Scope: website and client
This policy applies to flowyspace.com and the FlowySpace Windows client. The website currently introduces the product and displays client interfaces; a web workspace is not yet available. The client provides cloud accounts, work record management and AI assistant features.
Client screenshots on the website use fictional data. The current homepage does not provide business data entry, account sign-in or real AI conversations. It does not connect to the production business database or call real AI services.
Browsing the website still involves necessary network requests and uses Cloudflare hosting, security and analytics, as described below. This network and analytics processing is separate from data processing for client work accounts.
Information processed by the client and its purposes
- Account and profile information: your sign-in email, account identifier, authentication status, and the name, avatar and other profile details you set, used for authentication, account linking and profile display.
- Work records: tasks, work items, projects, meetings, follow-ups, people and contact details, materials and contracts, costs and their relationships that you submit, used to save, find, organize and sync your work. Please make sure you have the right to submit information about others.
- Files and attachments: files you choose to upload, along with their names, types, sizes and related information, are processed by cloud storage. Local file references, links and downloaded copies are saved locally or in related records according to the actions you take.
- Conversations and memories: messages you send, assistant replies, conversation summaries and memories you choose to save, used to continue conversations, find records and provide the AI features you enable.
- Necessary operational information: technical information such as authentication, request status, errors, delivery receipts and security audits, used to troubleshoot issues, prevent duplicate operations and maintain account and service security.
The client uses Supabase for authentication, the database, file storage and server-side processing. Necessary caches are kept locally by account so cached content can be read. Creating and changing work records requires an internet connection.
Google user data processing
When you select “Continue with Google”, Google sign-in uses only the basic openid, email and profile scopes to verify your identity, sign you in and link your FlowySpace account. Information may include your Google identifier, email and verification status, name, avatar and other basic profile details.
Identity and basic profile information returned by Google may be stored in Supabase Auth user or identity records. The client does not automatically overwrite the name and avatar you have set, add Google profile information to the People module or replace your chosen assistant name.
- Access and purpose
- Only the basic openid, email and profile scopes are used. Basic identifiers, email and verification status, name and avatar are accessed for authentication, FlowySpace account linking and necessary account functions. They are processed separately from work information you enter yourself.
- Storage locations
- Basic identity information returned by Google may be stored in Supabase Auth identity and user records. The client stores necessary account identifiers, sign-in email and authentication status. If you choose to stay signed in, session information is protected by DPAPI within the current Windows user's scope. Your Google name and avatar do not automatically replace the profile you set.
- Google and Supabase
- Google processes the identity authorization you initiate. Supabase Auth receives and verifies the authentication result and stores related identity records for authentication, account linking and session management.
- Email flows
- When you request registration, email-code sign-in or password recovery, Resend processes the recipient email and necessary authentication email content. If you separately enable email reminders, Resend receives the current account's verified sign-in email and minimal reminder content, not your Google avatar or full identity profile. Google sign-in does not require you to subscribe to reminder emails.
- AI flows
- The current application does not automatically import Google Auth identity records, your Google name or avatar into AI context. OpenAI receives messages from AI requests you initiate, necessary context and matching work information; the user name in that context comes from the personal work profile you set. Image requests also include a hashed safety identifier derived from the FlowySpace account for provider safety processing, not a Google user identifier. Email addresses or other personal information you enter in messages may still be sent to OpenAI with those messages; this is distinct from data returned by Google sign-in.
- Security, retention and requests
- Measures include HTTPS, authentication and account-based access restrictions. Data is retained for the purposes needed to provide account services, without a fixed-day promise. Deletion and account closure requests are handled manually through the contact email. After verifying account ownership, we explain and process what can be deleted and what must be retained for legal requirements, necessary backups or similar reasons. Revoking authorization, signing out or uninstalling does not automatically delete cloud identity or work records.
We currently do not request access to Gmail messages, Google Drive files or Google Calendar data, and we have not integrated Google Cloud Storage. Signing in does not give FlowySpace the ability to read your email, Drive files or Google Calendar.
Google user data is used only for the disclosed authentication, account linking and necessary account services, not for advertising targeting, sale, surveillance, or training or improving general-purpose AI models. Google sign-in data is not a source for image generation. AI document and image generation is provided by OpenAI and relates to work content and AI messages you submit; it does not rely on access to Google Workspace data.
FlowySpace's use of information received from Google APIs and transfer of that information to other apps will comply with the Google API Services User Data Policy, including applicable Limited Use requirements. If new Google data types or purposes are needed in the future, we will update disclosures and obtain authorization where required, rather than treating existing sign-in authorization as permission for new access.
Google API Services User Data Policy
You can manage or revoke authorization in your Google Account's third-party connections settings. Revoking authorization affects subsequent Google sign-in but does not automatically delete your FlowySpace account or saved cloud records. To request deletion, follow the contact process in this policy.
Data processing by Milo and custom-named assistants
Milo is the default assistant name; you can use a name you set yourself. When you use the assistant, messages, relevant conversation context, necessary summaries, enabled memories and matching work records needed to complete the request may be sent through FlowySpace servers to OpenAI. These are used to generate replies, search, organize, prepare work record changes or generate documents and images. Queries about public web pages also use OpenAI web search to process necessary query content.
Current work searches provide necessary matching record names, statuses, schedules, relationship identifiers, people's names and organizations, and excerpts of descriptions. They do not automatically upload the entire materials library. The materials library is not currently connected to OpenAI Vector Stores or File Search.
Content you enter or reference may itself contain personal, confidential or third-party information. This policy therefore does not mean that “personal information will not be sent to AI”. Check content before sending it and avoid submitting sensitive information that is not needed for the request.
Conversations, replies, context summaries and saved memories may be stored in cloud services used by FlowySpace and cached locally. You can disable memory in the client or confirm clearing saved memories. Clearing memories does not also delete the original conversations, context summaries or work records.
The assistant prepares work record changes for you to review and confirm before execution. OpenAI's processing, retention and other use of requests are governed by the actual service configuration and its applicable policies. This policy does not promise that AI services retain nothing, never use data for training or completely delete it within a fixed period.
Third-party services and recipients
Provides Google authentication when you choose it, processing sign-in authorization and basic identity information. As the contact email provider, Google also processes requests and correspondence you send us.
Google Privacy Policy- Supabase
Provides Auth authentication, the database, Storage file storage and Edge Functions server-side processing, handling necessary account information, work records, files, conversations and operational information.
Supabase Privacy Policy- OpenAI
Processes messages, context and work information needed for requests when you use the AI assistant, summaries, memory extraction, content generation or web search.
OpenAI Privacy Policy- Cloudflare / Turnstile
Provides website hosting, DNS, HTTPS, security and analytics. Relevant client authentication flows use Turnstile for human verification, which may process necessary technical information such as IP addresses, browser or device signals and verification results.
Cloudflare / Turnstile Privacy Policy- Resend
Sends registration, sign-in and password recovery code emails, and reminders if you enable them. Processes recipient email addresses, email content and necessary sending and delivery status.
Resend Privacy Policy
OpenAI API data processing information
These providers process necessary data to deliver their respective features. This is different from sharing your content with other users or the public. Using these features does not cause us to proactively publish your work records as public content. If you copy, export or share through other channels, consider the recipients and permissions involved.
These services and their infrastructure may be outside your country or region. Information may be transferred across borders or processed abroad. Processing locations and provider retention and backup arrangements depend on the actual service configuration, applicable provider policies and legal requirements. We do not promise that all data is processed in any one country or region.
Website requests, analytics and browser data
The website is delivered by Cloudflare Pages. To deliver pages and maintain security, Cloudflare may process IP addresses, requested URLs, browser information, timestamps and necessary network logs. The production domain also currently loads Cloudflare Web Analytics for page visits and loading performance statistics. See Cloudflare's privacy policy and Web Analytics documentation for this technical processing.
The current product website does not write work content to cookies, localStorage or a production work account. Temporary interface states, such as menus and image previews, are used only for interactions on the current page. Your browser may cache pages and static assets; Cloudflare separately provides network, security and analytics processing.
Your chosen interface language is stored locally in this browser to remember your preference. This record contains only the language option, not work records. Select “Use browser language” to clear the manual preference. The current website does not sync this preference to a work account.
Notifications and email
The client provides in-app notifications, local Windows notifications and email reminders separately. Email reminders are off by default and can be enabled or disabled in Settings → Notifications. When enabled, they are sent to the current account's verified sign-in email, not automatically to ordinary contacts in the People module.
Reminder emails contain the necessary title, reminder category, time and instructions for opening the client. They do not contain business attachments, contract text or full notes. Disabling reminders does not recall emails already sent. Authentication emails needed for registration, sign-in or password recovery are separate from optional reminders and are not controlled by the reminder switch.
Local system notifications are provided through Windows; their display also depends on system notifications, Do Not Disturb and device policies. Enabled cloud email reminders may still be sent as scheduled after the client has exited. To stop them, disable email reminders in notification settings first.
Local storage, sign-out and uninstallation
The client stores necessary account caches, work record snapshots, downloaded files and related state locally. If you choose to stay signed in, recoverable sign-in information is protected by DPAPI within the current Windows user's scope. You are responsible for managing files you save or export on your device.
Signing out ends the current client session and clears that account's sign-in information, primary work snapshots and file cache. Some protected account-related receipts may remain to resolve uncertain operation results. Signing out does not close your account, delete cloud work data or delete files you saved separately or exported.
Uninstallation primarily removes the program and its installation registration. Local user data and sign-in state are retained by default for reinstallation. Uninstalling is not the same as signing out or deleting cloud data. Before handing over or retiring a computer, sign out and handle remaining data and separately saved files as needed.
Retention and deletion principles
We retain information for as long as needed for the purposes of the services provided. Retention and deletion also take into account deletion requests, account and security verification, operation receipts, legal requirements, provider backups and system recovery. This policy does not currently promise a uniform fixed number of retention days.
Editing, deletion and memory-clearing actions available in the client affect only their corresponding content. Archiving, signing out, uninstalling or revoking Google authorization does not mean all data has been deleted. These actions do not automatically recall sent emails, separately saved files or data already received by third parties.
A complete self-service account closure feature is not currently available. Deletion or account closure requests are handled manually through the email below. After verifying account ownership, we process requests within actual capabilities and explain the scope and any parts that cannot be deleted immediately, with reasons. Logical deletion, backups and third-party processing may have different cleanup arrangements; we do not promise immediate and complete removal of every copy.
Security measures
We use measures including HTTPS, account authentication, account-based data access restrictions, server-side validation and protection of local sign-in information and related caches. AI changes to work records also require user confirmation. These measures aim to reduce risk and cannot guarantee absolute security of networks, devices or third-party services.
Protect your email, device and sign-in credentials. Do not share passwords or verification codes. If you suspect account misuse, a data leak or another security issue, contact us promptly at the email below.
Access, correction and deletion requests
You can view your work records in the client and use the editing, deletion and notification settings provided. To access, correct or delete other account-related information or request account closure, email us with the request type and the relevant account email.
When you contact us by email, the email address, request details and necessary verification information you provide are used to handle your request, communicate the result and keep necessary processing records. The email provider also processes this correspondence.
We first verify account ownership, then handle the request and communicate the outcome according to its scope, our actual capabilities and applicable requirements. Do not send passwords, verification codes, sign-in tokens or unrelated sensitive material in your request. Any necessary verification method will be communicated separately.
Policy updates
When product features or information processing practices change, we will update this page and the date at the top. Significant changes affecting purposes, scope or user rights will be explained through the website or appropriate in-product channels. Where separate authorization is required, we will obtain it as applicable.
Contact us
Operator: DorlakGong. For questions about this policy, personal information processing, deletion or account closure, contact: