Privacy Policy

Controller

The controller responsible for data processing on this website and in the “Flow” app within the meaning of the General Data Protection Regulation (GDPR) is:

Nicolas Matschke
Völklinger Weg 5
60529 Frankfurt am Main
Germany

Email: nicolas@nexhub.dev
Phone: +49 (0) 1517 0650737

Summary

• We only process the data Flow needs. There are no ads, no trackers, no analytics services and no sharing for advertising purposes.
• Notes, intentions, tasks, parked thoughts and your email address are stored encrypted, with a separate key for every account.
• We never store passwords in plain text, only as an irreversible hash.
• Fonts, graphics and music are hosted on our own server. No external servers are contacted when you use Flow.
• You can export your data yourself at any time (Settings → Privacy & legal) and delete your account with all data (Settings → Account).

Visiting the website and server log files

When you access Flow, our web server processes technically necessary data transmitted by your browser: IP address, date and time, requested address, amount of data transferred, status code, referrer URL and browser and operating system details (user agent).

This data is required to deliver the page and is stored in server log files to defend against attacks and to analyse errors. The IP address is shortened (IPv4: last octet, IPv6: everything after the first 48 bits) so that it cannot be traced back to you. The log files are deleted automatically after 7 days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable provision of the service.

To protect against abuse, Flow briefly counts sign-in and registration attempts per IP address (in memory only, for at most 15 minutes).

Default language: On your first visit, our server checks against a list of IP address ranges stored on the server whether your IP address belongs to a network in Germany. If so, we show Flow in German, otherwise in English. No external service is asked, and neither the IP address nor the result is stored. Only the language is saved in the flow_lang cookie (see below). You can change the language at any time at the top of every page or in the settings. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show you Flow in a suitable language right away.

Hosting

Flow runs on its own server at
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Deutschland. The server is located in Nürnberg, Deutschland (Rechenzentrum NBG1). The database, encrypted content and server log files are stored exclusively on this server; Flow does not use any cloud services, content delivery networks or external storage.

We have concluded a data processing agreement pursuant to Art. 28 GDPR with the hosting provider. It processes the data only on our instructions and may not use it for its own purposes. The legal basis is Art. 6(1)(b) and (f) GDPR.

User account

You need an account to use Flow. For this we process:

• username (only visible to others if you choose “With username” for the leaderboard),
• email address (stored encrypted; for signing in, resetting your password and notices about your account),
• password: only as a hash (scrypt with an individual salt and an additional secret key), never in plain text,
• the time of registration and last use, your chosen time zone and language (German or English) and the time you accepted the terms of use,

The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). Flow cannot be used without this information.

Using the app

To make Flow work, we store the following for your account:

• Focus sessions: start and end time, planned or achieved duration, type (timer or Flowtime), result (completed/aborted and reason), number of tab switches and, optionally, the linked task,
• your content (encrypted): the intention of a session, the note and rating after a session, tasks and parked thoughts,
• progress: XP, level, records, purchases, achievements, quests, streak, daily reward, plant and pet mood, break exercises,
• settings and appearance: language, timer settings, daily goal, atmosphere, character, room, presets.

From this data we calculate your statistics, quests and weekly review, for you only. The legal basis is Art. 6(1)(b) GDPR.

Strict mode: Your browser itself detects whether Flow is in the background (another tab, window or program). The server is only told that a session was aborted or how often you were distracted. Neither screen content nor other tabs or programs are recorded.

Flow extension (optional): If you install the browser extension “Flow Fokus-Wächter”, it checks in your browser during a strict session whether the address of a tab is on your block list, and blocks such sites until the session ends. This check takes place only locally in your browser: the extension does not transmit any addresses or history, neither to us nor to third parties. Flow only learns that the extension is running and whether your browser is currently in the foreground. We store your block list with your settings. The legal basis is Art. 6(1)(b) GDPR.

Encryption of your content

Notes, intentions, tasks, parked thoughts and your email address are encrypted with AES-256-GCM before they are stored. Every account has its own random key, which itself is only stored encrypted in the database. The master key is kept separately from the database. A stolen database or backup cannot be read without this key.

Content is decrypted on the server only to show it to you, to calculate your statistics or to send you emails. We do not look at your content. When you delete your account, your key is deleted too, making the content permanently unreadable.

Leaderboard and event worlds

Only sessions in strict mode count on the leaderboard. You decide how you appear there when you register and at any time in the settings:

• Anonymous (default): other signed-in users see your rank, your level and your focus time and number of sessions in the selected period, but without your username and with a neutral figure instead of your own. They cannot infer your account from this. The legal basis is our legitimate interest in a shared leaderboard (Art. 6(1)(f) GDPR); you can object at any time by choosing “Hidden”.
• With username: your username and your character are shown as well. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings.
• Hidden: others do not see you on the leaderboard.

If you join an event world, you appear with your level and score on that event’s leaderboard, which all participants can see; with your username and character only if you have chosen “With username” in the settings, otherwise anonymously. Only sessions in strict mode count towards the placement, which determines the reward. The legal basis is Art. 6(1)(b) GDPR; taking part is voluntary.

Cookies and local storage

Flow only uses technically necessary cookies and storage, no tracking or advertising cookies:

• flow_sid: keeps you signed in (HttpOnly, Secure, SameSite=Lax; valid until you sign out, at most 30 days). The server only stores a hash of this value.
• flow_lang: remembers whether you use Flow in German or English so that all pages appear in your language (contains only “de” or “en”, at most 1 year). On your first visit it is set based on where your IP address is located (see above), afterwards according to your choice.
• Local storage in your browser: chosen language, timer position, today’s round counter, dismissed hints and whether a session was aborted by reloading. This data never leaves your device.

The legal basis for storing and reading this information is § 25(2) no. 2 TDDDG (strictly necessary for the service you requested), and Art. 6(1)(b) GDPR for the subsequent processing. No consent is required for this.

Emails

We only send messages that are necessary for your account to the email address you provided, in the language you chose in Flow:

• a link to reset your password when you request it (valid for one hour, single use, only a hash is stored on the server),
• if we terminate your account: the notice, a reminder 3 days before the deletion, a message if we cancel the deletion, and a confirmation after the deletion (see the terms of use),
• a confirmation when you delete your account yourself,
• a reminder 30 days and another one 3 days before an inactive account is deleted, and a confirmation after the deletion.

We do not send advertising emails or newsletters. To send emails we use an email service (SMTP):
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Deutschland
It delivers the messages on our behalf and receives your email address and the content of the message for this purpose. We have concluded a data processing agreement pursuant to Art. 28 GDPR with the email provider. It processes the data only on our instructions and may not use it for its own purposes. The legal basis is Art. 6(1)(b) GDPR.

Queue: If a message cannot be delivered immediately, Flow stores it encrypted and retries for up to one day. As soon as it has been sent (or turned out to be undeliverable), its content and address are deleted. What remains is a delivery log with the type of message, the time and a shortened address (e.g. “m•••@example.org”), which is deleted after 30 days. For the confirmation after an account deletion, your address remains stored in encrypted form only until the message has been delivered. The legal basis is Art. 6(1)(b) and (f) GDPR (reliable delivery, proof of dispatch).

Live weather and location

If you turn on live weather, our server requests the current weather from Open-Meteo (Open-Meteo.com, Switzerland). Only the coordinates of your chosen location rounded to about one kilometre, or your search term when searching for a location, are transmitted, not your IP address and no account data. The responses are cached briefly.

If you choose “Use my location”, your browser asks for your permission. The coordinates are rounded and saved as the location in your settings. The legal basis is Art. 6(1)(a) and (b) GDPR. You can delete the location at any time or set the weather to “fixed”.

Browser notifications

If you wish, Flow shows a notification at the end of a phase. It is created directly by your browser; no push service is used. You can revoke the permission at any time in your browser settings.

Recipients and third countries

We do not pass your data on to third parties, except to the processors named above (hosting, email delivery) or if we are legally obliged to do so. Data is not transferred to countries outside the EU or EEA.

Storage period

• We store account, usage and content data for as long as your account exists. If you delete your account, all related data is deleted immediately and the storage space is overwritten.
• We automatically delete accounts that have not been used for 12 months. We remind you by email 30 days and again 3 days beforehand if an address is on file. If a reminder cannot be delivered, we do not delete the account. Signing in once is enough to keep the account.
• If we terminate your account (see the terms of use), the data is deleted on the announced date.
• Sign-in sessions end after 30 days at the latest, password reset links after one hour.
• Emails that have not yet been delivered stay in the queue for about one day at most; the delivery log with the shortened address is deleted after 30 days.
• Server log files are deleted after 7 days.
• If the operator makes backups, these are overwritten as part of the usual rotation. Encrypted content of deleted accounts can no longer be read in them.

Data security

We protect your data with technical and organisational measures (Art. 32 GDPR), including: encrypted transmission (HTTPS/TLS), encryption of your content with AES-256-GCM and a separate key per account, password hashes with scrypt and an additional secret key, secure session cookies readable only by the server, protection against cross-site request forgery, a strict content security policy, limits on sign-in attempts and overwriting deleted data in the database.

Your rights

You have the right at any time to

• access the data stored about you (Art. 15 GDPR), most easily via “Export my data” in the settings (Privacy & legal),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) via “Delete account” in the settings,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR): the export provides your data as a machine-readable JSON file,
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw any consent given with effect for the future (Art. 7(3) GDPR), e.g. your visibility on the leaderboard.

To do so, please contact the address given above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden.

Further information

No automated decisions: We do not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR). XP, levels and leaderboards are part of the game only.

Minors: Flow is intended for people aged 16 and over. Younger people may only use Flow with the consent of their parents or guardians.

Language versions: Flow is operated from Germany. Only the German version of this privacy policy is legally binding. This English version is a translation for your convenience only; in the event of any discrepancy, the German version shall prevail.

Changes: We update this privacy policy when Flow or the legal situation changes. The version published here applies.