Privacy Policy

Account information. If you sign in with Google, we receive your name, email address, and profile picture. If you register with email and password instead, we store your email and a bcrypt-hashed version of your password - we never store or have access to your actual password.

Usage and gamification data. We store your subscription plan, study streak, the dates you studied, and usage counters (like how many decks or AI definitions you've generated this month) so features like streaks, quotas, and Pro entitlements work correctly.

Payment information. If you upgrade to Pro, your payment is handled entirely by Razorpay or Stripe. We never see or store your card or bank details - we only store a billing reference id and your subscription status so we know your plan is active.

Text you ask the AI about. When you look up a definition, or ask the AI to tidy or answer a question you are writing, the passage involved is sent to an AI provider (see below) to produce that answer. The AI step does not keep it.

Your learning record. When you are signed in, the questions you write, your answers and review history, the questions you ask about a card, and the explanations you write in your own words are saved to our database, so they survive a lost or replaced phone and appear on every device you sign in on. If you use the app without an account, they stay only on your device.

Your library backup. When you are signed in, we also back up your reader library: each book's title and author, where you stopped reading, and your highlights, notes and saved definitions - so signing in on a new phone brings them back. The PDF and EPUB files themselves are never stored on our servers. You can switch the library backup off in Account at any time; switching it off deletes it.

Your book files, in your own Google Drive. Only if you choose Back up files to Google Drive in Account, your device uploads your book files directly to a folder named FlowRecall in your own Google Drive. We ask Google for the narrowest permission it offers: FlowRecall can see and change only the files it put there, and nothing else in your Drive. The files never pass through our servers. We keep the access Google grants us encrypted, and you can disconnect at any time from Account or from your Google account's security settings - the files already in your Drive stay there, yours to keep or delete.

We use this information to run the app: to sign you in, answer your AI requests, keep your learning record and library backed up across your devices, enforce Free/Pro usage limits, process payments, track your study streak, and respond if you contact us for support.

We do not sell your data, and we do not use it for advertising.

We rely on a small number of service providers to run FlowRecall, and each only receives what it needs to do its job:

• Google - for signing in with your Google account and, only if you connect it, for keeping your book files in your own Google Drive.
• Groq, OpenAI, and Anthropic - process the text you submit to generate recall questions and definitions.
• Free Dictionary API (dictionaryapi.dev) - looks up a word's dictionary definition when our AI definition is unavailable. It receives only the word.
• Razorpay and Stripe - process Pro plan payments.
• Supabase - hosts our database, where your account, usage data, learning record and library backup are stored.
• Vercel - hosts the app itself and its server functions.

As the developer of FlowRecall, we can access this data through Supabase's and Vercel's administrative dashboards, in the same way any app operator can access their own service's data. We only do so to operate, maintain, and troubleshoot the app.

We use a single, essential session cookie to keep you signed in. We don't use advertising or tracking cookies.

We keep your account data for as long as your account is active. You can delete it yourself at any time, without asking us: open Account and choose Delete Account under Danger Zone. You'll be asked to type your email address to confirm, because it cannot be undone.

Deleting your account removes everything we hold about you from our database immediately - your profile, email address, streak history, usage counters, learning record and library backup - and cancels any active subscription with our payment provider first, so you are never charged for an account that no longer exists. If you connected Google Drive, we move the FlowRecall folder to your Drive's trash (Google empties it after 30 days) and give up our access to your Drive. It also erases everything the app has stored on the device you delete from.

You don't have to delete your account to delete your data. Deleting a book or a highlight in the app removes it from the backup and from every device you are signed in on, and moves a backed-up file to your Drive's trash. Switching off Back up my library in Account deletes the whole library backup, including the FlowRecall folder in your Drive, while leaving everything on your device as it is.

If you would rather we did it for you, or you can no longer sign in, email us at founder@flowrecall.app from the address on your account and we'll remove it.

We use industry-standard practices to protect your data, including encrypted connections (HTTPS) for all traffic, bcrypt password hashing, and encryption of the Google Drive access you grant us. No method of storage or transmission is 100% secure, but we work to protect your information appropriately.

FlowRecall is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we'll delete it.

If we make material changes to this policy, we'll update the date at the top of this page. Continued use of FlowRecall after a change means you accept the updated policy.

Questions about this policy or your data? Email founder@flowrecall.app.