Flow
Legal

Privacy Policy

Last updated: October 3, 2026

This Privacy Policy explains what information Flow ("Flow", "we", "us") collects when you visit theflow-ai.com, join our early-access waitlist, or install the Glance Chrome extension — how it's used, and the choices you have. Flow is currently in pre-release, early-access status; this policy will be expanded as the product moves toward general availability.

Two things are covered here, and they are separate products. Glance is the free product described in Section 5, which closes open loops, starting in Gmail, and today runs as a Chrome extension — it is intended for general business use, not for regulated or otherwise sensitive material, and it carries none of the contractual or compliance guarantees described on our Security page. Flow (the core product) is deployed for an organization under its own agreement, in a masked cloud tenant or on the customer's own infrastructure, and its data handling is governed by that agreement rather than by this policy.

1. Information We Collect

We collect information you provide directly, and a small amount of information automatically.

  • Waitlist information. When you join the waitlist we collect your work email address, and — once you complete signup — your company name, role, and company website.
  • Communications. If you email us, we keep that correspondence to respond to you and keep a record of the interaction.
  • Automatic / analytics information. Like most sites, we use an analytics tool (Google Analytics) to understand aggregate traffic — pages viewed, general location by country/region, device and browser type, and referral source. This is not tied to your name unless you've also given us your email separately.
  • Local preferences. We store a light/dark theme preference in your browser's local storage. This never leaves your device and is not sent to us.
  • Glance Pro billing. If you start a Pro subscription we receive your email address, the plan you chose, and the subscription's status and renewal dates from Stripe, and we store a one-way hash of your licence key so it can be checked. We do not receive your card number.

2. How We Use Your Information

  • To manage the waitlist and grant early access when it opens.
  • To send you the Hybrid Automation Playbook, Glance install instructions, or a notice when Glance Pro becomes available — whichever you signed up for.
  • To understand how the site and product content are used, so we can improve them.
  • To detect and prevent abuse (for example, automated/bot signups).

We do not sell your personal information, and we do not use your waitlist submission to train third-party AI models.

3. Email Confirmation

To keep our mailing list accurate and to prevent someone from signing up an email address that isn't theirs, we use a confirmation step for the Flow waitlist: after you submit the form, we send a confirmation link to the email address provided, and the Playbook and further communications are sent only after that link is clicked. Glance works differently: because it is free and sends you nothing but the install file, the download starts as soon as you enter your email, and we email you the same download link once as a backup.

4. Who We Share Information With

We share information only with the service providers that operate the waitlist and site on our behalf, under their own data-processing terms:

  • Supabase — stores waitlist submissions (email, company, role, website) and enterprise enquiries submitted through the contact form.
  • Resend — delivers transactional email (for the Flow waitlist a confirmation link and then the Playbook; for Glance the install link; for Glance Pro your licence key and billing receipts).
  • Netlify — hosts the site and runs the serverless functions that process signups.
  • Stripe — takes payment for Glance Pro. Your card details go straight to Stripe; we never see or store them. We keep only your email, the subscription's status and renewal date, and a one-way hash of your licence key.
  • Google Analytics — aggregate site-traffic analytics.
  • Anthropic, xAI, and Google — power Glance Pro's Draft-It reply and attachment summary in Section 5, only when a Pro subscriber uses them. Anthropic and xAI also read the single masked sentence of the “Second reading” in Section 5, for Free and Pro, only after you turn it on. They receive masked placeholder text only — never a real name, company, amount, date, email address, or phone number. OpenAI is called only to summarize an attachment when Google's Gemini is not configured or is temporarily skipped after errors. See Section 5.

We do not share your information with any other third party for their own marketing purposes. We may disclose information if required to by law, or to protect the rights, property, or safety of Flow, our users, or the public.

5. Glance (the Chrome extension)

Glance runs in your browser, on Gmail, and on other apps only if you turn them on. What it does with your mail and your messages is the part most worth being precise about, so this section describes it in full.

  • What it reads. When you open an email in Gmail, the extension reads that message's visible text, subject, and sender in order to decide whether it records a decision worth logging.
  • Where that decision is made. On your device, and only on your device. The code that scores a message performs no network requests of any kind — no email text is transmitted anywhere in order to reach that judgment. This is an architectural property of the extension, not a policy promise.
  • What leaves your device, and only when you ask. Nothing is written anywhere unless you click the Do It button on a specific message. When you do, Glance writes directly to your own, already-signed-in Google account — a Google Calendar event, a Google Tasks reminder, a Gmail draft reply, or a combination of these, whichever the message actually calls for — carrying a short summary label, any amount or date it extracted, and (for a drafted reply) a single quoted sentence from the message. That data goes directly from your browser to Google's API using your own OAuth grant. It does not pass through us and we do not receive a copy. If a message asks for a specific file (an invoice, a signed contract, a resume) that isn't already attached to the thread and you haven't manually chosen one, Glance will search your Google Drive by filename and content for a matching file and attach whichever it finds to the draft — this is the one case where Glance reads more than the Gmail message itself, and it happens automatically, not on request. That search goes through the same direct, your-own-OAuth-grant connection as everything else in this bullet, so it never passes through us either. A file found this way is never sent: it lands only in the draft, flagged in its own text as an unverified guess for you to check before you hit send. (Notion, HubSpot, Salesforce, Slack, and Monday.com connectors also exist in the code but are not currently reachable from setup; if that changes, this section will be updated to match before it does.)
  • Draft-It and the attachment summary — opt-in, and separate from judgment. Part of Glance Pro: they appear only for an account with an active Pro licence, and the server refuses them without one. Two sidebar tools go further than the passive engine above: drafting a reply, and summarising an attachment. Both use a real language model, so before either ever sends anything, Local Privacy Shield scans the text on your device and replaces the names, companies, monetary amounts, dates, email addresses and phone numbers it finds with placeholder tokens (for example [CLIENT_NAME_1]) before anything is sent. It works by pattern-matching, not comprehension, and is tuned to over-mask rather than under-mask — but pattern-matching is not the same as omniscience, and we would rather say so than claim a guarantee no such system can make. An amount spelled out in words, or a first name used alone mid-sentence, can pass through. Only that masked text reaches our server. The server masks again before it calls a provider, and it does not send the text if an email address or phone number is still present. The real values are never sent. Drafts go to Anthropic (Haiku) or xAI (a fast Grok), whichever has been answering faster. Attachment summaries go to Google (Gemini Flash) first, then to that same fast pair; OpenAI's mini model is used for a summary only when Gemini is not configured or is being skipped after errors. A separate automatic classification of a whole message, for when the on-device pass found nothing, exists in the code (Anthropic Sonnet, then a stronger Grok; never Google or OpenAI) but is switched off in this version, and the second-reading option described below is not that: it is one masked sentence, only after you turn it on. If either ever returns a result that is not one of the known categories, Glance stays silent instead of guessing. The response comes back with the same placeholder tokens in it, and your browser substitutes the real values back in locally — that reconstruction happens only on your device, nowhere else.
  • Open loops (what you are waiting on, and what you promised). When you open a Gmail thread, Glance reads, on your device, your newest message to see whether it asks someone for something or promises something. When the other person's newest message arrives, Glance reads it on your device to tell an answer from an acknowledgement, an out-of-office, a promised date, or a payment confirmation. It also reads a message that states a date something stops being valid (an offer, a trial) to offer a reminder. Only if you click Stay on it or Remind me does Glance add a Google Task to your own Google account (due on the day to look again) and keep a short record on your device: who, the sentence involved, the amount if there is one, and the dates. After a meeting you put on your Calendar, Glance keeps its title and date on your device so it can ask what came out of it; what you type there is read on your device and turned into loops. It also keeps, per person, only the dates on which you opened loops, to notice what comes around regularly. A draft nudge is created only when you ask, and is never sent. None of this passes through us, with one exception that is off until you turn it on: the “Second reading” below. Glance Pro lifts the number of loops you can follow at once and adds the firmer nudges, the money totals and the rhythm view.
  • Other apps: off until you turn them on. Gmail is where Glance starts. In the extension's setup you can turn on WhatsApp Web. Doing so asks your browser for permission to that one website (an optional permission: nothing extra is asked when you install), and turning it off removes it again. It is read-only and experimental. Glance reads only the one-to-one chat you have open, never a group, a broadcast list, a channel or a status, to see whether something you asked was answered, using the same on-device rules as for email. It never types, sends, reacts to or opens anything, and nothing from that app is sent to us. A loop made there keeps a short record on your device (the number and name WhatsApp shows, the sentence, the day to look again), like a loop made in Gmail. WhatsApp can change its page without notice; if Glance cannot read it, it goes quiet and says so.
  • Outlook: off until you turn it on. In the extension's setup you can connect your Microsoft account. Glance then reads, on this device, the last 14 days of your Outlook inbox and sent folder while the panel or an Outlook on the web tab is open — asks made of you and answers to yours — and shows the same Do It card as in Gmail inside the message you open there. On Do It it writes a reply draft into your Outlook Drafts (Microsoft Graph createReply). To stay signed in, the extension renews your Microsoft sign-in in the background about every 16 hours, without opening a window; that renewal talks only to Microsoft. Microsoft's permission is Mail.ReadWrite, which lets an app read, create, change and delete mail but not send it; Glance uses it only to create and delete its own drafts. It never sends and never requests Mail.Send. Undo deletes only the draft Glance created, and only while it is still a draft. The sign-in token stays in this browser. Nothing of your mail goes to Glance's servers.
  • A language model on your own computer: off until you turn it on. If you run a program such as Ollama or LM Studio on this computer, you can let Glance send it one sentence at a time that Glance could not read itself. The address must be on this computer (127.0.0.1 or localhost); Glance refuses any other address, and the browser asks your permission first. Before it is used, Glance tests that model on sentences written for the purpose and switches it on, per language, only if it is precise enough. It only suggests: you still tap, and it can never close, write or send anything. The sentence goes from your browser to that program on the same computer; nothing about it is sent to us, and Glance does not download or install any model.
  • Second reading of one sentence: off until you turn it on. Glance reads your newest message on your device first, and a model on your own computer if you use one (above). For the few sentences it still cannot place, and only after you press Turn on in the extension panel (you can turn it off there at any time), it can send that one sentence to our server for a second reading. Before it leaves your browser the sentence goes through the same masking as Draft-It: names, companies, amounts, dates, email addresses, phone numbers and labelled identifiers are replaced with placeholders, and nothing is sent if an email address, a phone number or an amount is still in it. That masking can miss things: a first name used alone, or a number with no label, can pass through. Our server masks again, asks a fast model (Anthropic Haiku or xAI’s fast Grok) twice in two wordings and accepts only an answer both times agree on; for Glance Pro, when the two answers disagree, it asks a stronger model once (Anthropic Sonnet or xAI’s stronger Grok). Only the masked sentence is sent, never the thread, the subject or who wrote to whom, and the answer is a suggestion: you still tap, and it can never close, write or send anything. There is a monthly allowance, 120 second readings on Free and 1,500 on Glance Pro. We count them on our server with a number kept against a one-way hash of your random install identifier (or of your Pro key) and, to stop abuse, per network address and per day for everyone together; we keep no sentence and no answer. When the allowance is used up, Glance carries on on your device as before and says so in the extension panel. To know whether this is running, and how many are left, the extension asks our server with your random install identifier and, for Pro, your key; no message text is part of that. On your device Glance keeps a short code for each masked sentence already asked, so it is never asked twice, and counts of how it went. Glance is for general business use and not for regulated or otherwise sensitive material; do not turn this on for mail like that.
  • Stay on this, from any page. The browser's right-click menu offers “Glance: stay on this” on selected text. Only the text you selected and the page's address without its query or fragment are kept, on your device, until you answer one question. If you choose Stay on it, they become a loop like any other.
  • Loops that close without a reply. When you open a payment confirmation from a bank or payment provider, Glance reads it on your device to see whether it is for the amount a payment loop is waiting on. When you open the extension, for a “pick a time” loop it asks Google Calendar for events with that person on the invite, and for a document you promised it asks Google Drive for recently changed files with a matching name and the people they are shared with. Only ids, times and addresses come back, never titles or contents, and the answers stay on your device. A close made this way can be undone with Reopen, and weaker evidence only asks you.
  • Requests for a receipt or proof of payment. When someone asks you to send a receipt or a proof of transfer, Glance works out, on your device, whether one already exists (a file attached in that thread, or exactly one matching file in Google Drive, found by name), whether the payment really arrived, and who would issue it. To know whether a payment arrived it keeps, when you open a confirmation from a bank or payment provider, only the amount, the currency and the day (never the message), and it reads your own payment loops. If you type the address of whoever issues your receipts, that one address is kept on your device. Glance only ever prepares a draft in your own Gmail Drafts: it never sends, and it never issues a receipt or any other tax document. The request stays open until a message you sent carries a real attachment named for it, or you tell Glance it is done. None of this passes through us.
  • What Glance adapts, on your device. Glance adjusts to you with small numbers and counts kept only on your device: how it scored sentences you confirmed or turned down (numbers, never words), how long people usually take to answer, how you usually open and close an email (counts of greetings and sign-offs, per language), which names, addresses and numbers belong to the same person across apps, and a short plain list of each adjustment, which you can read in the extension. “Reset what Glance learned” deletes all of it. If your browser has a built-in language model, Glance may use it on your device to read wording it could not otherwise place, only after it passes an accuracy check there. It only suggests, and nothing leaves your device. For Pro, Draft-It receives, together with the masked thread text, a short fixed description of how you open and close emails (for example “opens with Hi and the first name”), never your own text.
  • Connection credentials. Authorising a connector stores an access token in your browser's local extension storage on your own machine. We never receive or store these tokens. The one exception is the moment of authorisation itself: the provider's one-time authorisation code is exchanged for a token through our server, because that exchange requires an application secret that cannot safely be shipped inside an extension. We do not retain the code or the resulting token.
  • What stays local. Your chosen connector, the activity log of what Glance noticed and wrote (including which proposed steps you tend to keep or remove, used only to reorder or stop repeating a step you consistently don't want), and the sensitivity calibration all live in extension storage on your device. None of it is sent to us. Uninstalling the extension deletes all of it.
  • Anonymous product-usage events. Separately from anything above, Glance reports a small set of aggregate usage events — a Do It chip appeared, was clicked, or was dismissed; a write completed; an action was undone; a process closed and by which method; a connector was set up; a follow-up was set, closed by a reply, or its nudge drafted, or the free limit was reached (counts only: never who, what or how much); the Glance Pro start button was clicked; a Pro key was activated; Draft-It generated a reply; an attachment was summarised; one ping per day the extension was active in a Gmail tab; and, at most once per install per calendar week, whether a recurring usage habit had formed — tagged only with a random per-install identifier (not tied to your email, Google account, or anything else identifying) and which connector or line-of-work profile was involved. This tells us whether the product is actually being used; it never includes message text, sender identity, or any extracted amount or date. Our server rejects any event name or field it doesn't already recognise, so this list is also the complete list — not just an example of it.
  • What we do not do. We do not read your mailbox, do not receive your unmasked email content, do not sell any of it, and do not use any of it to train AI models — ours or anyone else's. The exceptions for message content are the masked model calls described above: placeholder text only, when a Pro subscriber asks for a draft or an attachment summary, and, only after you turn it on, one masked sentence at a time for the second reading. (A separate automatic classification of whole messages exists in the code but is switched off; if it is ever turned on it will be opt-in and this policy will change first.) A real name, company, amount, date, email address, or phone number is not what those providers receive.

Glance is intended for general business use. It is a separate product from Flow, it is not designed for regulated or otherwise sensitive material, and it carries none of the contractual or compliance guarantees described on our Security page.

6. Enterprise enquiries

If you submit the form on our Contact page, we collect what you enter there — your email address and, where you provide them, your name, organisation, role, approximate number of seats, preferred deployment model, timeline, and message. We use it to answer your enquiry and to keep a record of the conversation. It is stored with Supabase and notified to us by email through Resend.

7. Cookies

Google Analytics sets standard analytics cookies to distinguish returning visitors and measure site usage in aggregate. You can block or clear these at any time through your browser settings without affecting your ability to use the site or join the waitlist.

8. Data Retention

We keep waitlist submissions and enterprise enquiries for as long as the signup or conversation is active, and for a reasonable period afterward for our own records, unless you ask us to delete them sooner (see Section 10). Data held inside the Glance extension lives on your own device and is removed when you uninstall it.

9. International Transfers

Our service providers may process data in the United States and other countries. Where required, we rely on those providers' own standard contractual safeguards for cross-border transfers.

10. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to withdraw consent to future emails at any time. Our emails are transactional — a confirmation link, and then the Playbook, Glance install instructions, or a Glance Pro launch notice, depending what you signed up for — rather than a marketing newsletter, so they do not carry an unsubscribe footer; to stop hearing from us, or to exercise any of these rights, email us at hello@theflow-ai.com and we'll act on your request promptly.

11. Children's Privacy

Flow is a business-to-business product. It is not directed at, and we do not knowingly collect information from, anyone under 16 years old.

12. Changes to This Policy

We may update this policy as the product evolves. We'll update the "Last updated" date above when we do; material changes will be reflected here before they take effect.

13. Contact

Questions about this policy or your data? Email hello@theflow-ai.com.