FlowSpace Privacy Policy

Introduction

Welcome to FlowSpace, a study platform for students. This Privacy Policy explains how we collect, use, and protect your information when you use our application.

FlowSpace is currently in beta testing. By using FlowSpace, you acknowledge that the app is under active development and may have limited features or instability.

Information We Collect

Data We DO Collect

1. Google Account Information

• What: Your name, email address, and profile picture
• Why: Required for sign-in via Google OAuth
• How: Collected when you sign in with your Google account
• Storage: Authentication managed via AWS Cognito; tokens stored in your OS secure keychain

2. Academic Data

• What: Assignments, subjects, subtasks, daily plans, deadlines, and completion status
• Why: Core functionality of the app — organizing your academic workload
• Storage: Synced to AWS DynamoDB (US-based, encrypted at rest)

3. Personal Tasks and Work Sessions

• What: Personal task lists and study session records
• Why: To help you track your productivity and plan your time
• Storage: Synced to AWS DynamoDB

4. AI Tutor History

• What: Problem or question text you submit, AI responses, and multiple-choice attempt records
• Why: To provide personalized tutoring and track your concept mastery over time
• Storage: Conversation history stored in AWS DynamoDB; problem text is sent to Google Gemini API for AI processing (see Google Gemini Disclosure below)

5. Concept Mastery Data

• What: Your understanding level for individual academic concepts
• Why: To personalize AI tutoring and track academic progress
• Storage: Synced to AWS DynamoDB

6. University Name

• What: The name of your educational institution and .edu email verification status
• Why: To verify student status and provide institution-relevant features
• How: You provide this during onboarding
• Storage: Synced to AWS DynamoDB

7. App Settings and Preferences

• What: Your in-app preferences and configuration settings
• Storage: Synced to AWS DynamoDB

8. Anonymous Usage Analytics

• What: Behavioral metadata such as session duration, feature usage events, and app navigation patterns
• Why: To understand which features are most valuable and improve the user experience
• How: Collected via PostHog using an anonymous identifier
• Storage: PostHog (posthog.com); data retained for 1 year

9. Session Analytics (Professor-Linked Courses Only)

• What: Anonymized session metadata when you are enrolled in a professor's course inside FlowSpace
• Why: To provide educators with aggregate course-level insights
• Storage: Anonymized data stored in AWS S3; only collected when you are connected to a professor's course

Data We DO NOT Collect

We explicitly do not collect:

• Assignment file contents not submitted to the AI tutor
• Browsing history or keystroke logging
• Location data
• Calendar event details beyond what you explicitly enter in FlowSpace
• The content of your answers in ways linked to your identity (analytics are anonymous)

Anonymous Usage Analytics — PostHog

We use PostHog (posthog.com) to collect anonymous usage analytics. This includes behavioral data such as session duration, feature usage events, and app navigation patterns. We never collect the content of your assignments, tasks, questions, or answers. Analytics data uses an anonymous identifier and cannot be linked to your name or email. This data is used solely to improve FlowSpace — it is never shared with your institution, professors, or any third party, and never used to evaluate your academic performance.

PostHog analytics data is retained for 1 year, then automatically deleted.

Google Gemini AI Disclosure

When you use AI tutoring features, the problem or question text you submit is sent to Google Gemini API (provided by Google LLC) for processing. Google Gemini operates in the cloud — your data temporarily leaves your device during AI processing. We do not store this data beyond what is needed to return your response. See Google's privacy policy: https://policies.google.com/privacy

Data Storage Breakdown

• Cloud (AWS DynamoDB): Assignments, subtasks, subjects, daily plans, personal tasks, work sessions, tutor sessions and messages, mastery data, settings
• Cloud (AWS S3): Session analytics (only when connected to a professor's course)
• Cloud (AWS Cognito): Authentication tokens
• AI inference (Google Gemini): Problem text sent when you use AI tutoring

How We Use Your Information

We use the collected data solely for:

1. Providing the Service

• Syncing your assignments, tasks, and academic data across your devices
• Enabling tutoring features and concept mastery tracking
• Tracking concept mastery to adapt tutoring sessions

2. Service Improvement

• Understanding feature usage patterns via anonymous analytics
• Identifying which workflows are most effective for students
• Prioritizing new features based on user needs

We will NEVER:

• Sell your data to third parties
• Use your data for advertising or marketing
• Share your usage data with your institution or professors for evaluative purposes
• Use your data to grade you or make decisions about your academic standing

Safe Learning Environment

FlowSpace is a tool for students. We never share your usage data with your professors, institution, or any third party for evaluative purposes. Your analytics data cannot be used to grade you, monitor your study habits on behalf of your school, or make any decisions about your academic standing.

Incognito Mode

Incognito mode keeps your AI tutor session private from course-level tracking. When enabled, your session is not linked to a specific course and will not appear in any course or institutional reports. Anonymous usage analytics (PostHog) continue to run, but without course association.

Auto-Update Disclosure

When the app checks for updates, it contacts our update server with your app version and operating system type. No personal information is sent. You can disable auto-updates in your OS settings.

FERPA

FlowSpace is designed to support FERPA compliance. If your institution has you connect FlowSpace, we handle your educational records according to FERPA guidelines. Your assignment content is stored in AWS DynamoDB (US-based, encrypted at rest) and only sent to cloud AI services for the specific AI tutoring features you actively use.

For full details on how FlowSpace handles educational records under FERPA, see our FERPA page.

Third-Party Services

FlowSpace uses the following third-party services:

PostHog

• Provider: PostHog, Inc.
• Purpose: Anonymous usage analytics
• Data Shared: Anonymous identifier, feature usage events, session duration, navigation patterns
• Privacy Policy: https://posthog.com/privacy

AWS Cognito

• Provider: Amazon Web Services, Inc.
• Purpose: Authentication and token management
• Data Shared: Google account info (name, email) passed through OAuth flow
• Privacy Policy: https://aws.amazon.com/privacy/

Google OAuth

• Provider: Google LLC
• Purpose: Sign-in authentication
• Data Shared: Name, email address, and profile picture via OAuth 2.0
• Privacy Policy: https://policies.google.com/privacy

Google Gemini API

• Provider: Google LLC
• Purpose: AI tutoring — problem analysis, step-by-step guidance, practice questions
• Data Shared: Problem or question text you submit when using AI tutoring features
• Privacy Policy: https://policies.google.com/privacy

GitHub

• Provider: GitHub, Inc.
• Purpose: App update delivery
• Data Shared: App version and OS type (no personal information)
• Privacy Policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

Security Measures

• Encryption at rest: All data stored in AWS DynamoDB is encrypted at rest
• Encryption in transit: All network communication uses TLS/HTTPS
• Auth tokens: Stored in your OS secure keychain (never in plaintext)
• Anonymization: Analytics data uses anonymous identifiers with no personal identifiers
• Access control: AWS data is only accessible to FlowSpace developers with appropriate IAM permissions
• No third-party sharing: We never share raw user data with third parties outside those listed above

Beta Program Terms

FlowSpace is currently in beta testing. By participating, you acknowledge:

Service Availability

• The app may be unstable or unavailable at times
• Features may change or be removed without notice
• The service may be discontinued at any time

Data Loss

• While we take precautions, data loss may occur during beta
• We recommend keeping personal backups of important information
• We are not liable for any data loss during the beta period

Feature Access

• All Pro features are currently free during beta testing
• Pricing and feature availability may change after beta
• Beta users will be notified before any pricing changes

Your Rights

You have the following rights regarding your data:

Right to Access

You can request to see what data we have collected and stored about you.

Right to Deletion

You can delete all your data at any time from Settings > Account > Delete Account inside the app, or by contacting us at hello@myflowspace.app.

Right to Opt-Out of Analytics

You can request to opt out of anonymous analytics collection by contacting us. Note that analytics help us improve the app for all students.

Data Portability

You can export your assignment and task data at any time. Contact us at hello@myflowspace.app to request a data export.

Children's Privacy

FlowSpace is designed for students and may be used by individuals under 18. We:

• Require Google account sign-in, which itself has age requirements
• Only collect data as described in this policy
• Recommend parental guidance for users under 13
• Comply with COPPA (Children's Online Privacy Protection Act)

If you are a parent and believe your child has used FlowSpace, please contact us.

Data Retention

• Account and academic data: Retained while your account is active; deleted upon account deletion
• AI tutor history: Retained in AWS DynamoDB while your account is active
• PostHog analytics: Automatically deleted after 1 year
• Session analytics (S3): Retained per institutional agreement; anonymized
• Workspace templates: Local to your device; removed when you uninstall or manually delete

Data Storage Location

FlowSpace operates in the United States. All AWS services (DynamoDB, Cognito, S3) are hosted in US-based AWS regions. PostHog data may be processed in the United States or European Union per PostHog's infrastructure.

All data storage and processing complies with applicable United States federal and state privacy laws, including COPPA and CCPA where applicable.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

Your Rights

• Right to Know: You have the right to know what personal information we collect, use, and disclose
• Right to Delete: You have the right to request deletion of your personal information
• Right to Opt-Out: You have the right to opt-out of the sale of personal information (we do not sell personal information)
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights
• Right to Correct: You have the right to request correction of inaccurate personal information

Categories of Information We Collect

We collect the following categories of personal information (as defined by CCPA):

• Identifiers: Name, email address (via Google OAuth / AWS Cognito)
• Internet Activity: Anonymous usage analytics (feature usage, session duration)
• Education Information: Assignment data, academic subjects, concept mastery

How to Exercise Your Rights

To exercise any of these rights, please contact us at hello@myflowspace.app with "CCPA Request" in the subject line. We will respond to your request within 45 days.

We Do Not Sell Personal Information: FlowSpace does not sell, rent, or share your personal information with third parties for monetary or other valuable consideration.

Platforms

FlowSpace is available on Windows 10+, macOS 12+, and Linux (Ubuntu 20.04+).

Changes to This Privacy Policy

We may update this Privacy Policy as FlowSpace evolves. When we make changes:

• The "Last Updated" date at the top will change
• Significant changes will be announced in-app
• Continued use after changes constitutes acceptance

You can always view the latest version at: myflowspace.app/privacy

Contact Us

If you have questions or concerns about this Privacy Policy or your data:

Email: hello@myflowspace.app
Website: myflowspace.app
Response Time: We aim to respond within 7 business days

For privacy-specific inquiries, please include "Privacy Request" in your subject line.

Acknowledgment

By using FlowSpace, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of information as described herein.

FlowSpace - Your assignments, simplified.