Privacy Policy

Who we are

Flow is a personal health tracker. It is operated by Matic Mermolja s.p., Bevkova ulica 18, 5270 Ajdovščina, Slovenia (registration no. 8256071000), the controller of your personal data. Contact: mermoljam@gmail.com.

What we collect

Account: your email address, your name if you give it, and a password hash or the account ID from Google or Apple if you sign in with them.
Profile and settings: time zone, height, weight, age, daily nutrition targets and display preferences.
What you log: meals, exercise, sleep, notes on how you feel, routines, and goals.
Chat: your messages to the in-app assistant and its replies, plus short summaries of past days so it can remember context. If you report a reply, we keep a copy of it with the reason and note you give, so we can review it.
Photos: photos you send in chat (for example a meal or a nutrition label) are sent to our AI provider to be read and are not stored by Flow; the saved message only says that a photo was attached. Photos you add to a goal, and background videos you upload, are stored until you remove them or delete your account.
Approximate location: only if you turn on the weather background. Your phone rounds your position to about 10 km before sending it, and we use it only to look up the current weather. We do not store or log it.
Garmin: if you connect Garmin, we store an encrypted sign-in token (never your Garmin password) and the data we sync from your Garmin account: activities, sleep, steps, heart rate, heart rate variability, stress, body battery, respiration, blood oxygen and daily summaries.
Barcodes: when you scan a product, its barcode number. Product details go into a shared product list; it notes which account added a product, and that link is removed when you delete your account.

Reminders are scheduled on your device. We do not use advertising trackers, we do not show ads, and we do not sell your data.

Why we use it

To provide Flow to you: keeping your log, showing your day, and answering in chat. Legal basis: performing our contract with you.
Health information (meals, sleep, exercise, how you feel) is a special category of data. We process it only because you choose to log it, based on your explicit consent. You can withdraw consent at any time by deleting the data or your account.
To keep the service secure and working, for example rate limits and error logs. Legal basis: our legitimate interest.

We do not use your data to train AI models, and our AI provider does not train on it under its commercial terms.

Who processes it for us

Anthropic (AI): reads your chat messages, photos and the context needed to answer, using Claude.
Railway (database, file storage and the Garmin sync service): stores your account and everything you log.
Vercel (hosting): runs the website and the app's server.
Google and Apple (sign-in): confirm who you are when you choose to sign in with them.
Open Food Facts (barcodes): receives the barcode number of a product you scan.
Open-Meteo (weather): receives the rounded location, if you use the weather background.
Garmin: if you connect it, we fetch your data from Garmin.

If you connect Flow to an assistant such as Claude or ChatGPT, that assistant can read and write your Flow data on your request, under its own privacy terms.

Where and how long

Some of these providers process data outside the European Economic Area. Where they do, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

We keep your data while you have an account. When you delete your account, we delete your data immediately. Copies in database backups are removed when those backups expire.

Your rights

Under the GDPR you can:

access your data and get a copy of it in a portable format;
correct data that is wrong;
delete your data or your whole account (see Delete account);
object to or restrict some processing, and withdraw consent;
complain to a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), ip-rs.si.

To use any of these rights, email mermoljam@gmail.com from your account address.

Children

Flow is not meant for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we will update the date on this page and tell you in the app if the change is significant.

Contact

Matic Mermolja s.p., Bevkova ulica 18, 5270 Ajdovščina, Slovenia (registration no. 8256071000). Email: mermoljam@gmail.com.