Privacy

Who is behind this

FlowLNCR is built and run by Salah Eddine Medkour, an independent developer in Annaba, Algeria. It is me, not a company with a sales team, investors or a data department.

For your account and for what I keep about you, I am the data controller. For the clients and leads you add to your own workspace, you are the controller and I only store the data for you.

You can write to me at contact@flowlncr.com.

What I keep, and why

• Your account: your email and a password. The password is stored scrambled (hashed) by the sign-in service; I never see it. Also your language and the invite code you used.
• Your workspace: whatever you type or upload to run your business, such as your profile, clients, quotes, projects, invoices, payments, expenses, jobs, time, briefs, reviews, files and settings. I keep it so the app can show it to you.
• When you pay for a plan: the amount, the method, the reference and note you give me, the receipt you upload, and my decision on it. I keep these as accounting records.
• Support and contact: the messages you send me, any screenshot you attach and, if you choose to include it, the last error from your device.
• The waitlist: your email, and what you do if you tell me, after you confirm the address with a code.
• Technical traces: the hosting provider keeps ordinary server logs (IP address, time, page) for a short time. To stop spam, counters keep a scrambled form of an IP address for a few days. Nothing is used to follow you around.

What I don't do

• I don't sell, rent or trade personal data.
• I don't run advertising, profiling, tracking pixels, social-media widgets or analytics.
• I don't read your clients, invoices, notes or numbers for curiosity. Technically a developer can reach a database. I choose not to browse it. I look at a workspace only if you ask me to help, to stop abuse, or if the law requires it.
• I don't use your data to train any AI.

Private notes

Text and voice notes are encrypted in your browser with a key that is protected by your passphrase, before they are saved. I only ever hold the encrypted version, so I cannot open them. If you lose both your passphrase and your recovery code, nobody can: that is the price of real privacy.

The AI assistant (Flowee)

Flowee runs on your own key from Anthropic, OpenAI, Google, xAI or another provider. I don't give you one and I don't pay for it. That is deliberate: I am not the one who decides whether an AI reads your revenue, you are.

Flowee reads your workspace only after you allow it for that session, only the parts you leave switched on in Settings, and never your private notes. Whatever you allow is sent to the provider you chose, under their own terms. Your key is stored encrypted in a vault and is never shown again.

If you don't add a key, no AI is involved and nothing is sent anywhere.

Your clients, and forms you fill in

If you are a freelancer: the people you add to FlowLNCR are yours. Make sure you have a good reason to keep their details, and tell them. I keep it all inside your workspace, separated from every other workspace by the database itself.

If you filled in a freelancer's form, opened a proposal or invoice link, or reported a payment: that freelancer decides what happens with what you wrote, and FlowLNCR stores it for them. Forms ask for your agreement with an unticked box before you send. To see or delete your answers, ask the freelancer, or write to me and I'll act on it.

Clients never need an account. When you open a link the freelancer can see that it was opened.

Who else handles data

This is the whole list.

• Supabase: the database, sign-in and file storage. The data sits in Frankfurt, in the EU.
• Netlify: serves the website's pages.
• Resend: delivers email sent from FlowLNCR.
• Hostinger: my domain name and my contact@ mailbox.
• Your AI provider: only if you add a key, and only for what you allow.
• WhatsApp: only when you tap a WhatsApp link to message someone yourself.
• No analytics company, no ad network, no social-media pixel, and no fonts or scripts loaded from other companies.

How long I keep it

Your data stays while your account exists. When you ask me to delete it, I delete the workspace, its files and your sign-in within 30 days, usually within a week. Backups kept by the hosting provider drop it as they roll over.

What I must keep: the records of what you paid me, for as long as the law requires me to keep accounts.

Small things are cleared on a schedule: spam counters after a few days, confirmation codes within a day, and old contact messages after a year.

Your rights, and how to use them

I follow the principles of Algeria's law 18-07 and of the GDPR as carefully as a one-person project can. If I get something wrong, tell me.

• See and take your data: Settings, Your data, Export everything gives you a zip with all of it.
• Correct it: edit it in the app, or tell me.
• Delete it: Settings, Your data, Delete my data. If you don't have an account, use the Delete my data page.
• Withdraw consent or stop emails: switch notifications off in Settings, or use the unsubscribe link in any automatic email.
• Complain: you can contact Algeria's data protection authority (ANPDP), or the authority in your own country. Please talk to me first, I'll answer.

Children

FlowLNCR is for adults, 18 or over, who work for themselves. I don't knowingly collect data from children. If you think a child's data is in here, write to me and I'll remove it. If you add data about children for your own work, you need the consent of their parent or guardian.

Security

Every workspace is separated by the database, so one person can never read another's. Connections are encrypted, passwords are hashed, keys are in a vault and private notes are end-to-end encrypted. No system is perfect. If something happens that affects you, I'll tell you by email without delay.

Emails

I send you the emails the service needs: sign-in codes, receipts for your plan, support replies, and the notifications you chose. News about FlowLNCR can be switched off in Settings. Automatic emails sent to your clients on your behalf, such as reminders, carry a link that lets them stop receiving them.

Changes

If I change this page in a way that matters, I'll tell you in the app or by email before it applies. The date at the top is always the last change.