The short version
- No ads, no trackers, no analytics, no third-party cookies.
- What stays on your device: your sign-in, and your choices such as language and theme.
- Because all of it is needed for the app to work, the law doesn't ask for a consent choice. You get a short notice, not an "accept all" wall.
- If I ever add something optional, it will be off until you switch it on.
What is kept on your device
- Sign-in session (a cookie named sb-…-auth-token, set by Supabase, the sign-in service). It keeps you signed in. It ends when you sign out or it expires.
- Your choices (browser storage, names starting with flow:). Language, theme, simple or detailed view, text size, which cards are folded, how lists are sorted, menu state. They never leave your device.
- Private notes key (browser database). A locked copy of your notes key, so you don't type your passphrase on every page. It can't be exported from the browser and is erased when you sign out.
- Offline copy (service worker cache). The shell of the app, so it opens quickly and shows an offline page. Your private pages are never cached.
- Push notifications (only if you turn them on). A subscription so your phone can receive them. Turn it off in Settings, Notifications.
- This notice (flow:notice). Remembers that you've seen it.
Third parties
None of them set cookies or load scripts on this site. Fonts are served from the same place as the pages. The hosting provider keeps ordinary server logs (IP address, time, page) for a short time, and that is not a cookie. The Privacy page lists everyone who handles data.
Your control
You can clear or block cookies and site data in your browser at any time. FlowLNCR will then ask you to sign in again and forget your display choices. Blocking the sign-in cookie means the app can't keep you signed in.