Flowly
FREN

Privacy Policy

Last updated : May 18, 2026

At Flowly, we take your privacy seriously. This policy explains what data we collect, why, and how you stay in control.

1. Data controller

The data controller for personal data is Flowly, based in France.

For any privacy-related question, reach us at support@myflowly.co.

2. Data we collect

We only collect what's necessary for the service to work:

  • Account data: email address, first name or alias, Apple Sign-In identifier (if you use "Sign in with Apple").
  • Habit data: goals, habits you create, completion history, streaks.
  • Onboarding data: declared emotional state, past experience with routines, daily available time, preferred progression style, support preference.
  • Subscription data: subscription status, transaction identifiers (Apple App Store, Google Play). We never receive your payment card number.
  • Technical data: push notification token, language and theme preferences, device model and OS version (for diagnostics).
  • Usage data: interactions with the app (screens opened, actions), timestamps, to improve the product.
  • Advertising identifier (IDFA) — only if you accepted tracking through the iOS App Tracking Transparency prompt. Used solely to know which ad brought you to Flowly. See section 7.

3. How we collect this data

  • Directly: when you create an account, complete onboarding, or use the app.
  • Via Apple Sign-In: if you choose this sign-in method, we receive an anonymous identifier and, depending on your choice, your email (real or Apple relay).
  • Automatically: non-identifying technical information (device type, system language) while you use the app.

4. Why we process this data

  • To provide and maintain the Flowly service.
  • To generate your personalized routines via AI.
  • To send the notifications you've enabled.
  • To understand aggregated app usage and improve the product.
  • To handle support requests.
  • To manage subscriptions and payments (via Apple and Google).

5. Legal basis (GDPR)

  • Performance of a contract: to provide the service you subscribed to.
  • Consent: for push notifications and sensitive data (emotional state).
  • Legitimate interest: to improve the service and prevent abuse.
  • Legal obligation: to retain transaction records.

6. Third-party services and processors

Flowly is a small team. To deliver the app we rely on a short list of carefully selected processors that handle data on our behalf under a Data Processing Agreement (DPA). We never sell your data. Each service applies its own privacy policy in addition to the protections described here:

  • Supabase, Inc. (United States — hosting and database). Stores your account email, profile, goals, habits, completion history, streaks and AI generation history in a PostgreSQL instance hosted in the European Union. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). DPA and Standard Contractual Clauses in place. https://supabase.com/privacy
  • OpenAI, L.L.C. (United States — AI habit generation and weekly coaching reports). When you create a goal or request an AI-generated plan, we send the inputs needed to personalize it — goal title, goal description, anchor habits you have chosen, and onboarding answers such as time availability and motivation — to OpenAI's API so it can return a routine. OpenAI does not use API content to train its models. No data is sent to OpenAI for users who never trigger an AI feature. The disclosure is also shown in-app the first time AI generation runs. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). DPA and Standard Contractual Clauses in place. https://openai.com/enterprise-privacy
  • PostHog Inc. (EU region — eu.i.posthog.com — product analytics). Receives anonymous usage events (screen views, button taps, drop-off points) so we can understand how the app is used and improve it. We do not send your email, password, goal titles or habit content to PostHog. You can opt out at any time in Settings → Privacy & Data → Opt out of analytics. Legal basis: legitimate interest in product improvement (Art. 6(1)(f) GDPR), with the in-app opt-out as your right to object (Art. 21 GDPR). https://posthog.com/privacy
  • Apple (Sign in with Apple, StoreKit, push notifications). https://www.apple.com/legal/privacy/
  • Expo (builds, OTA updates, push notification routing). https://expo.dev/privacy
  • AppsFlyer Ltd. (Israel / United States — advertising attribution measurement). Receives an install identifier, install and subscription events, and — only if you consented through the App Tracking Transparency prompt — your device's IDFA, which it may pass to Meta and TikTok so the ad you saw can be credited. It never receives your goals, your habits or your notes. Legal basis: consent (Art. 6(1)(a) GDPR). See section 7 below. https://www.appsflyer.com/legal/services-privacy-policy/
  • RevenueCat, Inc. (United States — subscription management). Receives an anonymous user identifier and your subscription status, in order to verify your purchases with Apple. It receives neither your email, nor your goals, nor your habits. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). https://www.revenuecat.com/privacy/

7. Advertising and attribution

Flowly runs paid ads on Meta (Facebook, Instagram) and TikTok. To know which ad actually brings people in — and therefore to stop paying for the ones that bring nobody — we use AppsFlyer (attribution measurement) and Apple's SKAdNetwork.

On iOS this can involve your device's advertising identifier (IDFA). Apple requires us to ask you first, through the system prompt called App Tracking Transparency. That prompt is a real question, not a formality:

If you say no — and you can, at any time, in iOS Settings → Privacy & Security → Tracking — we do not read your IDFA and we do not track you across other companies' apps and websites. Attribution then rests solely on Apple's SKAdNetwork, which reports to us in aggregate and tells us nothing about you individually. Nothing in Flowly stops working. No feature is reduced. You lose nothing.

If you say yes, AppsFlyer may receive your IDFA along with install and subscription events, and may pass attribution signals to Meta and TikTok so that the ad you saw can be credited.

Under California law (CPRA) this constitutes sharing of data for cross-context behavioural advertising, and under Apple's rules it constitutes tracking. We declare it as such on our App Store privacy label rather than burying it in a paragraph.

What we do not do, and will not do: we do not sell your data. We do not build an advertising profile about you. And we never send your goals, your habits, your notes, or the content of anything you write in the app to an advertising partner.

Legal basis (GDPR): consent (Art. 6(1)(a)), collected through the App Tracking Transparency prompt. You can withdraw it at any time, with no consequence for your use of the app.

8. Data retention

Your data is retained as long as your account is active.

If you delete your account, all personally identifiable data is deleted within 30 days. Some anonymized data may be retained for statistical purposes, and some transaction records may be retained to meet our legal obligations (accounting, tax).

9. International transfers

Your data is hosted by Supabase on servers located in the European Union and/or the United States. Non-EU transfers are covered by Standard Contractual Clauses (SCCs) as required by the GDPR.

10. Your rights (GDPR — EU users)

If you reside in the European Union, you have the following rights:

  • Access to your personal data.
  • Rectification of inaccurate data.
  • Erasure ("right to be forgotten").
  • Portability of your data in a structured format.
  • Restriction of processing.
  • Objection to processing based on legitimate interest.
  • Withdrawal of consent at any time.
  • Lodging a complaint with a supervisory authority (in France: CNIL — https://www.cnil.fr).

To exercise your rights, email us at support@myflowly.co. We respond within 30 days.

11. Your rights (CCPA/CPRA — California residents)

If you reside in California, you additionally have the following rights:

  • Right to know what personal data is collected and how it's used.
  • Right to delete your personal data.
  • Right to correct inaccurate data.
  • Right to opt out of the sale or sharing of your data. Flowly never sells your data. However, if you accepted advertising tracking (the App Tracking Transparency prompt), an identifier is shared for cross-context behavioural advertising within the meaning of the CPRA — see section 7. You can refuse, or change your mind, at any time in iOS Settings → Privacy & Security → Tracking, and lose nothing in the app.
  • Right to non-discrimination for exercising these rights.

12. Sensitive data

Some information you provide (emotional state, wellness goals) may be considered sensitive. It's used solely to personalize your routines. It's never shared with third parties for commercial purposes and is not used to train public AI models. Processing relies on your explicit consent, which you can withdraw at any time by deleting your account.

13. Minors

Flowly is not intended for users under 16. We do not knowingly collect data from minors under 16. If you believe a minor has provided us with data, contact us at support@myflowly.co for deletion.

14. Push notifications

If you enable notifications, we store an opaque token provided by Apple or Google to deliver the reminders you've configured. This token doesn't allow us to identify you personally. You can disable notifications any time in your device settings or in the app.

15. Microphone & voice input

Flowly uses your device's microphone for voice input (speech-to-text) when you choose to dictate a goal description. Audio is processed in real time on your device using native platform APIs (SFSpeechRecognizer on iOS, SpeechRecognizer on Android).

No audio recording is stored, sent to our servers, or retained after transcription. The resulting text is used solely to fill in the goal description field.

You activate the microphone manually each time — Flowly never listens in the background. The RECORD_AUDIO permission can be revoked at any time in your device settings.

16. Calendar access

Flowly may request access to your device calendar (Apple Calendar or Google Calendar). This access is used exclusively to analyze your busy time slots and suggest the best times for your habits.

No calendar events are copied, stored, or sent to our servers. The analysis is performed locally on your device.

Calendar access is entirely optional — the app works normally without it. You can revoke the permission at any time in your device settings.

17. Speech recognition

Voice input relies on your operating system's built-in speech recognition services (Apple Speech Recognition on iOS, Google Speech Services on Android). Flowly does not handle or process audio directly — the operating system does.

Apple's and Google's respective privacy policies apply to the system-level voice processing. Flowly only receives the transcribed text, never the raw audio.

18. Security

All communication between the app and our servers is encrypted via HTTPS (TLS). Data is stored securely with Supabase (Row Level Security enabled). On iOS, sensitive local information is stored via SecureStore (Keychain). No system is bulletproof, but we follow recognized industry standards.

19. Changes to this policy

We may update this policy to reflect product or legal changes. For material changes, we'll notify you by email or via an in-app notice before the changes take effect.

20. Contact us

For any question, rights request, or complaint, email us at support@myflowly.co. We aim to respond within 30 days.