← flow-graph.com

Privacy Policy

Effective: August 11, 2026 · Contact: help@flow-graph.com

What stays on your device

• Your vaults: every graph, card, edge, document, IFC model, run history, and setting — stored in your browser (or your own disk with the pip install).
• Your AI provider keys — stored locally and sent only through the route you chose. The local pip app can use your Codex or provider connection. The hosted Free Preview uses FlowGraph's server-side AI route and sends the goal you submit for that map to the disclosed provider.
• Local vault content that you have not synced, shared, or submitted to a cloud feature.

What we store if you create an account

• Your email address and display name (from the email you enter, or your Google/GitHub profile if you use one-click sign-in — we receive only basic profile info, never your contacts or repositories).
• Your plan, subscription state, and entitlement records.
• Eligible personal graphs protected across devices and documents you explicitly share, stored with tenant isolation, plus the minimum revision and audit metadata needed for governed review.

Payments

Card-backed trials and payments are processed by Stripe. Card details never touch FlowGraph servers or code. We store only the customer/subscription identifiers and status/timing needed to enforce the trial and entitlement.

Cloud 3D translations (Autodesk APS)

If you choose "View with APS (cloud)" for a Revit/Navisworks/DWG/DGN file, that file is sent to Autodesk's cloud for conversion — always behind an explicit consent step that says so. With your own Autodesk app, the traffic is between you and Autodesk. On our platform quota, we meter usage counts (not file contents).

Analytics & error reporting

• Hosted site only: cookieless page analytics and first-party activation events. Activation events record a random browser/journey/session ID, an opaque account ID after sign-in, entry/start route, coarse device and viewport, milestone result, latency, coarse object count, explicit technical failure code, and a blocker reason only when you deliberately choose one.
• Activation analytics never contain prompts, graph or card text, titles, filenames, email addresses, exact URLs, or session replay. A stop point is stored only as the last observed milestone; silence is never labeled as confusion or intent.
• The pip-installed app sends no graph-content analytics, crash beacons, or session replay. It does contact FlowGraph when you explicitly sign in, refresh an entitlement, use account sync/sharing, or invoke another hosted feature.

How you found us (attribution)

When you arrive from one of our content pages or a campaign link, the address may carry a short source tag (?src= or a standard utm_source) — for example ?src=ifc-viewer. We remember only that one short tag for the current browser session, using session storage on your device — no cookie, no cross-site identifier, no fingerprint. If you later create an account, that single tag is attached to your signup as a plain field so we can learn which pages are useful. It is never sold, never linked across sites, and it disappears when you close the browser tab if you don't sign up. It is not used for the local, account-free path at all.

What we never do

• Sell or share your data with advertisers. No ads, no data brokers.
• Train AI models on your content.
• Read your vaults. We structurally can't for local-only users; for synced vaults we access content only as needed to operate the service or as you direct (e.g., a share you create).

Data deletion

Local data: delete it yourself — it's yours, on your machine. Account data: email help@flow-graph.com and we delete your account, plan records, and synced content within 30 days (billing records are retained as legally required).

Changes

If this policy changes materially we'll note it in the app's "What's new" and on this page. Questions: help@flow-graph.com.