identity on an entity in Science, or fetch a sequence record by its accession
    Where
    Not recorded

  • GitHub, GitLab, Bitbucket and Codeberg

    Code hosts we read files from when you import or link one

    What they see: The address of the file or repository you import, link or scan. Imports, and embeds that show a file from a code host, are fetched by your browser, so the host sees your IP address; living-diagram checks are fetched by our server. No diagram content or account details are sent.

    When
    When you import, link or scan code
    Where
    Not recorded

  • jsDelivr

    Serves public sample data for some chart templates

    What they see: Your IP address and the file requested, when you open a chart template that loads its sample data from jsDelivr. Nothing we ship loads code from it.

    When
    When you open such a template
    Where
    Not recorded

  • Google (public STUN servers)

    Helps the browsers in a voice or screen-share call find a route to each other

    What they see: Your public IP address and network port when you join a call. No audio, video or account details pass through it.

    When
    When you join voice or screen sharing in a live session
    Where
    Not recorded

Not on this list

Pictures and data files your documents name. A document can name a picture or data file on another website. Your browser loads it only from the companies named above and blocks every other site. If your browser cannot turn a diagram into a PNG itself, our server does it and fetches the pictures the diagram names from their websites, which then see our server's address, not yours.

Your browser's own speech recognition. Some microphone buttons use the speech recognition built into your browser. Some browsers, such as Chrome, send that audio to their maker's servers. That service belongs to your browser, not to us.

Where data is handled

“Not recorded” means we have not yet confirmed where that service handles data. How we handle data that leaves your country is in section 12 of our privacy policy.

Questions about this list? Email hello@flowss.ai.