Last updated 26 October 2026

Privacy policy

This policy covers the hosted Flow at flow.humantech.ch and the Flow app for iPhone when it's connected to it. Flow is a private journal: we keep what you write so you can use it, and for nothing else. No ads, no tracking in Flow, no selling or sharing your data.

Who is responsible

Massimo Brivio, trading as Humantech, Switzerland. The postal address is in the Impressum. For anything about your data, write to hey@humantech.ch.

If you use the iPhone app with a Flow server someone else runs, that person is responsible for your data there, and this policy doesn't apply.

What Flow stores

• Your account: your email address and your password, kept only as a one-way hash we can't turn back into the password. Also when you signed up and confirmed your address, and a new address while you're changing it.
• What you write: your goals, opportunities and their log, with the ratings, values, sources and notes you give them. If you write about other people (who mentioned an opportunity, for example), that's stored too, as you wrote it.
• Where you're signed in: for each sign-in, the IP address and the browser or device it came from, so you stay signed in. It's deleted when you sign out.
• Tokens you create for the command-line tool or agents: the name you give them, a hash of the token and when it was last used.
• Server logs: for each request, the IP address, the page asked for, the time and the browser. They're used to keep Flow running and secure, and deleted after at most 30 days.

Flow sets two cookies, both needed for it to work: one that keeps you signed in, and one that remembers, for example, the page to return to after signing in. There are no analytics or advertising cookies, and no page loads anything from another company's servers: even the fonts come from Flow itself.

Why

Only to give you Flow: to sign you in, show you your goals and opportunities, send the emails below, and keep the service secure. Your journal isn't read by us, analysed, used to train AI, or shown to anyone else. We'd look at your data only if you ask us to (for example to help with a problem) or if the law requires it.

Flow emails you only when needed: to confirm your address, to reset your password, and when your email address changes. No newsletters or marketing.

Where it's kept, and who processes it

• OVHcloud (OVH SAS, France) rents us the server Flow runs on, in a data centre in Germany. Everything Flow stores is on that server.
• Brevo (Sendinblue SAS, France) sends Flow's emails. It receives your email address and the email itself, and records for us whether each email was delivered, opened, and its link clicked: an invisible image in the email tells it when it's opened, and the link passes through Brevo on its way to Flow.
• Backups: OVHcloud makes a copy of the whole server every day, kept in the EU and deleted automatically after at most a week.

Germany, France and the EU are recognised by Switzerland as having adequate data protection. We don't send your data to any other country.

If you use Flow through an agent or AI assistant with one of your tokens, what it reads from Flow goes to that service, under its own terms. You choose that, and you can revoke the token any time in Settings.

How long we keep it

As long as you have an account. When you delete it, your account and everything in it are deleted from the server at once. Copies in the backups are deleted as those age out, within a week.

Deleting your account

In Flow, on the web or in the iPhone app, open Goals → Settings → Delete account and enter your password. This deletes your account, goals, opportunities, log and tokens immediately and can't be undone. If you can't sign in any more, write to hey@humantech.ch from the address of your account and we'll delete it for you.

Your rights

You can ask what data we hold about you, and have it corrected or deleted. You can take your data with you: Flow's API returns everything in your account as JSON, with a token from Settings. Write to hey@humantech.ch; we answer within 30 days.

Flow follows the Swiss Federal Act on Data Protection (FADP). If you're in the EU, the GDPR applies too: we process your data to provide the service you signed up for (Art. 6(1)(b)) and, for server logs and backups, because keeping Flow secure and your data safe is a legitimate interest (Art. 6(1)(f)). If you think we handle your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to the data protection authority where you live.

The iPhone app

The app shows Flow from the server you choose. On your iPhone it keeps only that server's address and the cookie that keeps you signed in. It contains no analytics, advertising or tracking code, and doesn't ask for your location, contacts, photos or anything else on the phone.

Security

Flow is only reachable over encrypted connections (HTTPS). Passwords and tokens are stored as hashes, and each account sees only its own data.

Changes

If this policy changes, the new version is published here with a new date. If a change matters to how your data is used, we'll email you before it applies.