FlowQuota - Privacy Policy

1. What Information We Collect

When you use FlowQuota, we may collect and process:

Account and profile information

• Your name, if you provide it
• Your email address
• Your login details, stored securely
• Basic profile, settings, invite, trial, plan and access information

When you allow Marketing measurement in Cookie Settings, FlowQuota may store limited acquisition and campaign attribution parameters from your registration link against your account: utm_source, utm_medium, utm_campaign, utm_content and utm_term. These help us understand how people reach FlowQuota and register. This choice is separate from optional analytics cookies, which are activated only after the applicable consent. With the same Marketing measurement permission, we link a whitepaper request to your registered FlowQuota account and share verified registration and focus-engagement milestones with HubSpot. The random lead reference is pseudonymous personal data, not anonymous data; it never grants account access. We share milestone dates, an internal user reference, reporting classification and whether you currently meet our weekly engagement definition. We do not send session notes, calendar content or work descriptions through this integration. Declining does not affect the whitepaper or product access and does not change marketing-email preferences. Change or withdraw permission through Cookie Settings on any page. When signed in, this also stops future HubSpot milestone sharing for your account; a failed account update is shown so you can retry. Historical records are not automatically erased on withdrawal: contact support@flowquota.ai about deletion.

Subscription and billing information

• Subscription status, plan identifiers and billing-related identifiers
• Payment, invoice and billing portal information handled through Stripe

We do not store your full card details, and FlowQuota does not send payment card details to OpenAI.

Focus and productivity information

• Focus-session data and session data
• Timer and session timing data
• Projects, categories and work labels where you use them
• Completion, outcome and status data where used
• Whether you choose to indicate that AI assisted a Focus session. This is user-declared: FlowQuota does not detect AI use, identify the AI provider, capture prompts or AI outputs, or monitor browser, IDE or application content.
• Generated AI Briefings and briefing history
• Notification and email logs, including AI Briefing notification emails

Technical information

• IP address
• Browser type
• Device information
• Basic usage data, such as pages visited

Website forms and marketing enquiries

If you submit a form on the FlowQuota website, such as requesting a whitepaper or other resource, we may collect:

• Your email address
• Your first name
• Your role or professional category
• Your communication preferences and consent choices
• Information about the form or resource you requested

We use HubSpot to process website forms and manage these contact records. HubSpot processes this information on our behalf as a service provider.

Connected Google Calendar information

If you choose to connect Google Calendar, FlowQuota processes:

• Your stable Google account identifier, email address and available profile name
• OAuth credentials, protected with authenticated encryption
• The names, identifiers and basic settings of calendars available to that account
• Your explicit choice of which calendars FlowQuota may use
• After you separately grant read-only event access, provider event identifiers, status and type, updated metadata, timing or exclusive all-day dates, time-zone metadata, minimal recurring-instance identity, availability, your own response status, whether you organise the event, and whether conference data is present
• A separate provider synchronisation token and privacy-safe synchronisation status for each selected calendar

FlowQuota does not retain event titles, descriptions, locations, attendee identities or lists, organiser identity, meeting links, conference details, attachments, reminders, extended properties or raw Google responses. Eligible historical timed calendar context may appear in History and as separate Calendar Intelligence in Reporting. Calendar events remain separate from Focus Sessions. Calendar scheduled time is not added to Focus or productive-time totals, and calendar data does not calculate or alter Focus Score.

Connected Microsoft Outlook Calendar information

Outlook is disabled by default and available only where explicitly enabled. This initial release supports personal Microsoft accounts, including Outlook.com. Work and school Microsoft 365 accounts are not supported yet. Shared and delegated calendars are not supported. Connecting is optional. Microsoft consent requests read-only Calendars.Read, a broader permission than basic calendar metadata access. FlowQuota discovers only owned calendars. No calendar is selected automatically; only selected calendars supply imported scheduling metadata.

• A stable Microsoft account identifier for connection binding; a Microsoft account email address or profile name is not stored
• OAuth credentials protected with authenticated encryption
• Discovered owned calendar names, identifiers, ownership and basic settings needed for explicit selection
• For selected calendars only, limited scheduling and reconciliation metadata: event identifiers, timing or all-day dates, time zones, status, availability, minimal recurring-instance identity and update metadata
• Privacy-safe sync status and provider continuation state for primary incremental synchronisation

Microsoft may transmit event content during a read, but FlowQuota does not retain event titles, descriptions or body, attendees, locations, meeting links or raw Microsoft responses. FlowQuota never edits your calendars or events. Primary calendars use incremental synchronisation. Owned secondary calendars use bounded calendar-view reads; two complete reads must agree before local metadata is reconciled. Incomplete or inconsistent reads keep existing context. These reads cover the supported scheduling window, not your entire calendar history.

You can connect Google Calendar and Outlook at the same time, with separate calendar selections and sync controls. Working-hours settings apply to both providers. Eligible selected Outlook scheduling metadata contributes to History and Reporting alongside Google Calendar, but scheduled time is not productive Focus minutes and does not change Focus Score. Protected Focus reminders currently use Google Calendar Focus Time only; ordinary Outlook events do not trigger these reminders. Connecting Outlook does not change Google's permissions or Google-data restrictions.

Microsoft APIs process stable account identity, owned-calendar discovery and read-only scheduling data for the optional connection. FlowQuota processes the retained minimal metadata and encrypted credentials in its hosted application and database infrastructure on Render. Disconnecting in Settings removes the Microsoft connection, stored credentials, calendar sources and imported event metadata. Deselecting removes that calendar's imported events and sync state. Pausing stops automatic updates but keeps stored data and permits manual sync. Reconnecting normally uses the same account; explicit replacement clears the previous account's imported context and selections. Outlook events remain unchanged.

2. How We Use This Information

We use this information to:

• Provide the timer, history, reporting, settings and billing features
• Generate AI Briefings for eligible AI-tier users
• Identify focus patterns, time-of-day trends and changes in working rhythm
• Send service, account, billing, lifecycle, product usage and AI Briefing notification emails
• Improve product reliability and user experience
• Prevent misuse, protect accounts and maintain security
• Provide customer support
• To provide resources or information that you request through our website.
• To manage marketing communications where you have provided the relevant permission or where another lawful basis applies.

AI Briefing notification emails alert users when a briefing is ready and link back into FlowQuota. They do not need to include the full briefing.

Promotional product updates, offers and launch news are optional. Where we send promotional messages, you can unsubscribe or opt out from those messages.

We only collect what we need to operate and improve the service.

We process your data under the lawful basis of:

• Contract, to provide the service you signed up for
• Legitimate interest, to improve and protect the service
• Legal obligation, where required
• Consent, for optional analytics and marketing measurement chosen in Cookie Settings

3. AI Briefings and OpenAI

FlowQuota uses the OpenAI API as a third-party AI service to generate AI Briefings. Relevant focus-session and productivity context may be sent to OpenAI solely to generate the user-facing briefing. When calendar-aware briefing context is available, bounded privacy-minimised summaries derived from Google Calendar data may also be included.

FlowQuota sends only the information needed for the briefing. OpenAI processes this information as a service provider to FlowQuota for that purpose. FlowQuota does not send Google Calendar event titles, descriptions, locations, attendee identities or lists, organiser identity, meeting links, conference details, attachments, reminders, extended properties or raw Google responses to OpenAI because FlowQuota does not retain that event content.

FlowQuota does not use Google user data, including raw, aggregated or derived Google user data, to develop, train or improve foundational or generalized artificial intelligence or machine-learning models. FlowQuota does not permit OpenAI or any other third-party AI provider to use Google user data for those purposes.

AI Briefings are generated from bounded FlowQuota evidence and context. They may be imperfect, incomplete or not suitable for every situation.

Calendar information and AI Briefings

If you connect a supported calendar, FlowQuota may derive privacy-minimised contextual summaries, such as aggregate meeting load, Working Hours context, fragmentation patterns or Protected Focus information, and use them to provide additional context for AI Briefings. Calendar events are not treated as focused work, added to productive-time totals or used to calculate your Focus Score. Only bounded contextual summaries from the calendar integration are supplied to the AI briefing process under the applicable privacy controls; raw calendar event content is not treated as productivity truth. Where an AI service provider generates the briefing, those bounded summaries may form part of the information processed for that purpose.

4. Your Data Belongs to You

Your productivity data belongs to you.

We do not:

• Sell your personal data
• Rent your personal data
• Trade your personal data

We may use anonymous, aggregated data, for example overall usage trends, to improve the service. This anonymous data cannot identify you personally. The general aggregated-data uses described in this policy do not include Google user data or data derived from Google user data for external research, reports, marketing, advertising or generalized AI or machine-learning model training.

5. Use of Aggregated and Anonymised Data

We may use anonymised and aggregated data to understand how FlowQuota is used and to improve the product. Google user data and data derived from Google user data are handled under the separate Google-data restrictions described in this policy.

This means we may analyse patterns such as:

• Average focus session length
• Time-of-day productivity trends
• Completion rates of focus sessions
• General usage patterns across the platform

This information is processed in a way that removes personally identifiable details. It cannot be used to identify any individual user.

We may publish summaries of these insights in reports, articles or other content that help professionals understand productivity patterns and focus behaviour. These reports are always based on aggregated data and never include personal information. Google user data and data derived from Google user data are excluded from these external research, publication and marketing uses.

6. How We Protect Your Data

We take security seriously and use reasonable safeguards, including:

• Encrypted connections using HTTPS
• Secure hosting providers
• Access controls
• Practical technical measures to reduce risk

No system is 100% secure, but we take sensible steps to protect your data.

7. How Long We Keep Your Data

We keep account, session, billing, notification and AI Briefing records for as long as needed to provide the service, maintain account history, comply with legal obligations, resolve disputes, improve reliability or as otherwise described in this policy.

You can disconnect Google Calendar in Settings at any time. Disconnecting removes the connection, stored OAuth credentials, calendar-source records and all associated locally stored raw event metadata. Deselecting a calendar immediately deletes that calendar's locally stored events and synchronisation token. Initial synchronisation is limited to 45 days before the user's current local date through the whole day 90 days after it; later automatic and manual updates use incremental provider synchronisation. Selected calendars may update automatically while the Google connection is operating. Access tokens may be refreshed securely for these updates. You can pause automatic synchronisation in Settings without deleting the Google connection, encrypted credentials, selected calendars or already imported local context. Automatic provider updates stop while paused, and calendar-dependent features that require an operating/current connection may remain inactive. Protected Focus reminders remain inactive while paused. Sync now remains available while paused as a manual fallback. Resume restores normal automatic calendar operation.

You may request deletion where applicable. We will delete personal data within a reasonable time, unless we need to keep it for legal, security, billing or dispute-resolution reasons.

Website form and marketing contact information is retained for as long as reasonably necessary to fulfil the relevant request, manage our relationship with you, comply with applicable legal obligations, and maintain communication preferences or suppression records.

8. Your Choices and Rights (UK and GDPR)

You can choose what focus-session data, project names, categories and work labels you enter.

You can stop using AI Briefings by downgrading, cancelling or otherwise ending AI access.

If you are in the UK or EU, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request a copy of your data, also called data portability

To make a request, contact us using the details below. You may also contact FlowQuota about privacy questions, access, correction or deletion.

9. Cookies and similar technologies

Essential cookies keep you signed in and protect the service. The flowquota_cookie_consent preference cookie remembers your choices for up to 180 days across flowquota.ai and app.flowquota.ai. It records separate Analytics and Marketing measurement choices. Optional choices start off. Accept all, Reject optional or Save choices in Cookie Settings; you can reopen it on any page.

Analytics: with permission, Google Analytics uses cookies such as _ga and _ga_* to measure website and product use. Turning Analytics off stops optional analytics events and removes these accessible first-party cookies. Google may retain information already received under its own retention arrangements.

Marketing measurement: with separate permission, browser session storage remembers limited campaign parameters (flowquota_attribution_v1) and a random reference for a successful whitepaper request (flowquota_journey_reference_v1). The reference is accepted for up to 30 days and can link that request to registration and verified engagement milestones in HubSpot. Google Ads campaign measurement may also run, with advertising storage, advertising user-data consent and personalised advertising kept denied. We do not use advertising cookies at this time.

Google Analytics and Google Ads are provided by Google; HubSpot provides the resource-request form and contact records. Requesting a resource still uses HubSpot to fulfil that request when optional measurement is declined; this is separate from optional journey linking and email subscriptions. Provider information: https://policies.google.com/privacy and https://legal.hubspot.com/privacy-policy.

Withdrawing Marketing measurement removes the campaign/reference values from this browser session and removes the reference from registration links. For signed-in accounts it records withdrawal to stop future HubSpot milestone sharing. Other browser sessions need their own cookie choices; sign in when changing Cookie Settings to apply account withdrawal. Optional marketing-sharing permission expires after 180 days unless renewed. Withdrawal does not change core product records or erase previously shared contact records automatically.

10. Third-Party Services

FlowQuota uses Sentry for application error monitoring and scheduled-operation checks. This privacy-minimised telemetry includes error categories, code locations, application version, environment, timing, aggregate failure counts, random correlation references and, where needed for diagnosis, internal numeric record identifiers. It helps us detect, attribute and investigate service failures. Sentry processes this operational metadata on our behalf. FlowQuota-controlled monitoring excludes names, email addresses, authentication credentials, cookies, request bodies, calendar event content, free-text work content, AI prompts, generated briefings, source summaries and raw provider payloads. Hosting-platform request logs are separate; application-level redaction cannot remove an upstream hosting-platform copy of a Google OAuth callback URL.

We use trusted third-party services to operate FlowQuota, including:

• Stripe for payments, subscriptions, the billing portal, invoices and payment processing
• Resend for transactional, lifecycle and AI Briefing notification emails
• OpenAI API for AI Briefing generation, including bounded privacy-minimised Google Calendar-derived context when it is used in a calendar-aware briefing
• Google APIs, when you choose to connect Google Calendar, for account identity, calendar-list information and separately authorised read-only event information from selected calendars
• Render for application hosting and PostgreSQL database infrastructure
• Sentry for privacy-minimised application error monitoring and scheduled-operation checks
• HubSpot for selected website forms and contact-management functions

These providers process data on our behalf for the purposes described in this policy and are expected to follow applicable data protection laws and contractual safeguards.

Google user data disclosures

Google user data is processed within FlowQuota's hosted application and database infrastructure on Render. When an eligible calendar-aware AI Briefing is generated, bounded privacy-minimised summaries derived from the user's selected Google Calendar data may be transferred to OpenAI through the OpenAI API solely to generate that user-facing briefing.

FlowQuota does not sell Google user data, disclose it for advertising or data-brokerage purposes, or use, transfer or disclose it to develop, train or improve foundational or generalized AI or machine-learning models. FlowQuota requires third-party AI processing of Google user data to remain limited to providing the requested FlowQuota feature.

HubSpot

We use HubSpot to process selected website forms and manage contact information submitted through those forms.

Where you request a FlowQuota resource, such as a whitepaper, HubSpot may process the information you provide so that we can record and fulfil that request.

If you separately choose to receive marketing communications, HubSpot may also store your communication preferences and help us manage those communications.

HubSpot processes this information on our behalf under its applicable data-processing terms. We do not use a whitepaper request as automatic consent to receive ongoing marketing communications where separate permission is required.

FlowQuota's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. FlowQuota uses Google data only to provide the user-facing calendar connection features you authorise and does not sell it or use it for advertising.

11. Children's Privacy

FlowQuota is not designed for children under 13. We do not knowingly collect personal information from children. If we learn that we have done so, we will delete the information promptly.

12. Changes to This Policy

We may update this Privacy Policy occasionally. If we make important changes, we will notify users. By continuing to use FlowQuota, you accept the updated policy.

13. Contact Us

If you have questions about privacy, contact:

support@flowquota.ai