FlowQuota - Privacy Policy

Last updated: 05 August 2026

Welcome to FlowQuota.

This Privacy Policy explains what information we collect, why we collect it, and how we use it. We believe privacy should be clear and simple, not hidden in confusing legal language.

This is not formal legal advice. It is our practical explanation of how FlowQuota handles data.

1. What Information We Collect

When you use FlowQuota, we may collect and process:

Account and profile information

• Your name, if you provide it
• Your email address
• Your login details, stored securely
• Basic profile, settings, invite, trial, plan and access information

Subscription and billing information

• Subscription status, plan identifiers and billing-related identifiers
• Payment, invoice and billing portal information handled through Stripe

We do not store your full card details, and FlowQuota does not send payment card details to OpenAI.

Focus and productivity information

• Focus-session data and session data
• Timer and session timing data
• Projects, categories and work labels where you use them
• Completion, outcome and status data where used
• Generated AI Briefings and briefing history
• Notification and email logs, including AI Briefing notification emails

Technical information

• IP address
• Browser type
• Device information
• Basic usage data, such as pages visited

Connected Google Calendar information

If you choose to connect Google Calendar, FlowQuota processes:

• Your stable Google account identifier, email address and available profile name
• OAuth credentials, protected with authenticated encryption
• The names, identifiers and basic settings of calendars available to that account
• Your explicit choice of which calendars FlowQuota may use
• After you separately grant read-only event access, provider event identifiers, status and type, updated metadata, timing or exclusive all-day dates, time-zone metadata, minimal recurring-instance identity, availability, your own response status, whether you organise the event, and whether conference data is present
• A separate provider synchronisation token and privacy-safe synchronisation status for each selected calendar

FlowQuota does not retain event titles, descriptions, locations, attendee identities or lists, organiser identity, meeting links, conference details, attachments, reminders, extended properties or raw Google responses. Eligible historical timed calendar activity may appear in History as generic scheduled time. Calendar events remain separate from Focus Sessions and do not affect Reporting, Focus Score or AI Briefings.

2. How We Use This Information

We use this information to:

• Provide the timer, history, reporting, settings and billing features
• Generate AI Briefings for eligible AI-tier users
• Identify focus patterns, time-of-day trends and changes in working rhythm
• Send service, account, billing, lifecycle, product usage and AI Briefing notification emails
• Improve product reliability and user experience
• Prevent misuse, protect accounts and maintain security
• Provide customer support

AI Briefing notification emails alert users when a briefing is ready and link back into FlowQuota. They do not need to include the full briefing.

Promotional product updates, offers and launch news are optional. Where we send promotional messages, you can unsubscribe or opt out from those messages.

We only collect what we need to operate and improve the service.

We process your data under the lawful basis of:

• Contract, to provide the service you signed up for
• Legitimate interest, to improve and protect the service
• Legal obligation, where required

3. AI Briefings and OpenAI

FlowQuota uses OpenAI as an AI provider to help generate AI Briefings. Relevant focus-session and productivity context may be sent to OpenAI to generate the briefing.

FlowQuota aims to send only the information needed to generate the briefing. OpenAI processes this information as a service provider to FlowQuota for the purpose of generating the briefing.

AI Briefings are generated from your FlowQuota activity data and focus data. They may be imperfect, incomplete or not suitable for every situation.

4. Your Data Belongs to You

Your productivity data belongs to you.

We do not:

• Sell your personal data
• Rent your personal data
• Trade your personal data

We may use anonymous, aggregated data, for example overall usage trends, to improve the service. This anonymous data cannot identify you personally.

5. Use of Aggregated and Anonymised Data

We may use anonymised and aggregated data to understand how FlowQuota is used and to improve the product.

This means we may analyse patterns such as:

• Average focus session length
• Time-of-day productivity trends
• Completion rates of focus sessions
• General usage patterns across the platform

This information is processed in a way that removes personally identifiable details. It cannot be used to identify any individual user.

We may publish summaries of these insights in reports, articles or other content that help professionals understand productivity patterns and focus behaviour. These reports are always based on aggregated data and never include personal information.

6. How We Protect Your Data

We take security seriously and use reasonable safeguards, including:

• Encrypted connections using HTTPS
• Secure hosting providers
• Access controls
• Practical technical measures to reduce risk

No system is 100% secure, but we take sensible steps to protect your data.

7. How Long We Keep Your Data

We keep account, session, billing, notification and AI Briefing records for as long as needed to provide the service, maintain account history, comply with legal obligations, resolve disputes, improve reliability or as otherwise described in this policy.

You can disconnect Google Calendar in Settings at any time. Disconnecting removes the connection, stored OAuth credentials, calendar-source records and all associated locally stored raw event metadata. Deselecting a calendar immediately deletes that calendar's locally stored events and synchronisation token. Initial manual synchronisation is limited to 45 days before the user's current local date through the whole day 90 days after it; later manual runs use incremental provider synchronisation. Access tokens may be refreshed securely to perform a user-requested synchronisation.

You may request deletion where applicable. We will delete personal data within a reasonable time, unless we need to keep it for legal, security, billing or dispute-resolution reasons.

8. Your Choices and Rights (UK and GDPR)

You can choose what focus-session data, project names, categories and work labels you enter.

You can stop using AI Briefings by downgrading, cancelling or otherwise ending AI access.

If you are in the UK or EU, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request a copy of your data, also called data portability

To make a request, contact us using the details below. You may also contact FlowQuota about privacy questions, access, correction or deletion.

9. Cookies

FlowQuota may use essential cookies to keep you logged in and protect the service. We do not use advertising cookies at this time.

If this changes, we will update this policy.

10. Third-Party Services

We use trusted third-party services to operate FlowQuota, including:

• Stripe for payments, subscriptions, the billing portal, invoices and payment processing
• Resend for transactional, lifecycle and AI Briefing notification emails
• OpenAI for AI Briefing generation
• Google APIs, when you choose to connect Google Calendar, for account identity, calendar-list information and separately authorised read-only event information from selected calendars
• Hosting and database providers used to run the service

These providers process data on our behalf and are expected to follow applicable data protection laws.

FlowQuota's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. FlowQuota uses Google data only to provide the user-facing calendar connection features you authorise and does not sell it or use it for advertising.

11. Children's Privacy

FlowQuota is not designed for children under 13. We do not knowingly collect personal information from children. If we learn that we have done so, we will delete the information promptly.

12. Changes to This Policy

We may update this Privacy Policy occasionally. If we make important changes, we will notify users. By continuing to use FlowQuota, you accept the updated policy.

13. Contact Us

If you have questions about privacy, contact:

support@flowquota.ai