Flow
Legalמשפטי

English · עברית

Glance Privacy Policy

Last updated: November 9, 2026

This policy explains what information Flow ("Flow", "we", "us") collects and handles when you download or use Glance, the Chrome extension that closes open loops (starting in Gmail), including Glance Pro, and when you sign up to download Glance or subscribe to Pro on theflow-ai.com.

Glance is a consumer product offered to individuals. It is a separate product from Flow (the enterprise product). Our website, the Flow waitlist and enquiries are covered by the Flow Privacy Policy, available at theflow-ai.com/privacy.html. Glance is intended for general business use. It is not designed for regulated or otherwise sensitive material, and it carries none of the contractual or compliance guarantees described on our Security page.

What Glance does with your mail and messages is the part most worth being precise about, so Section 2 describes it feature by feature.

1. Information we collect

Download sign-up. When you enter your email address to download Glance, we store it (with the page language) and email you the download link once. The download starts as soon as you enter your email. If you asked to be told when Glance Pro is available, we store that request too.

Glance Pro billing. If you start a Pro subscription, Stripe collects your payment details. Your card details go straight to Stripe. We never see or store them. We receive from Stripe your email address, the plan you chose, and the subscription's status, renewal and trial dates. We store these, together with Stripe's customer and subscription identifiers and a one-way hash of your licence key so the key can be checked. We do not store the key itself. We email the licence key to you and are notified by email when someone starts Pro.

Anonymous usage events. See Section 3.

Second-reading counters, licence checks and Pro requests. See Section 2.

Communications. If you email us, we keep the correspondence so we can respond and keep a record of it.

Everything else Glance reads or records stays in the extension's storage on your device (Section 2) and is not sent to us.

2. What Glance does, feature by feature

What it reads. When you open an email in Gmail, the extension reads that message's visible text, subject and sender to decide whether it records a decision worth logging.

Where that decision is made. On your device. The code that scores a message performs no network requests of any kind. No email text is transmitted in order to reach that judgment. This is an architectural property of the extension, not a policy promise.

Your inbox list and the morning list. While Gmail's inbox list is on screen, Glance looks at the rows Gmail has already rendered, up to 25 at a time: the subject, the preview snippet and the sender's name and address, not the full message. It judges them on your device and sends nothing anywhere. A row that clears the same bar as an open message is remembered on your device as a short snapshot (the subject, a link to the thread, the type of item and a few extracted facts such as an amount or a date), so that Glance can show it in its morning list, with the Do It button, before you open the thread. Rows that do not clear the bar are not stored. Opening the thread drops the snapshot, and the full message is then judged as described above. The morning list opens in Gmail at most once a day, and only when it is not empty. Glance can also show one optional desktop notification a day that points to the same list; its text and count are produced on your device.

What leaves your device when you click "Do It". Nothing is written anywhere unless you click the Do It button on a specific message. When you do, Glance writes directly to your own, already-signed-in Google account: a Google Calendar event, a Google Tasks reminder, a Gmail draft reply, or a combination of these, whichever the message calls for. It carries a short summary label, any amount or date it extracted and, for a drafted reply, a single quoted sentence from the message. That data goes directly from your browser to Google's API using your own OAuth grant. It does not pass through us and we do not receive a copy.

If a message asks for a specific file (an invoice, a signed contract, a resume) that is not already attached to the thread and you have not chosen one, Glance searches your Google Drive by filename and content for a matching file and attaches whichever it finds to the draft. This is the one case where Glance reads more than the Gmail message itself, and it happens automatically, not on request. The search uses the same direct, your-own-OAuth-grant connection, so it does not pass through us either. A file found this way is never sent: it lands only in the draft, flagged in the draft's own text as an unverified guess for you to check before you send.

Notion, HubSpot, Salesforce, Slack and Monday.com connectors also exist in the code but are not currently reachable from setup. If that changes, this policy will be updated before it does.

Draft-It and the attachment summary (Glance Pro). These appear only for an account with an active Pro licence, and the server refuses them without one. They use a real language model, so before either sends anything, Local Privacy Shield scans the text on your device and replaces the names, companies, monetary amounts, dates, email addresses and phone numbers it finds with placeholder tokens (for example [CLIENT_NAME_1]). It works by pattern-matching, not comprehension, and is tuned to over-mask rather than under-mask. But pattern-matching is not the same as omniscience, and we would rather say so than claim a guarantee no such system can make. An amount spelled out in words, or a first name used alone mid-sentence, can pass through.

Only that masked text reaches our server. The server masks again before it calls a provider, and it does not send the text if an email address or phone number is still present. The real values are never sent.

  • Drafts go to Anthropic or xAI, whichever has been answering faster.
  • Attachment summaries go to Google first, then to that same pair. OpenAI is used for a summary only when Google's service is not configured or is being skipped after errors.
  • The response comes back with the same placeholder tokens, and your browser substitutes the real values back in locally. That reconstruction happens only on your device.
  • If a result is not one of the known categories, Glance stays silent instead of guessing.

A separate automatic classification of a whole message, for when the on-device pass found nothing, exists in the code (Anthropic first, then xAI; never Google or OpenAI) but is switched off in this version. The "Second reading" below is not that. If it is ever turned on it will be opt-in, and this policy will change first.

For Pro, Draft-It also receives, with the masked thread text, a short fixed description of how you open and close emails (for example "opens with Hi and the first name"), never your own text.

Second reading of one sentence (off until you turn it on). Glance reads your newest message on your device first, and with a model on your own computer if you use one (below). For the few sentences it still cannot place, and only after you press "Turn on" in the extension panel (you can turn it off there at any time), it can send that one sentence to our server for a second reading.

  • Before the sentence leaves your browser it goes through the same masking as Draft-It: names, companies, amounts, dates, email addresses, phone numbers and labelled identifiers are replaced with placeholders, and nothing is sent if an email address, a phone number or an amount is still in it. That masking can miss things: a first name used alone, or a number with no label, can pass through.
  • Our server masks again and asks a fast model (from Anthropic or xAI) twice, in two wordings, and accepts only an answer on which both agree. For Glance Pro, when the two answers disagree, it asks a more capable model (from Anthropic or xAI) once.
  • Only the masked sentence is sent, never the thread, the subject or who wrote to whom. The answer is a suggestion: you still tap, and it can never close, write or send anything.
  • There is a monthly allowance: 120 second readings on Free and 1,500 on Glance Pro. We count them on our server with a number kept against a one-way hash of your random install identifier (or of your Pro key) and, to stop abuse, per network address and per day for everyone together. We keep no sentence and no answer.
  • When the allowance is used up, Glance carries on on your device as before and says so in the extension panel.
  • To know whether this is running, and how many are left, the extension asks our server with your random install identifier and, for Pro, your key. No message text is part of that.
  • On your device Glance keeps a short code for each masked sentence already asked, so it is never asked twice, and counts of how it went.

Do not turn this on for regulated or otherwise sensitive mail.

Open loops (what you are waiting on, and what you promised). When you open a Gmail thread, Glance reads, on your device, your newest message to see whether it asks someone for something or promises something. When the other person's newest message arrives, Glance reads it on your device to tell an answer from an acknowledgement, an out-of-office, a promised date or a payment confirmation. It also reads a message that states a date something stops being valid (an offer, a trial) to offer a reminder.

Only if you click "Stay on it" or "Remind me" does Glance add a Google Task to your own Google account (due on the day to look again) and keep a short record on your device: who, the sentence involved, the amount if there is one, and the dates. After a meeting you put on your Calendar, Glance keeps its title and date on your device so it can ask what came out of it. What you type there is read on your device and turned into loops. Glance also keeps, per person, only the dates on which you opened loops, to notice what comes around regularly. A draft nudge is created only when you ask, and is never sent. None of this passes through us, except the Second reading above when you have turned it on.

Glance Pro lifts the number of loops you can follow at once and adds the firmer nudges, the money totals and the rhythm view.

Stay on this, from any page. The browser's right-click menu offers "Glance: stay on this" on selected text. Only the text you selected and the page's address without its query or fragment are kept, on your device, until you answer one question. If you choose "Stay on it", they become a loop like any other.

Loops that close without a reply. When you open a payment confirmation from a bank or payment provider, Glance reads it on your device to see whether it is for the amount a payment loop is waiting on. When you open the extension, for a "pick a time" loop it asks Google Calendar for events with that person on the invite, and for a document you promised it asks Google Drive for recently changed files with a matching name and the people they are shared with. Only ids, times and addresses come back, never titles or contents, and the answers stay on your device. A close made this way can be undone with "Reopen", and weaker evidence only asks you.

Requests for a receipt or proof of payment. When someone asks you to send a receipt or a proof of transfer, Glance works out, on your device, whether one already exists (a file attached in that thread, or exactly one matching file in Google Drive, found by name), whether the payment really arrived, and who would issue it. To know whether a payment arrived it keeps, when you open a confirmation from a bank or payment provider, only the amount, the currency and the day (never the message), and it reads your own payment loops. If you type the address of whoever issues your receipts, that one address is kept on your device. Glance only ever prepares a draft in your own Gmail Drafts: it never sends, and it never issues a receipt or any other tax document. The request stays open until a message you sent carries a real attachment named for it, or you tell Glance it is done. None of this passes through us.

Other apps (off until you turn them on). Gmail is where Glance starts. In setup you can turn on WhatsApp Web, Slack or Telegram Web, each on its own. Turning one on asks your browser for permission to that one website (an optional permission: nothing extra is asked when you install), and turning it off removes it again. It is read-only and experimental. Glance reads only the one-to-one chat or direct message you have open, never a group, a broadcast list, a channel, a thread or a status, to see whether something you asked was answered, using the same on-device rules as for email. It never types, sends, reacts to or opens anything, and nothing from that app is sent to us. A loop made there keeps a short record on your device (the number or name that app shows, the sentence, the day to look again), like a loop made in Gmail. These apps can change their pages without notice. If Glance cannot read one, it goes quiet and says so.

Outlook (off until you turn it on). In setup you can connect your Microsoft account. Glance then reads, on this device, the last 14 days of your Outlook inbox and sent folder while the panel or an Outlook on the web tab is open (asks made of you and answers to yours), and shows the same Do It card as in Gmail inside the message you open there. On Do It it writes a reply draft into your Outlook Drafts (Microsoft Graph "createReply"). To keep you signed in, the extension renews your Microsoft sign-in in the background about every 16 hours, without opening a window. That renewal talks only to Microsoft.

Microsoft's permission is Mail.ReadWrite, which lets an app read, create, change and delete mail but not send it. Glance uses it only to create and delete its own drafts. It never sends and never requests Mail.Send. The Connect screen is one list: Select all, then Mail (always on), To Do, Calendar, OneDrive, Contacts and Teams. To Do, Calendar, OneDrive, Contacts and Teams are asked only if you check them:

  • To Do asks Tasks.ReadWrite. On a task-only Do It, Glance creates one task in Microsoft To Do on the default list, reads that task back, and says it is handled only when that read succeeds. Undo deletes that task.
  • OneDrive asks Files.ReadWrite. On that Do It, Glance writes one file, reads it back, and Undo deletes that file or restores the previous one. A mail does not search OneDrive.
  • Calendar asks Calendars.ReadWrite. When that permission is on the token, Do It on a note that names one file and a time creates one event on your Outlook calendar, with that file's link in the description, and Undo deletes that event. It does not invite anyone.
  • Contacts and Teams are read-only (Contacts.Read, Chat.Read).

Undo deletes only the draft Glance created, and only while it is still a draft. The sign-in token stays in this browser. Nothing of your mail goes to Glance's servers.

A language model on your own computer (off until you turn it on). If you run a program such as Ollama or LM Studio on this computer, you can let Glance send it one sentence at a time that Glance could not read itself. The address must be on this computer (127.0.0.1 or localhost). Glance refuses any other address, and the browser asks your permission first. Before it is used, Glance tests that model on sentences written for the purpose and switches it on, per language, only if it is precise enough. It only suggests: you still tap, and it can never close, write or send anything. The sentence goes from your browser to that program on the same computer. Nothing about it is sent to us, and Glance does not download or install any model.

What Glance adapts, on your device. Glance adjusts to you with small numbers and counts kept only on your device: how it scored sentences you confirmed or turned down (numbers, never words), how long people usually take to answer, how you usually open and close an email (counts of greetings and sign-offs, per language), which names, addresses and numbers belong to the same person across apps, and a short plain list of each adjustment, which you can read in the extension. "Reset what Glance learned" deletes all of it. If your browser has a built-in language model, Glance may use it on your device to read wording it could not otherwise place, only after it passes an accuracy check there. It only suggests, and nothing leaves your device.

Connection credentials. Authorising a connector stores an access token in your browser's local extension storage on your own machine. We never receive or store these tokens. The one exception is the moment of authorisation itself: the provider's one-time authorisation code is exchanged for a token through our server, because that exchange requires an application secret that cannot safely be shipped inside an extension. We do not retain the code or the resulting token.

What stays on your device. Your chosen connector, the activity log of what Glance noticed and wrote (including which proposed steps you tend to keep or remove, used only to reorder or stop repeating a step you consistently do not want), and the sensitivity calibration all live in extension storage on your device. None of it is sent to us. Uninstalling the extension deletes all of it.

3. Anonymous product-usage events

Separately from everything above, Glance reports a small set of aggregate usage events: a Do It chip appeared, was clicked or was dismissed; a write completed; an action was undone; a process closed and by which method; a connector was set up; a follow-up was set, closed by a reply, or its nudge drafted, or the free limit was reached (counts only: never who, what or how much); the Glance Pro start button was clicked; a Pro key was activated; Draft-It generated a reply; an attachment was summarised; one ping per day the extension was active in a Gmail tab; and, at most once per install per calendar week, whether a recurring usage habit had formed.

Each event is tagged only with a random per-install identifier (not tied to your email, Google account or anything else identifying) and which connector or line-of-work profile was involved. Events are sent to our server, which relays them to Google Analytics. This tells us whether the product is actually being used. It never includes message text, sender identity, or any extracted amount or date. Our server rejects any event name or field it does not already recognise, so this list is the complete list, not just an example of it.

4. What we do not do

We do not read your mailbox, do not receive your unmasked email content, do not sell any of it, and do not use any of it to train AI models, ours or anyone else's.

The exceptions for message content are the masked model calls described in Section 2: placeholder text only, when a Pro subscriber asks for a draft or an attachment summary and, only after you turn it on, one masked sentence at a time for the second reading. A real name, company, amount, date, email address or phone number is not what those providers receive.

Provider terms. Anthropic's commercial terms state: "Anthropic may not train models on Customer Content from Services." OpenAI states that "data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)." These are statements of those providers' published terms, which they may change.

Google user data. Glance's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace data to develop, improve or train generalized AI or machine-learning models.

5. Who processes data on our behalf

We share information only with the service providers that operate Glance's servers and billing on our behalf, under their own data-processing terms:

  • Supabase stores download sign-ups, Glance Pro licence records and the second-reading counters.
  • Resend delivers the install link and, for Pro, your licence key and billing emails.
  • Netlify hosts the site and runs the serverless functions that process sign-ups, licence checks, billing events and Pro requests (including masked text in transit).
  • Stripe takes payment for Glance Pro.
  • Google Analytics receives the anonymous usage events in Section 3.
  • Anthropic, xAI, Google and OpenAI process masked text only, as described in Section 2: drafts and second readings (Anthropic or xAI), attachment summaries (Google first, then Anthropic or xAI; OpenAI only when Google's service is not configured or is being skipped after errors).

When Glance writes to your Google or Microsoft account, it connects directly from your browser to Google or Microsoft under your own authorisation (Section 2). Those providers are not our processors for that traffic.

We do not share your information with any other third party for their own marketing purposes. We may disclose information if the law requires it, or to protect the rights, property or safety of Flow, our users or the public.

6. International transfers

Our service providers, including Anthropic, xAI, Google and OpenAI, may process data in the United States and in other countries. Where the law requires it, we rely on those providers' contractual safeguards for cross-border transfers.

7. Retention

  • Data held inside the Glance extension lives on your own device and is removed when you uninstall it.
  • We keep download sign-ups and Glance Pro licence and billing records for as long as the sign-up or subscription is active, and for a reasonable period afterwards for our own records and legal obligations, unless you ask us to delete them sooner (see Section 8).
  • We keep no second-reading sentence and no answer. The allowance counters are kept as one-way hashes, as described in Section 2.

8. Your rights

Under the Israeli Protection of Privacy Law, 5741-1981 and its regulations, you may have the right to review personal information we hold about you and to ask us to correct or delete it, in the cases the law provides. Where the GDPR applies, you may also have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, to withdraw consent at any time, and to complain to a data protection authority. In Israel that is the Privacy Protection Authority.

Most Glance data is on your device, where you control it: you can delete it with "Reset what Glance learned" or by uninstalling the extension. We cannot see or delete it for you. For what we hold (download sign-ups and Pro records), and for any request under this section, email info@theflow-ai.com and we will act on your request promptly.

Our emails are transactional (the install link, your licence key and billing emails) and not a marketing newsletter, so they do not carry an unsubscribe footer. To stop hearing from us, email the same address.

9. Children

Glance is a consumer product. It is not directed at, and we do not knowingly collect information from, anyone under 16. If you are under 16, please do not install or use Glance or subscribe to Glance Pro.

10. Changes to this policy

We may update this policy as Glance evolves. We will change the "Last updated" date when we do. Material changes, including any new use of your mail or messages, will appear here before they take effect.

11. Contact

Questions about this policy or your data: info@theflow-ai.com