privacy policy

What we collect

• Account basics. If you sign in, we store your email (magic-link), or your GitHub / Telegram identifier · whichever you use. We use it to keep you signed in and sync your sessions across devices.
• Focus sessions. Start time, length, and whether a session completed. This powers your streak, stats, and the leaderboard.
• Tasks you type. Your “currently working on” list, stored so it’s there when you come back.
• Preferences. Theme, timer presets, reminder settings, sound on/off · stored locally on your device and (if signed in) on your account.
• Basic analytics. Anonymous, aggregate usage events (e.g. “a session started”) so we know which features matter. No cross-site tracking, no ad networks. Analytics only run if you accept them in the cookie banner.
• Session replay. If you accept analytics, we may record privacy-masked replays of how the interface is used (clicks and navigation) to find bugs and rough edges. All text inputs and form fields are masked · we never capture what you type, your passwords, or your email keystrokes.

What we do NOT collect

• We don’t read your keystrokes, screen, or other apps.
• We don’t sell or rent your data to anyone.
• We don’t run third-party advertising trackers.
• We don’t require your real name, photo, or phone number.

Where your data lives

Account data is stored with Supabase (Postgres, hosted in the EU/US). The app is served by Vercel. Anonymous product analytics and session replay are processed by PostHog, hosted in the United States (US region). If you connect Telegram, we exchange the minimum identity data Telegram provides to sign you in. If you upgrade (when paid plans are live), payments are handled by Stripe · we never see or store your card number.

Local-first by default

If you use FlowMax without signing in, your sessions, tasks, and preferences stay in your browser’s local storage on your device. Nothing is sent to our servers until you choose to sign in.

Your choices

• Use it signed-out. Most of FlowMax works without an account.
• Delete your data. Email us and we’ll delete your account and everything tied to it. Clearing your browser storage wipes the local copy.
• Turn off reminders any time from preferences.

Children

FlowMax isn’t directed at children under 13, and we don’t knowingly collect their data.

Changes

If we change this policy we’ll update the date above. Material changes will be announced in-app.

Contact

Questions or a deletion request? hello@flowmax.app.