This is the honest version. It describes what Flowy actually collects and why. Nothing more. If something here is unclear, email us (below) and we'll explain.
1. Analytics
We measure usage in two ways. The first is our own, a first-party cookie called flowy_anon: a random UUID, set for 90 days and marked httpOnly. It lets us count anonymous page-view and usage events (catalog views, flow views, flow adds) so we know whether people actually read and run Flows. This is not based on your IP address and is not a browser fingerprint. It's just a random identifier in a cookie. Events are stored in our usage_events table and are not tied to your account.
The second is PostHog, an analytics service hosted in the United States, which we use to count page views and returning visitors. Its script keeps a random visitor id in your browser, together with the full address of the first page you opened here, query string included, and the address you came from. It keeps them in a first-party cookie (its name starts with ph_, kept for up to a year and readable by the page), which your browser sends back to flowy.sh with each request, and in the browser's local storage, which stays until you clear it. Each page view sends PostHog the address and title of the page, the page that linked you here, and basic details of your browser and device. Query strings are removed from our own addresses, except the few that describe the view; campaign tags and ad-click identifiers in the link you followed (such as utm_source or gclid) are sent as well. When you close the tab or leave the site, PostHog gets one more event with the same address, so we can see how long a visit lasts. It records nothing you type or click: autocapture, dead-click capture, heatmaps, session recording and surveys are switched off, and the script can neither load PostHog's add-on code nor take settings from PostHog's dashboard. As with any request your browser makes, PostHog's servers see your IP address, and can estimate your country and city from it.
2. Sign-in
You can sign in with a magic-link email or with GitHub OAuth. Authentication is handled by Supabase. We store your email address and, if you sign in with GitHub, your public GitHub username/handle. We use these to identify your account and attribute Flows you contribute. Nothing more.
3. Newsletter
If you subscribe to product updates, we store your email address in our newsletter_signups table so we can send you those updates. You can unsubscribe at any time. Reply to any email or contact us (below) and we'll remove you. We don't use your newsletter email for anything other than Flowy updates.
4. Placement requests
When you ask for a Boost, the Founding Slot or a product ad, the form sends us what you type into it: your email, the plugin or the product, any name, handle or note you add, and the Flowy page you came from. We use it to reply with a payment link, or first with a price for a product ad. We store the request in our database so we can answer it, and Resend delivers a copy to our inbox, or your own email app sends it when the form cannot. We delete the request from our database 12 months after you send it; ask at hello@flowy.sh and we delete it sooner, with its copy in our inbox. To limit abuse, we count requests per day for each network address and for each email; the count stores your network address itself and only a one-way hash of your email.
5. Processors
We rely on a small set of third-party services to run Flowy: Supabase (database, authentication, and file storage), GitHub (OAuth sign-in and reading the repos that back imported Flows), Resend (delivering placement requests to our inbox), PostHog (page-view analytics, hosted in the United States), and our deployment host (which serves the site). These providers process data on our behalf so the product can function. We do not sell your personal data.
On a plugin page, your browser asks star-history.com for that repository's star chart when the chart scrolls into view. Their site then receives your IP address, your browser's name, version and operating system, and the repository's name. Until the chart is near the screen, your browser sends them nothing.
6. Contact
For data requests, including access, correction, and deletion, or for any privacy question, email contact@flowy.sh.