Privacy policy

Flowing (flowing.to) is run by [Kabarza legal name, e.g. Kabarza GmbH], [Street and number], [Postcode and town], Germany. We are the controller for the personal data described here. Questions about this policy, or about your data, go to hi@flowing.to.

This policy is written in plain language on purpose. Where it names a legal basis, it refers to the General Data Protection Regulation (GDPR).

You can read everything on Flowing without an account. Doing so sends the usual technical details to our hosting provider: your IP address, the page you requested, the time, your browser and operating system, and the page that linked you here. These are kept in server logs for a short time, to keep the site running and to spot abuse, and are not combined with anything else to identify you.

Legal basis: our legitimate interest in running a secure site (Article 6(1)(f) GDPR).

The site remembers a few preferences in your browser's own storage: the theme, whether the sidebar is collapsed, the grid or list layout, and whether the controls panel is open. These never leave your browser and we cannot read them.

An account holds the name you enter, your email address, your password (stored only as a hash, which cannot be turned back into the password), and a profile picture if you set one, either a small image you upload or an avatar you build on the account page. We use it to sign you in, to keep what you save, and to send you account email such as a confirmation of your address or a link to reset your password.

Legal basis: performing our agreement with you (Article 6(1)(b) GDPR).

An account stays until you delete it. You can do that yourself on the account page, and everything attached to it goes with it: saved items, roadmap requests and votes, and your newsletter subscription.

Saving an item records which item and when, against your account. Voting on the roadmap or requesting a component records the request, its title and description, and the fact that you voted. Requests are shown to other users without your name.

Legal basis: performing our agreement with you (Article 6(1)(b) GDPR).

There are two kinds, kept apart. Account email goes to everyone with an account and cannot be switched off: confirming your address, resetting a password, approving a change of email. Product updates, about new components and prompts, go only to people who ticked the box at sign-up or turned the switch on in their account. Every product update has an unsubscribe link, and the switch on the account page does the same thing.

Legal basis: performing our agreement with you for account email (Article 6(1)(b) GDPR), and your consent for product updates (Article 6(1)(a) GDPR), which you can withdraw at any time.

We use PostHog to understand how Flowing is used: which pages are visited, which components are opened, which prompts are copied, and whether the site works as it should, including errors it runs into. It is set up without cookies and without storing anything in your browser, so visits are not linked across days and no profile of you is built. The data is processed on PostHog's servers in Frankfurt.

Legal basis: our legitimate interest in understanding and improving the site (Article 6(1)(f) GDPR).

Flowing sets one cookie, and only once you sign in: the session cookie that keeps you signed in. It is strictly necessary for the account to work, so it needs no consent and there is no cookie banner. It lasts up to 30 days and is removed when you sign out.

Tutorials may embed videos from other platforms, such as YouTube. Playing one loads content from that platform, which may then set its own cookies under its own privacy policy.

We do not sell or share your data for anyone else's purposes. These companies process it on our behalf, under contracts that bind them to our instructions and to the GDPR:

• Vercel Inc. hosts the site and runs its code. Location: USA, with servers in Frankfurt for European visitors. Privacy policy.
• Neon Inc. runs the database that stores accounts and saved items. Location: USA. Privacy policy.
• Resend Inc. delivers account email and product updates. Location: USA. Privacy policy.
• PostHog Inc. measures how the site is used. Location: EU (Frankfurt). Privacy policy.

Where a provider is based in the USA, the transfer rests on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.

Server logs: a few weeks. Account data, saved items and requests: as long as the account exists. Newsletter subscription: until you unsubscribe. Account email: kept by our email provider for a short time for delivery and troubleshooting. Where the law requires us to keep something longer, such as records of consent, we keep only that.

You can ask us at any time for a copy of the data we hold about you, to correct it, to delete it, to restrict how we use it, or to receive it in a portable form. Where we rely on legitimate interest you can object; where we rely on consent you can withdraw it, which does not affect what was done before. Most of this you can do yourself on the account page; for the rest, write to hi@flowing.to.

You also have the right to complain to a data protection authority. For us that is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, Ansbach), though you may use the authority where you live.