Privacy Policy

Effective 1 November 2026 · Applies to the FlowFirst apps for iPhone, iPad and Mac, their widgets, and flowfirst.app

The short version

FlowFirst works without an account. Until you sign in, everything stays on your device.
If you sign in to sync, your email address and your FlowFirst data (tasks, outcomes, focus sessions and settings) are stored on our server so your devices stay in step.
Your calendar never leaves your device. FlowFirst reads events to show your day and find free time, and never uploads them.
No ads, no tracking, no selling or sharing your data. FlowFirst has no analytics or advertising code in it.
You can delete your account and its data at any time, inside the app: Settings → Delete account.

1. Who we are

FlowFirst is made by Red Dash Media, 5 Begumpur, 1st Floor, Malviya Nagar, New Delhi 110017, India ("we", "us"). We decide how the personal data described here is used, which makes us its controller (its "data fiduciary" under India's Digital Personal Data Protection Act, 2023).

2. What stays on your device

Everything you put into FlowFirst is saved on your device first: your tasks and notes, outcomes and the reasons behind them, outcome photos, focus sessions and settings. The app and its widgets share this copy; the widgets get a lighter copy without photos or notes.

If you never sign in, nothing you enter in FlowFirst is sent to us. If you back up your device to iCloud or a computer, that backup may include FlowFirst's data, under Apple's terms.

3. What leaves your device, and when

Data goes to our server only if you choose to sign in, so your iPhone, iPad and Mac can share it. Here is all of it:

What	Why
Email address	To create your account and sign you in. We email you a one-time code; there's no password.
Account ID, and when the account was created and last signed in	To keep your data together and separate from everyone else's.
Your FlowFirst data: your name and settings (working hours, default task length, which sources you connected); tasks: title, notes, length, due date, scheduled time, whether it's done, and where it came from; outcomes: the result, your reason, life area, deadline and photo, if you added one; focus sessions: which task, when, and for how long.	To sync between your devices. It's stored as one document that only your account can read.
Reminders you imported: title, notes, list name, due date and priority, plus an identifier for each	Imported reminders become FlowFirst tasks, so they sync like any other task. The identifier stops a reminder from being imported twice, or coming back after you delete it.
Technical logs: IP address, the time of each request and its result	Kept by our hosting provider for security and to fix problems, for 7 days.

We use this data only to run FlowFirst for you. We don't read your content, except when you ask us to for support or the law requires it.

4. What we never collect

Calendar events. FlowFirst reads them to show your day and avoid double-booking. They stay on your device and are never uploaded.
Your photo library. When you add a photo to an outcome, you pick one, and FlowFirst keeps a smaller copy with location and camera details removed. It never sees the rest of your library.
Payment details. Apple handles payment (see section 6).
Usage tracking. FlowFirst has no analytics, advertising, attribution or crash-reporting code. We don't track you across apps or websites, and we don't sell or share personal data.
Your contacts, location, microphone or camera. FlowFirst doesn't ask for them.

If you allow it in your device's settings, Apple may share anonymous crash reports and usage statistics with developers. That's controlled by Apple, and you can turn it off in Settings → Privacy & Security → Analytics & Improvements.

5. Permissions FlowFirst asks for

Each one is optional. FlowFirst works without it, and you can change your mind any time in your device's Settings (on iPhone: Settings → Apps → FlowFirst; on Mac: System Settings → Privacy & Security).

Calendars: to show your events on the day and keep focus blocks out of their way. Read on your device only.
Reminders: to bring your open reminders into the FlowFirst inbox. If you sign in, the ones you import sync as tasks.
Notifications: a heads-up five minutes before each block. They're scheduled on your device; we don't send push notifications.
Photos: no permission is needed. You choose a photo in Apple's picker, and FlowFirst only receives that one.

FlowFirst doesn't connect to Gmail, Slack, Notion, Todoist or other services yet. If we add connections like these, we'll update this policy first, and nothing will connect without you turning it on.

6. Subscriptions and payments

FlowFirst Pro is sold through Apple's App Store. Apple processes the payment and manages the subscription, and we never receive your card or billing details. The app checks with Apple, on your device, whether your subscription is active. We don't store your purchase history on our server. See Apple's Privacy Policy.

7. Who handles data for us

We use a small number of service providers. They handle data only on our instructions and only to provide their service:

Supabase stores your account and synced data and signs you in, on Amazon Web Services servers in the United States (Northern Virginia). Supabase's privacy policy.
Resend delivers the emails with your sign-in code, so it receives your email address and the code. Resend's privacy policy.
Vercel hosts our website, flowfirst.app (see section 13). Vercel's privacy policy.
Apple distributes the app and handles subscriptions.

We may also disclose data if the law requires it, to protect people's safety, or as part of a merger or sale of the business. In that last case, this policy would keep applying to your data unless you're told otherwise and given a choice.

8. How long we keep it

On your device: until you delete it in the app, erase it (Settings → Erase everything), or delete the app.
On our server: for as long as your account exists. When you delete your account, your account and synced data are removed from our database straight away. Copies in our hosting provider's daily backups are gone within 7 days.
Technical logs: 7 days.
Emails with sign-in codes: Resend keeps a short delivery record (address, time, whether it arrived) under its own retention rules.

9. Your choices and rights

Use FlowFirst without an account. Nothing is sent to us.
See and correct your data in the app, where all of it is shown and editable.
Delete your account and synced data in the app: Settings → Delete account. This takes effect immediately.
Sign out, and choose whether to keep your data on that device or remove it.
Get a copy of your synced data in a machine-readable format (JSON), or ask any question about your data, by emailing privacy@flowfirst.app.

Depending on where you live, you may have the right to access, correct, delete or get a portable copy of your personal data; to object to or restrict how it's used; to withdraw consent; and to nominate someone to act for you. These rights come from the EU and UK GDPR, India's Digital Personal Data Protection Act, 2023, and California's CCPA/CPRA, among others. Email us to use any of them; we'll answer within 30 days and won't treat you differently for asking. You can also complain to your data protection authority, such as the Data Protection Board of India, or your local supervisory authority in the EU or UK.

Legal bases (EU and UK)

We process your data to provide the service you asked for (sync and your account); for our legitimate interests in keeping FlowFirst secure and working; and with your consent for device permissions, which you can withdraw in Settings at any time.

California

We don't sell or share personal information, as those words are defined in the CCPA, and we don't use it for targeted advertising.

10. How we protect it

All data travels over encrypted connections (HTTPS).
Our database lets each account read and change only its own data.
Your sign-in is kept in your device's secure Keychain, on that device only: it doesn't move to a new device through backups or transfers.
There are no passwords to leak: you sign in with a one-time code.
Photos are reduced in size and stripped of location and camera details before they're saved.

Synced data is encrypted in transit and at rest by Supabase. It isn't end-to-end encrypted, which means our team could technically access it. We only do so as described in section 3. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

11. Where it's stored

Synced data is stored in the United States (Northern Virginia). We're based in India and keep everyone's synced data in the US, wherever they live. For people in the EU, UK and Switzerland, these transfers are covered by the Standard Contractual Clauses in our data processing agreements with Supabase and Resend.

12. Children

FlowFirst is meant for people aged 13 and over. We don't knowingly collect personal data from children under 13. If you're under 18, use FlowFirst with a parent's or guardian's permission. If you think a child under 13 has given us personal data, email us and we'll delete it.

13. Our website

flowfirst.app sets no cookies, has no analytics, and doesn't ask for any personal data. It loads nothing from other sites; even its fonts are served from flowfirst.app. The capture demo on the home page runs entirely in your browser and sends nothing. The site is hosted by Vercel, which, like any web host, records basic request logs (IP address, page, browser and time) for security and keeps them for no more than 30 days. We don't use Vercel's analytics.

14. Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects what we collect or how we use it, we'll tell you before it takes effect: by email if you have an account, and in the app's release notes.

15. Contact us

Questions, requests or complaints: privacy@flowfirst.app
Red Dash Media, 5 Begumpur, 1st Floor, Malviya Nagar, New Delhi 110017, India

Grievance Officer (India)

Ashish Kumar, contact@flowfirst.app. We aim to resolve every grievance within 30 days.