Privacy Policy
Last Updated: August 16, 2026
BBMM Technologies Inc., operating as Flowo from Halifax, Nova Scotia, Canada, protects your privacy through data minimization, encrypted local storage, and consent before optional analytics. This policy explains what the Flowo app and flowoapp.com process, why, and the choices available to you. Questions and privacy requests can be sent to privacy@flowoapp.com.
1. Who We Are and Scope
BBMM Technologies Inc. (NS Registry ID 4825550) is the controller for personal information processed by Flowo and this website.
BBMM Technologies Inc.
1800 Argyle St, Unit 801
Halifax, Nova Scotia, B3J 3N8, Canada
Privacy contact: privacy@flowoapp.com
This policy applies to the Flowo mobile application, our marketing website at flowoapp.com, early-access forms, and support communications.
2. What the App Processes
Flowo 1.0.0 is a free early-access release. It does not offer in-app purchases or subscriptions, and it does not include StoreKit purchase flows, RevenueCat, paywalls, purchase or restore controls, paid feature gates, or session replay.
• Local planning content: Tasks, schedules, habits, notes, Braindump items, preferences, and related planning state are stored in encrypted local storage on your device. Flowo does not maintain a centralized cloud database containing your tasks.
• Device security: Flowo creates a random, app-scoped installation identifier and sends device-attestation evidence, security counters, quota use, and token metadata to authenticate the installation and prevent abuse. This is not an email or login account.
• User-invoked cloud features: When you request generative assistance, only the content needed for that request is sent over an encrypted connection to the Flowo API and processed using Amazon Bedrock. Voice features ask for separate just-in-time permission before recording or uploading audio and may use Amazon Transcribe before a generative request. Flowo does not use this content to train models or store it as a centralized copy of your planning database. AWS publishes separate service terms and data-protection commitments for these services.
• On-device processing: Semantic search and embeddings run on your device through Core ML on iOS or TensorFlow Lite on supported platforms. Raw text and embedding vectors used by those features remain on the device.
• Optional analytics: Only after analytics consent, Flowo may send content-free, pseudonymous interaction and performance events to Amplitude and TelemetryDeck. Flowo does not ship a crash-reporting SDK, and these services are not used for cross-app tracking.
3. What the Website Processes
• Early-access, quiz, and contact forms: If you submit a form, we process the fields you choose to provide, such as your name, email address, role, use case, message, or optional quiz answers and outcome. Quiz answers are stored only when you choose to save the result with an email; viewing a result without email does not submit them. Form submissions are stored through our Supabase project so we can manage access requests and respond.
• Support messenger: Zendesk does not load until you select Support. If you open it, Zendesk processes the messages and contact details you choose to provide plus technical data needed to deliver and secure the conversation. Do not send task text, passwords, payment-card data, or health information through support.
• Consent preferences: We store your cookie and analytics choices so the site can respect them.
• Optional website analytics: If you consent, Amplitude may receive content-free page and interaction events used to understand site performance. We do not use third-party advertising cookies.
• Technical delivery data: Hosting, DNS, security, and network providers may process standard request information such as IP address, browser type, timestamps, and requested URLs to deliver and protect the site.
4. Why We Process Data
We process data only for defined purposes: to provide an app feature you request, including a cloud feature you invoke (performance of a contract); to respond to early-access, privacy, or support requests (consent, legitimate interests, or steps requested before a contract); and to authenticate installations, enforce security controls, prevent abuse, and diagnose faults (performance of a contract and legitimate interests). Voice upload requires the separate choice shown before recording. Optional analytics runs only with consent. Local personalization does not send its planning data to us.
Flowo does not sell personal information, use planning content for advertising, track users across apps or websites, or use your content to train models.
5. Service Providers
We use providers only for specific operating purposes:
• Amazon Web Services, Amazon Bedrock, and Amazon Transcribe — Flowo API infrastructure and request-scoped processing for user-invoked generative or voice features.
• Amplitude — consented, content-free product and website analytics.
• TelemetryDeck — consented, content-free product telemetry and performance signals; Flowo does not send it crash reports.
• Apple platform services — Keychain, speech recognition, App Attest, and other operating-system functions needed for requested device features and security.
• Zendesk — support messaging only after a visitor selects Support.
• Supabase — website early-access, feedback, contact, and saved quiz submissions.
• Resend and Google Workspace — delivery and handling of support or form-related email.
• GitHub Pages and Fastly — static website hosting and content delivery. Cloudflare may provide DNS and related network services.
RevenueCat is not included in Flowo 1.0.0. It may be documented again only if a later release restores purchases and updates this policy before distribution. Each current provider processes data under its own terms and applicable data-protection obligations. We do not authorize providers to use planning content for advertising or model training. Contact privacy@flowoapp.com for the current provider and transfer-mechanism register.
6. Your Consent and Controls
App analytics is off until you consent. Voice upload asks for a separate choice before recording; generative text features run only when you invoke them. You may change or withdraw optional analytics in the app, and withdrawal applies to future processing.
You can export supported local records, use Delete Account & Data to erase app-owned local records and identifiers, and remove locally stored content by deleting the app. On this website, analytics is off by default; the permanent Privacy choices control lets you reject or withdraw consent at any time. Website consent expires after 180 days or when this policy version changes.
7. Retention and Deletion
Local planning content remains on your device until you delete it, use the erasure workflow, or remove the app. Flowo does not retain user-invoked cloud content as a task database; limited request, security, and provider records may remain only for service delivery, abuse prevention, incident investigation, and legal claims under the applicable operational schedule.
App and website analytics records follow the configured provider retention period and are no longer collected after consent is withdrawn. Device-authentication, security, and revocation records are kept while needed to operate or protect an installation and are periodically reviewed. Website forms, email, and Zendesk support conversations are kept while the request or early-access relationship is active and then deleted or de-identified when no longer needed, subject to provider backup timing, legal claims, and statutory records.
Use https://flowoapp.com/data-rights or privacy@flowoapp.com to request deletion of records we control. The privacy request process explains identity verification and the limits of matching an account-free installation after app data has been removed.
8. International Transfers
BBMM Technologies Inc. is based in Canada. The providers listed above may process data in Canada, the United States, the European Economic Area, or other locations disclosed in their service terms. For a restricted transfer, we use an applicable adequacy decision or contractual safeguard, such as the European Commission Standard Contractual Clauses and, where required for the United Kingdom, the UK Addendum or another valid mechanism. You may request information about the safeguard relevant to you at privacy@flowoapp.com. Data sent from the app or website is protected in transit using HTTPS/TLS.
9. Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal information we control; object to processing based on legitimate interests; withdraw consent; and complain to a privacy regulator. California and other US state rights apply when their statutory scope and thresholds are met.
Use https://flowoapp.com/data-rights or send a request to privacy@flowoapp.com. We may need to verify the request without collecting more information than necessary. We will respond within the period required by applicable law. Because planning content is stored locally and is not held in a Flowo task database, the in-app export and erasure controls are usually the direct way to act on that content.
10. Security
Flowo uses encrypted local records, hardware-backed key storage where supported, HTTPS/TLS for network requests, release configuration controls, and consent and policy gates around external services. The Flowo API does not act as a centralized storage database for user tasks. Website submissions and operational systems use access controls appropriate to their purpose.
No system can guarantee absolute security. If you believe your information is at risk, contact security@flowoapp.com or privacy@flowoapp.com.
11. Children and Policy Changes
Flowo is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can review and delete it where appropriate.
We may update this policy when the product, providers, or law changes. We will update the date above and provide additional notice when a material change requires it.
12. Contact
BBMM Technologies Inc.
1800 Argyle St, Unit 801
Halifax, Nova Scotia, B3J 3N8, Canada
Privacy Officer: Director, BBMM Technologies Inc.
Privacy: privacy@flowoapp.com
Security: security@flowoapp.com
General support: hello@flowoapp.com
Data-rights instructions: https://flowoapp.com/data-rights
Canadian residents may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca. Quebec residents may also contact the Commission d'accès à l'information du Québec at https://www.cai.gouv.qc.ca. EEA and UK residents may contact their local supervisory authority.