Privacy Policy

01Introduction

Flowroid (“we”, “our”, or “the app”) is an Android automation platform. This Privacy Policy explains what data Flowroid accesses, how it is used, where it is stored, and your rights with respect to that data.

Core principle: your automation content stays on your device unless you put a step in a flow that sends it. Flows, variables, execution history and crash reports are never uploaded, and we have no ability to read them. Every permission the app asks you for is used solely to power automations you configure; the one set it does not ask for — the advertising-identifier permissions the measurement libraries declare — is used only if you allow ad measurement, and is listed in Section 3 alongside the rest.

Flowroid contacts a server of ours for three things, and this policy is precise about the difference between them.

• The licence check — to confirm whether this install is in its trial or carries an active entitlement. It carries a one-way hash, no personal data, no automation content, and never your raw device identifier. Section 6 sets out exactly what is sent and why.
• The AI assistant — if you choose to use it, what you type is sent to our AI proxy and on to Google’s Gemini API to be answered. This is real content leaving your device, and Section 7 states plainly what is sent, where it goes, and what happens to it.
• AI steps in your flows — if you put one in a flow, it sends its prompt, including any values the flow puts in it, to the same AI proxy each time the flow runs it, with no assistant open. This is content leaving your device too, and the same section sets it out.

A fourth path exists only if you switch it on: analytics and ad measurement, which Flowroid asks about on first run with everything switched off and which carry no content you created. Section 8 sets out what they collect, who receives it, and how to withdraw.

Your automations do not depend on any of them: flows, triggers and actions run on the device, and keep running with no connection and no AI. A flow sends something to our AI service only through an AI step you placed in it, and only that step’s prompt; a user who uses neither the assistant nor an AI step transmits no content.

02Data Controller

Flowroid is published by an individual developer, not a registered company, based in the Arab Republic of Egypt. For the records described in Section 5, and for the assistant and AI-step content described in Section 7, that developer is the data controller within the meaning of the General Data Protection Regulation (GDPR). Google acts as our processor in both cases.

• Contact e-mail: support@flowroid.com
• Data deletion requests: flowroid.com/data-deletion

We do not have a data protection officer, and we are not required to appoint one: the server-side records are limited to the fields listed in Section 5, assistant and AI-step content is not retained at all, and neither is used for profiling or monitoring.

03Permissions and Data We Access

The following table lists every Android permission Flowroid may request or declare, why it is needed, and where the resulting data goes. Each On device? answer describes only what that permission does — none of them covers the AI assistant or AI steps, whose own data flow is set out in Section 7.

Every row except the last is a permission Flowroid asks for to power an automation you configure. The last row is not: the advertising-identifier permissions are declared by the measurement libraries Flowroid links, are never prompted for by Android, and are used only while you allow ad measurement (Section 8). We list them rather than let the manifest say more than this page does.

Text shared to Flowroid needs no permission. When you share text from another app to Flowroid through Android’s share sheet, it starts the flow you chose. The shared text is capped at 20,000 characters, is never written to a log, and is used as a plain value — it is never evaluated as a {{…}} expression. It leaves the device only if that flow sends it, for example in an AI step.

04Background Location

Background location is used exclusively to evaluate geofence boundary crossings via the Google Play Services Geofencing API. Flowroid does not log, store, or upload your GPS coordinates. Location data is processed entirely on-device by Google Play Services; Flowroid only receives a binary “entered” or “exited” event per geofence.

If you do not create any geofence triggers, you can decline this permission and the rest of the app will work normally.

05Data Storage

Local database

All flows, variables, execution history, and app settings are stored in a Room (SQLite) database on your device’s internal storage. This data never leaves the device except when you use the export feature, configure an HTTP Request action to send it, or put it into an AI step’s prompt.

Secret variables

Variables you mark as “Secret” (e.g., API keys, passwords) are encrypted at rest using the Android Keystore (AES-256). Secret values are never displayed in logs or the execution history UI.

Crash reports

If Flowroid crashes, a local crash report is saved to files/crashes/ on your device. These reports contain the stack trace, app version, Android OS version, and device manufacturer/model. They do not contain notification content, location data, contact data, or any other personal information. Reports are capped at 10 files (oldest deleted automatically). Crash reports are never uploaded; you can view or delete them from the app’s log viewer.

Flow execution logs

When a flow runs, Flowroid writes a log entry that includes the flow name, trigger type, action results, and any error messages. Notification titles and bodies, and text shared to Flowroid, are deliberately excluded from log entries. Logs are stored locally and you can clear them at any time in Settings → Logs. A flow you build can still write a notification’s text to a file of your own (the “Receipts into a Spreadsheet” template does), and then it is in that file.

What we store on our servers

The table below is the complete list of what our server holds. None of these records contains your name, e-mail address, automation content, or any raw device identifier: the hashes below are computed on your device before anything is sent. Two of them exist only because Flowroid AI, the trial and earlier purchases include an AI allowance — they count what you have spent, never what you said (Section 7).

Our server also keeps a single fleet-wide daily counter of AI spend, which exists to cap our own costs. It holds a date and a number, and no identifier of any kind — yours or anyone else’s.

These records are stored on Google Cloud infrastructure in the europe-west1 region (Belgium). See Section 11 for the processors involved and Section 14 for how to have them deleted.

06Licence and Purchase Verification

Flowroid is a paid app with a 14-day trial. The trial and every kind of purchase — the one-time unlock, a Flowroid AI subscription, a one-time unlock bought before 17 August 2026, and a legacy Flowroid Pro subscription — are verified with a licence server we operate. This section describes that exchange in full.

What the app sends

• A device key. Your device’s ANDROID_ID combined with a secret salt and hashed with SHA-256 on your device. Only the resulting hash is transmitted. The hash cannot be reversed, and the raw ANDROID_ID never leaves your phone.
• A hashed purchase token, once you buy Flowroid, subscribe to Flowroid AI or buy a credit pack, so that Google Play’s record of the purchase can be matched to your entitlement without us storing the token itself. The purchase record also stores which product it is, so the server knows what it unlocks.
• A Google Play Integrity verdict, which tells us whether the request came from a genuine, unmodified copy of Flowroid. It describes the app and the device, not you.

What the app receives

A short-lived signed licence stating whether this install is in its trial or entitled, and — if you are entitled to AI — an anonymous metering id and your credit allowance. The metering id is derived by hashing: from your unlock purchase once you own Flowroid, and from the device key during the trial. It is what the AI usage meter and AI credits in Section 5 are keyed by, which is why every device you restore the purchase on shares one balance, and it identifies an entitlement, not a person.

What the app never sends

No flows, flow names, variables, secrets, execution logs, crash reports, notification content, location, contacts, or calendar data. The licence request has no field capable of carrying them. The device record does hold the date this install first ran a real automation, and the app version it registered and first ran one with (Section 5); those are a date and a release number, not anything from the automation.

Why we do it

• Entitlement. Your unlock — or a Flowroid AI or legacy Flowroid Pro subscription — must keep working across reinstalls and on any device signed into the same Google account, up to the device limit. Verifying it against a record is what makes that possible.
• Metering the AI allowance. Cloud inference costs us money per request, so the credits included with Flowroid AI, the trial or an earlier purchase are counted server-side against the metering id above. Only the amount is recorded, never the content.
• One trial per device. The trial needs no payment method, so nothing else stops it from being restarted indefinitely by reinstalling the app. The device record deliberately survives an uninstall, a clear-data, and Settings → Reset App Data. That persistence is the anti-abuse mechanism, and we would rather state it plainly than have you discover it.

If the server is unreachable

A successful check is recorded on your device as a signed licence. Flowroid keeps working on that licence until it expires, and renews it automatically once connectivity returns. Losing your connection does not lock the app.

Legal basis (GDPR Article 6)

07The AI Assistant and AI Steps

Flowroid offers AI in two optional forms. These are the only parts of Flowroid that send your content to our servers — the analytics in Section 8 carries none — so this section is deliberately specific.

• The AI assistant: a chat surface where you describe what you want in plain language and it runs Flowroid’s own actions and your flows.
• AI steps you place in a flow, which send their prompt each time the flow runs them (below).

What the assistant sends, when you use it

When you send a message to the assistant, the following leaves your device over an encrypted, certificate-pinned connection:

• Your message — what you typed, or what your device’s speech recogniser turned your speech into.
• The conversation so far — the earlier messages in that session, because a reply that ignores them would be useless.
• The tool definitions — the list of Flowroid actions and flows the assistant is allowed to use, including your flow names, so it can pick the right one.
• Tool arguments and results — what it decided to run and what came back, so it can carry on from there: for example, the titles and text of notifications, if you ask the assistant about your notifications. Notification keys are replaced with opaque references first.
• Your signed licence, carrying the anonymous metering id from Section 6. There is no account, no e-mail address and no name attached to the request.

Anything you put into a message is part of that message. If you paste a password, an address or someone else’s details into the assistant, they are sent with it — the same as with any chat assistant. Your secret variables are never included: the assistant cannot read them, and they are not sent.

Where it goes

Your message, and every AI step’s prompt, goes to Flowroid’s AI proxy, which we operate on Google Cloud in europe-west1 (Belgium), and from there to Google’s Gemini API, which generates the reply. The proxy exists so that AI works without you having to sign up with an AI provider, and so the included allowance can be metered.

What happens to it

• We do not store it. Your message or prompt and the reply pass through our proxy in memory for the length of the request and are never written to a database or a file.
• We do not log it. Our request logs record the method, route, status and latency of a call — never its body. There is no debugging log of prompts, and a test in our build fails if one is ever added.
• It is not used to train models. We do not train anything on it, and Flowroid uses Google’s paid Gemini API tier, whose terms state that Google does not use prompts or responses submitted through it to improve its products.
• Google logs it briefly for abuse detection. Under those same terms Google retains prompts and responses for a limited period, solely to detect and prevent abuse of its API. That is Google’s processing, on its own retention schedule, and we state it here rather than claim a zero-retention pipeline we do not control.
• What we do count is the cost. Every request adds a number to the AI usage meter in Section 5 — how many credits it consumed, against an anonymous metering id. That meter is how a monthly allowance can exist at all. It holds no content.

AI steps in your flows

Ask AI, Classify with AI, Extract with AI, Summarize with AI and Translate with AI are steps you can place in a flow, from the Intelligence section of the palette. They produce text or data for the next step. They never act on another app, read your screen, or run an action by themselves.

• When they send. Every time the flow runs one, triggered by whatever starts the flow — a notification, a schedule, a webhook, a share. No assistant has to be open. Setting Flowroid up also runs one AI step, once.
• What is sent. Only the step’s resolved prompt and system instruction. That can include whatever values the flow fills in, which means any of these kinds of data: messages — the title and text of a notification from a chat, email or SMS app (Flowroid has no SMS permission and never reads your messages store; only the notification text you chose to send); a calendar event’s title and notes; a file’s contents; and other text you create or receive — the clipboard, text you shared to Flowroid, a webhook body, an HTTP response, or the prompt you wrote. It takes the assistant’s route and pipeline: the same pinned connection, the same personal-data filter (Settings → AI → Privacy), to our AI proxy and on to Google’s Gemini API. Not stored, not logged, not used for training. Prompts are clipped at 8,000 characters, and shared text at 20,000.
• What is never sent. Secret variables. A step that references one cannot be saved. And nothing is sent from a flow that has no AI step.
• Your own model. If you point AI at your own endpoint (Settings → AI → Advanced), the prompt is sent there as it is instead, and to nobody else.
• Before you install a template. Every Intelligence template’s detail screen says what text it sends — for example, “Sends the notification title and text to your AI provider” — before you install it.
• Cost and limits. Each run spends credits like an assistant message. By default a flow may make 30 AI calls an hour and 200 a day. Running a flow with AI steps by hand asks first, and offers to run it with the AI skipped.
• Without AI. A step with fallback text uses it and the flow carries on. Automation is never gated by AI credits.

Running your own model instead

If you would rather nothing reached our servers, point Flowroid at a model you host yourself — Ollama, LM Studio, or any OpenAI-compatible server — under Settings → AI → Advanced. Assistant messages and AI-step prompts then go to the address you entered and nowhere else: not to our proxy, not to Google, and they do not touch your allowance. Flowroid does not offer to send your content to a cloud AI provider under an API key of your own; that route was removed.

Speaking to it

The microphone is used only while you have the assistant open and have started it yourself — there is no wake word and no background listening. Flowroid never records or stores your audio. Speech is converted to text by your device’s recogniser, which on a device without an offline speech pack may be Android’s system provider (typically Google). The text is then treated exactly like a typed message.

What stays on the device

Two assistant features never involve a server at all: the learned shortcuts that let repeated commands run instantly, and the automation suggestions Flowroid draws from your own usage. Both are computed on the phone, are stored only there, and are never uploaded. Reports you file about a bad assistant reply are also stored on the device.

08Analytics and Advertising

Flowroid asks, the first time you open it, whether it may collect anything for analytics and advertising. If you installed Flowroid before it asked, it asks once, the same way, the next time you open it after updating. Everything in this section happens only if you said yes, and only for the purposes you said yes to. If you have not answered, or you answered no, nothing described here is collected — not reduced, not anonymised: not collected. Flowroid works exactly the same either way.

What is collected

• A short, fixed list of steps you take in the app, as bare counts with no detail attached: you finished setup, you saved a flow, you ran a flow successfully for the first time, the first-run step started waiting for your first flow to run, or you skipped it, the unlock screen was shown to you, and the AI step in setup produced a result. Each SDK additionally records its own standard events — Google’s, your first open of the app and how long a session lasted; Meta’s, that the app was opened. Meta receives these steps only if you allowed ad measurement; if you allowed product analytics alone, Meta receives nothing.
• Purchases. After a purchase our server has verified, one more event is counted — you unlocked Flowroid, you subscribed to Flowroid AI, or you bought AI credits. Like every other event it carries no detail: no price, no product and no order number. Purchase events go to Google Analytics only and are never sent to Meta.
• Identifiers. A Firebase “app instance ID” — an identifier for this installation, not for you — and, only while you allow ad measurement, the Android Advertising ID. The Advertising ID is a resettable identifier you control in your Android settings. Meta receives the Advertising ID and an installation identifier of its own, again only while you allow ad measurement. We do not use Meta’s “Advanced Matching”, so no e-mail address, phone number or name is ever sent to Meta — Flowroid has none of those to send.
• An approximate location, meaning the city Google or Meta infers from the IP address the data arrives on. Flowroid never sends your actual location: geofence triggers and the map picker work on the device (Section 4), and no flow, event or licence check carries coordinates.
• Basic technical facts about the device the SDK reports by itself: model, Android version, app version, language, country.

What is never collected

No content, ever. Not the names of your flows, not the contents of a variable, not a notification, not a message you typed to the assistant, not an address you geofenced. The set of events Flowroid can raise is fixed in its source code and none of them carries any attached detail — there is no field to put your data in. Flow runs, execution logs and trigger history stay on the device exactly as described in Section 5.

The two choices, and what each one permits

They are independent. Allowing one never turns on the other.

Who receives it, and on what basis

Google receives it. Google Analytics for Firebase processes it on our instructions, in a property we control, as our processor. If you allow ad measurement, Google also reports the resulting conversions to Google Ads, the advertising platform we use to promote Flowroid, marked as not to be used for personalised advertising. Google’s own handling is described in the Google Privacy Policy, and its row is in Section 11.

Meta receives it too, but only if you allow ad measurement, and the difference between the two recipients matters enough that we would rather state it plainly than let it read as a footnote. Google acts as our processor: the data sits in a property we control and Google deletes it when we say so. Meta acts as an independent controller under the Meta Business Tools Terms: what it receives becomes Meta’s, held under Meta’s own retention rules and its own privacy policy. We can stop sending to Meta at any time, and we can clear what is stored on your phone, but we cannot delete Meta’s copy on your behalf. To ask Meta directly, use the controls in your Meta account or the routes in the Meta Privacy Policy. Meta receives the same product steps as Google — never the purchase events — your advertising identifier, and the coarse region derived from your IP address, and nothing else. Its row is in Section 11.

Turning it off, and deleting what is on your device

• Settings → Privacy, at any time, in no more taps than it took to allow. Each choice has its own switch and a change applies immediately.
• Turning a choice off also deletes the analytics identifiers stored on your device — Google’s and, if you turn off ad measurement, Meta’s — so nothing collected afterwards can be joined to anything collected before.
• Settings → Privacy → Delete analytics data does that on its own, without changing your choices.
• Neither can reach data Google or Meta have already received, and the two halves have different answers. For the Google side, write to support@flowroid.com and we will action it, because Google holds it as our processor; we answer within 30 days. For the Meta side we can stop sending but cannot delete on your behalf, because Meta holds it as its own controller — ask Meta directly through your Meta account or the routes in the Meta Privacy Policy.

How long it is kept

Google expires the user- and event-level analytics data after 2 months, the shortest retention Google Analytics offers; aggregated reports outlive it and contain nothing that identifies a device. Our own licence records are separate, are not analytics, and are covered by Section 14.

Meta’s retention is Meta’s, not ours. We do not set it and cannot shorten it; it is governed by the Meta Privacy Policy. This is the practical consequence of Meta being an independent controller rather than our processor. It is the main reason the two recipients are described separately above rather than lumped together.

Your US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana or another US state with a comprehensive privacy law, this subsection is for you.

We do not sell personal information for money, and we never have. We do not use your data for targeted advertising either: Flowroid does not ask for ad personalization, and tells Google, for every user, not to use what it receives for personalised ads. If you allow ad measurement, Google Ads and Meta each learn that one of our advertisements brought you to Flowroid, and we use that only to measure and bid on our own campaigns. Those laws define a “sale” and a “share” broadly, and we would rather tell you exactly what happens than argue whether measuring our own ads falls inside “sharing for cross-context behavioural advertising”.

Because Meta receives it as its own controller rather than as our processor, we treat that disclosure as a “share” and give you the opt-out those laws require. Two things follow. First, the opt-out is the Ad measurement switch described below, and it starts off. Second, for every event we send — from every device, in every country, not only in the United States — we set Meta’s Limited Data Use flag, which asks Meta to use the data for measurement and attribution rather than for ad targeting or building a profile of you. We apply it everywhere rather than only where the law demands it, because deciding which users are American means guessing at their location, and we would rather not guess.

You also have the right to know what we hold about you, to have it deleted, to have it corrected, and not to be discriminated against for exercising any of those rights — Flowroid is identical in every feature and price whatever you choose here. Because there are no accounts, the identifier we hold is the device key shown at Settings → About → Device key; quote it when you write to support@flowroid.com. We do not use or disclose sensitive personal information for inferring characteristics, and we do not knowingly process the data of anyone under 18 — Flowroid is an adults-only app.

09Embedded HTTP Server

Flowroid includes an optional local HTTP server (off by default) that allows external systems to trigger flows via REST API. By default, the server binds to 127.0.0.1 (loopback only) and is not reachable from other devices on the network. An explicit “Enable LAN access” setting expands the bind address to 0.0.0.0.

When the server is enabled, any HTTP requests received are processed locally. You are responsible for securing access (API key, network configuration). We recommend not enabling LAN access on untrusted networks.

10User-Configured HTTP Requests

The HTTP Request action lets you send data to any URL you configure. You are fully in control of what data is sent and to which endpoint. Flowroid does not inspect, log, or intercept the content of these requests beyond what is necessary to execute them. You are responsible for the privacy implications of the endpoints you call.

11Third-Party Services

Flowroid shows no advertisements, and it uses no third-party crash reporting — crash reports are written on your device and stay there. It does integrate two measurement SDKs, Google Analytics for Firebase and Meta (Facebook) App Events; both are used to understand which of our own advertising campaigns work, neither shows you anything, and neither collects anything at all until you allow it — Meta’s not even then, unless the choice you allowed was ad measurement. Both are covered in full in Section 8. Beyond that, the app calls a server of ours for the licence check in Section 6, and — only if you use them — the AI assistant and AI steps in Section 7.

One row in that table is not like the others. Every service above acts as our processor — it handles the data on our instructions and deletes it when we say so — except Meta (Facebook) App Events, which receives what we send as an independent controller. That distinction decides what we can promise you about deletion, and it is set out in Section 8.

This table is about the app, which is what everything above it describes. The website you are reading is a separate thing with separate answers — a different measurement tool, cookieless and with no advertising use — and it gets its own section rather than a footnote: Section 12.

12This Website

Everything above describes the Android app, whose own measurement — consent-gated, per purpose, and carrying nothing you created — is in Section 8. This section is about this website, which is a different collector with a different recipient and a different lawful basis: cookieless page counts, no advertising use, no identifier that survives the day. It says exactly what is counted — including how to switch it off, at the bottom.

What is counted

• Page views — the page’s address, the page that linked to it, and the campaign parameters on the link if it carried any. Every other query parameter is stripped in your browser before anything is sent.
• Your browser’s own headline facts — browser, operating system, device type, screen size, language, and the country your network resolves to. Not your IP address: it is used to work out the country and is never stored.
• A short list of interactions — which call to action was pressed, which help question was opened, which table-of-contents entry was followed, how far down a page was read, and which address produced a 404.

What is not

No cookies are set and no identifier is stored in your browser. A visit is recognised only by a one-way hash of your network address and browser, salted with a value that is rotated daily — which means the same person on the same browser is not recognisable across days and is never recognisable across sites. There is no advertising network, no data broker, no cross-site profile, and nothing is sold or shared.

Nothing you type is measured. The support composer and the deletion request on this site assemble a draft in your browser and send nothing anywhere; what is counted is that a draft was opened and which topic it used, never a word of what it says.

Where it goes

To https://umami.pharadev.com/api/send, our account with Umami — an open-source, cookieless analytics engine, hosted here by its maker, which processes these events on our instructions as our processor and for no purpose of its own.

The rows are kept while the site is measured. There is no request to make about them and none we could act on: they carry no name, no address, no account and no identifier of yours, so there is nothing in them to look up, export or erase. The deletion route in Section 14 is about the app’s licence records, which are a different thing entirely.

Turning it off

Three ways, any of which is enough. Your browser’s Do Not Track setting and the Global Privacy Control signal are both honoured, and neither needs anything from us. Or switch it off for this browser here — the setting is kept in this browser only, so it does not follow you to another one:

A content blocker also works, and nothing on this site breaks when the tracker is blocked: it is loaded after the page is usable and nothing waits on it.

13Data Sharing and Disclosure

We do not sell your personal data for money and we never have. US state privacy laws define “sell” and “share” more broadly than that, and Section 8 explains exactly what allowing ad measurement sends to Google Ads and to Meta, and how to opt out. Beyond that, your data is disclosed only as follows:

• Google Play Billing — the one-time unlock, Flowroid AI subscriptions and top-ups are handled by Google. We receive a purchase token and the purchase state, not your payment details.
• Google (Gemini API) — answers the AI assistant and your flows’ AI steps. If you use the assistant, your message and its conversation context, and if a flow runs an AI step, that step’s prompt, are shared with Google as our sub-processor, for the sole purpose of generating that reply. Nothing is shared unless you use the assistant or a flow runs an AI step. See Section 7.
• Google (Analytics for Firebase, and Google Ads) — only if you allowed it, and only for the choices you allowed. Nothing is shared if you declined or have not answered, and nothing shared this way contains anything you created. Google receives it as our processor. See Section 8.
• Meta (Facebook) App Events — only if you allowed ad measurement, which is off until you turn it on. Meta receives it as an independent controller, under Limited Data Use, and nothing shared this way contains anything you created. Nothing at all is shared if you declined, have not answered, or allowed only product analytics. See Section 8.
• Our hosting provider — the records in Section 5 are stored on Google Cloud infrastructure in europe-west1 (Belgium) under a data-processing agreement. Google processes them on our instructions only.
• Our website analytics provider — the anonymous page counts described in Section 12 are processed on our instructions by the host of our Umami instance. They concern this website, not the app, and contain no identifier of yours.
• Legal obligations — if required by law, court order, or to protect the safety of any person.
• User-initiated HTTP requests — data you send via the HTTP Request action goes to the endpoints you configure. This is entirely under your control.

14Data Retention and Deletion

On your device

Everything Flowroid creates while automating (flows, variables, execution logs, crash reports) lives on your device, and you can delete it at any time:

• Flows and variables: delete individually within the app, or use Settings → Reset App Data to wipe everything.
• Execution logs: Settings → Logs → Clear Logs.
• Crash reports: Settings → Logs → Clear Crash Reports.
• All app data: uninstalling Flowroid removes every locally stored file from your device.

On our server

The retention period for each record is listed in Section 5: request logs are deleted after 30 days, a purchase record 90 days after the entitlement stops being active, the AI usage meter after 12 months, and the device record is kept for the life of the product unless you ask us to delete it. Your AI credits (balance and ledger) belong to your purchase, not to one device, and are kept while they are yours to spend, because purchased credits do not expire. A deletion request erases them when the device asking is the last one linked to the purchase. A one-way hash of each credit pack you bought is kept, unlinked from you, so the same purchase cannot be redeemed twice.

Nothing you asked the assistant, and no AI step’s prompt, is retained by us at any point (Section 7), so there is no conversation history on our side to delete or export.

Analytics data is not ours to keep or delete. If you allowed it, Google holds it and expires the user- and event-level rows after 2 months — the shortest retention Google Analytics offers. If you allowed ad measurement specifically, Meta holds a copy too, and Meta’s retention is Meta’s, not ours. We do not set it and cannot shorten it; it is governed by the Meta Privacy Policy. This is the practical consequence of Meta being an independent controller rather than our processor. Turning a choice off in Settings → Privacy stops collection and deletes the identifiers on your device, but it cannot reach what either has already received. For the Google half, write to us and we will ask on your behalf; for the Meta half we can stop sending but cannot delete on your behalf, so the route is Meta’s own (Section 8).

To have your device, purchase and AI records deleted, follow the request route at flowroid.com/data-deletion. It explains what is removed, what to include so we can find your record, and the two consequences worth knowing in advance: deletion resets the trial for that device, and your unlock and any Flowroid AI subscription have to be re-linked with Restore purchase. We cannot delete your Google Play order record; that is Google’s, and you can manage it in your Google account.

15Security

We apply the following security measures to protect your data:

• Secret variables are encrypted using AES-256 via the Android Keystore. If Keystore initialisation fails, the app refuses to store secrets rather than falling back to plaintext.
• All traffic between the app and our server — licence checks, assistant requests and AI steps alike — is encrypted in transit with TLS 1.2 or higher, against a certificate pinned in the app.
• The records in Section 5 are encrypted at rest. Assistant and AI-step content is never at rest on our side to begin with.
• The licence database has no public IP address. It is reachable only from the licence service over a private network path, never from the open internet.
• The API server requires an API key by default.
• The HTTP Request action maintains a blocklist against Server-Side Request Forgery (SSRF) attacks targeting loopback, link-local, and RFC 1918 private addresses.
• Boot receivers and background services are not exported and cannot be invoked by third-party apps.

16Children's Privacy

Flowroid is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data through the app, please contact us at the address below so we can take appropriate action.

17Your Rights

There are two sets of data and two routes to them — plus the analytics you may have allowed, which has a third route and is covered at the end of this section.

Data on your device

You hold this outright. No request to us is needed, and none is possible: we cannot reach it.

• Access — view all flows, variables, and logs within the app.
• Correction — edit or delete any flow or variable at any time.
• Deletion — Settings → Reset App Data, or uninstall the app.
• Portability — export your flows as JSON files via the import/export feature.

The records on our server

For the records in Section 5 you have the rights of access, rectification, erasure, restriction of processing, objection, and data portability under the GDPR, and comparable rights under other applicable privacy laws. There is no assistant history among them: we keep none.

Erasing your device record resets the 14-day trial for that device, and erasing your purchase record detaches your unlock and any Flowroid AI subscription from it. If it is the only device on your purchase, the purchase’s AI meter and any unspent purchased credits are erased too — only a one-way hash of each credit pack, unlinked from you, stays so it cannot be redeemed twice; if other devices still use it, they keep the purchase, its meter and its credits. If you have paid for Flowroid and then ask us to erase these records, use Restore purchase afterwards: your entitlement lives with your Google account, not with the record we deleted.

Analytics and ad measurement

These run on your consent (GDPR Article 6(1)(a)) and on nothing else, which gives you a right the rest of this policy does not: you can withdraw it at any moment, with no reason and no request to us. Each choice has its own switch in Settings → Privacy, a change applies immediately, and turning a choice off also deletes the analytics identifier stored on your device. Withdrawal does not affect the lawfulness of anything collected beforehand, and it changes nothing else about Flowroid — same features, same price. Section 8 has the detail, including what neither switch can reach. One limit is worth stating here rather than only there: withdrawal stops all future sending, but the copy Meta already holds is Meta’s own, not ours, and we cannot delete it for you — ask Meta through your Meta account or the routes in the Meta Privacy Policy. Data Google holds as our processor we can and will have deleted on request.

If you are in the United States, your state may give you additional rights over advertising data specifically — those are set out in the same section.

You may object at any time to the processing we carry out on the basis of legitimate interests (Section 6). If you believe we have handled your data unlawfully, you can also complain to your national data protection supervisory authority.

Your Google Play order record is held by Google as its own controller. To exercise rights over it, contact Google directly.

18Changes to This Policy

We may update this Privacy Policy when the app’s data practices change. We will update the “Last updated” date at the top of this page. For significant changes, we will provide notice within the app. Your continued use of Flowroid after an update constitutes acceptance of the revised policy.

19Contact

For privacy-related questions or requests, please contact:

• E-mail: support@flowroid.com

Back to top