Privacy Policy

Account information. When you sign up, we collect your name, email address, and either a password (stored as a salted hash, never in plain text) or your Google account identifier if you sign in with Google. You may also add a profile photo.

Organization and workspace content. Any data you or your teammates create inside Flowspace: organizations, teams, projects, boards, tasks, comments, attachments, checklists, and labels: is stored so the product can function. This content belongs to your organization, not to us.

Activity and security data. We keep a log of actions taken in your organization (e.g. a task was moved, a member was invited, a role was changed) so teams have a working history and audit trail. For account-security events specifically, signing in, signing out, password resets, session revocation, we also record the IP address, browser/device (user agent), and an approximate location derived from that IP address, so owners and admins can spot suspicious activity.

Cookies. We use httpOnly session cookies to keep you signed in and to protect requests against cross-site forgery. These are functional cookies required for the app to work: we don't use third-party advertising or cross-site tracking cookies.

To operate the service: authenticate you, enforce your organization's role-based permissions, sync changes to your team in real time, and send transactional email (invitations, password resets, email verification). To keep accounts secure: detect unusual login activity and let organization owners/admins review the audit log. We do not sell your data, and we do not use your organization's content to train models or for advertising.

Flowspace uses a small number of third parties to provide the service: Google, if you choose to sign in with a Google account; a transactional email provider, to deliver invitations, verification, and password-reset emails; and an IP-geolocation lookup service, used only to attach an approximate location to security-relevant login events in the audit log. None of these providers receive your organization's task or project content beyond what's required to perform that specific function.

We retain your account and organization data for as long as the account or organization is active. If you delete your account or your organization is deleted, associated data is removed or scheduled for deletion within a reasonable period, except where we're required to retain it for legal or security purposes (for example, a limited window of audit-log history).

You can update your profile information at any time from your account settings, and you can review and revoke your own active sessions there too. You can request a copy of your personal data or ask us to delete it by contacting us using the details below, organization owners and admins can also manage member access and remove members directly from organization settings.

Passwords are stored as salted hashes, never in plain text. Every session is checked against a live session record on our servers, not just trusted from a token, so revoking a session takes effect immediately. Access to organization data is scoped by role-based permissions and project-level visibility, and security-relevant actions are written to an audit log that only organization owners and admins can view.

Flowspace is a workplace productivity tool and is not directed at, or intended for use by, children. We don't knowingly collect information from children.

If we make material changes to this policy, we'll update the date at the top of this page. Continued use of Flowspace after a change means you accept the updated policy.

Questions about this policy or your data? Reach us at contact@akashkadam.com