Privacy Policy

FlowForgeSoft, LLC ("FlowForge," "we," "us," or "our") built FlowForge to give developers a verifiable record of their own work. This policy explains, in plain terms and without generic filler, what information we collect when you visit flowforgesoft.com or use the FlowForge product, why we collect it, and the choices you have.

This is the English version of our Privacy Policy; the Portuguese version says the same. If the two ever differ, the Portuguese version prevails for people in Brazil, and this English version everywhere else.

1. Who we are

FlowForge is a product of FlowForgeSoft, LLC, a Delaware limited liability company (Delaware File #10616707), located at 2810 N Church St STE 88527, Wilmington, DE 19802. For any privacy question, contact us at alex@flowforgesoft.com. Data-protection requests under the GDPR and Brazil's LGPD can go to that address or to our data protection officer below.

Data protection officer (encarregado, Brazil's LGPD, art. 41): Alexandre Reis Corrêa Cruz, privacidade@flowforgesoft.com. We answer in Portuguese and English.

2. Information we collect

2.1 Account information

When you sign up, we collect the email address and password you provide, and — only if you choose to enter it — a display name used to personalize your welcome email. Your password is handled by Supabase Auth, our authentication provider; FlowForge never stores your password in plain text.

2.2 Payment information

Subscription checkout is processed by Stripe on Stripe's own hosted payment page. FlowForge's servers never receive, transmit, or store your card number, expiration date, or security code — that data goes directly to Stripe. Stripe notifies us of billing events (checkout completed, subscription updated, payment failed) over a signature-verified webhook, and we keep a record of those events — including the billing contact details Stripe collected for the transaction (name, email, and billing address) and the amount charged — to activate and maintain your license and to have a forensic record if a billing dispute comes up. We use this to operate your subscription; we don't use it for marketing.

2.3 Product usage data (time tracking)

FlowForge's core feature is generating a verifiable, billable record of your own development work. To do that, the FlowForge CLI/TUI records session and time-tracking events locally on your machine — which ticket you're working on, session start/stop times, and token-cost data — and syncs them in batches to our database once you're signed in. This data exists to power the time-tracking and reporting feature you're using it for; it is not shared with, or sold to, any third party.

2.4 Communications

If you email support, we keep that correspondence to respond to you and to improve the product. The sign-up form asks whether you want to receive product-update emails. The box arrives unticked (sign-ups made before this change saw it ticked); answering it is optional, and it never affects your purchase. We record your answer either way — ticked or unticked — together with the exact wording you were shown. You can unsubscribe at any time from the link in any product-update email, without affecting your ability to keep using FlowForge. Receipts, account and security emails are not marketing and are sent regardless. The product-update email is the monthly letter described in 2.7; section 6.1 explains the legal basis we rely on for it.

2.5 How you found us

If you arrived through a link carrying campaign tags (the utm_source, utm_medium, utm_campaign, utm_term and utm_content parameters in the address), we keep those tags in your browser while you look around, and when you subscribe we attach them — together with your answer to the optional "How did you hear about us?" question on the sign-up form — to your checkout at Stripe. We use this only to learn which channels bring customers to FlowForge. The tags and your answer stay between you, us and Stripe — unless you accept advertising measurement, in which case the page addresses Meta and Google receive include them (section 4.2). Skipping the question changes nothing about your purchase.

2.6 Server request logs

Every request to flowforgesoft.com, and to get.flowforgesoft.com — where you download FlowForge and where the product itself fetches updates and components — passes through Amazon CloudFront, which writes a standard access log entry. Each entry records your IP address, the date and time, the address requested including its full query string (so any campaign tags in the link), the page you came from (the referrer), your browser's user-agent string, and technical details such as the response status and size. Cookies are not logged. Our checkout backend also writes operational logs while it processes a sign-up. We use these logs to keep the site and downloads running and secure — diagnosing errors and blocking abuse — and to count, in our own records, how many visits and downloads the site gets. The logs stay in our Amazon Web Services account and are not given to advertising platforms. They are deleted automatically after 90 days (section 9).

We also count, in aggregate and never per person, how many visits arrive from each link, campaign and referring site. These counts hold no IP address and no browser detail, and we keep them for as long as we report on our marketing. Section 6.2 explains why we may do this and what we never do with it.

2.7 The FlowForge monthly letter

Once a month we send an email letter: what we shipped in FlowForge the month before, and one problem of building software with AI explained, with the research behind it and how FlowForge deals with it. Anyone can ask for it from our website, customer or not, in English or Portuguese.

• You confirm first. When you type your address into the sign-up form, we send one email with a confirmation link. Nothing else is sent until you click it. If you never click it, we delete your address from our list after 30 days.
• What we keep: your email address; the language you chose; whether you are subscribed; and the proof of your request — the exact wording you agreed to and its version, the date and time you asked, where you asked (the site form, your account sign-up, or our re-confirmation email), and the date and time you confirmed. When you unsubscribe, we record that too. Signing up for the letter asks only for your email address and language — never your name, your birth date or your country.
• What every issue says about itself: each letter states that it is a marketing email from FlowForgeSoft, LLC, gives our postal address (2810 N Church St STE 88527, Wilmington, DE 19802, USA), tells you why you are receiving it, and carries a one-click unsubscribe link that keeps working for at least 60 days after the letter was sent. We stop sending to you as soon as you unsubscribe, and never later than 10 business days after.
• We do not track whether you open the letter or click its links. We put no tracking pixel in the letter and we do not rewrite its links to count clicks. Pictures in the letter load from our own web hosting, so, like any request to our servers, loading them is written to the request logs described in 2.6.
• Who delivers it: Resend sends the letter and the confirmation email on our behalf; the list itself is stored with Supabase (section 5).

Unsubscribing from the letter never affects your FlowForge account or your purchase. Receipts, account and security emails are not marketing and are sent regardless.

3. Cookies and local storage

Without your consent, flowforgesoft.com sets no advertising or tracking cookies. The site uses your browser's localStorage and sessionStorage for strictly functional purposes: remembering that you've dismissed a launch-announcement banner, caching the plan/billing options you selected while moving between pages, holding the campaign tags of the link you arrived from until you sign up (see 2.5), remembering your answer to the advertising-measurement question (section 4), and — via our authentication provider's own SDK — keeping you signed in between visits. None of this is used for ad targeting or cross-site tracking. If you accept advertising measurement, the Meta and Google tools described in section 4 set their own cookies and use similar technologies; if you don't, they are never loaded.

One cookie is set by our servers rather than by the page: ff_ad_region. It holds one of three words — eu, outside or unknown — saying whether you are visiting from the European Union or the European Economic Area, so the page knows to keep the advertising tools off there (section 4.4). It never holds your country, your city or anything that identifies you, and it is deleted when you close your browser.

4. Advertising measurement

We market FlowForge with paid advertising, and to know whether an ad worked — and to show FlowForge again to people who have already visited — the website uses measurement tools from two advertising platforms. The FlowForge product does not use them (see the short version above).

• Meta Platforms (Facebook and Instagram ads): the Meta Pixel, a script on our web pages, and the Meta Conversions API, which our servers use to tell Meta that a sign-up happened.
• Google (Google Ads, including YouTube ads): the Google tag on our web pages, and Google's conversion measurement, which tells Google that a sign-up happened.

4.1 You choose first

These tools are off until you turn them on. The first time you visit, the site asks whether you accept advertising measurement. Until you choose "Accept", none of the Meta or Google scripts load and our servers send nothing about you to either platform. If you choose "Decline", or ignore the question, it stays that way. You can change your answer at any time from the privacy-choices link at the bottom of every page; withdrawing consent stops all further collection from then on. If the site has never asked you, nothing from these tools has been loaded. Visitors in the European Union and the European Economic Area are not asked at all: the tools stay off for them (section 4.4).

If your browser sends a Global Privacy Control signal, we treat it as "Decline" and the tools do not load. We do not otherwise change behavior in response to "Do Not Track" signals; the tools stay off unless you accept.

4.2 What the platforms receive, if you accept

• From the scripts in your browser: the pages you view on flowforgesoft.com and the address of each (including any campaign tags), the page you came from, your IP address, your browser and device information, the platform's own cookie and click identifiers, and events such as "started sign-up" or "completed checkout".
• From our servers, when you complete a sign-up: the event itself ("completed sign-up", with the plan and amount), the time, your IP address and browser user-agent, the platform's click identifier from the ad you clicked, and your email address in hashed form. Hashing turns your email into a fixed code (SHA-256), so we never send it readable. The platform can still match that code to an account it already has for you, which is the purpose of sending it: it lets the platform tell whether its ad led to the sign-up.

We never send the platforms your password, payment card details, billing address, your product-usage or time-tracking data, or anything from inside the FlowForge product. We do not upload lists of our existing customers to either platform.

4.3 What the platforms do with it

Meta and Google use this data to measure and improve our ads, to build audiences we can show ads to again, and to find similar people. They also use the data under their own terms and privacy policies, for their own purposes as those policies describe: Meta's Privacy Policy and Google's Privacy Policy (including how Google uses information from sites that use its services). Once the data reaches them, how long they keep it is set by those policies, not by us.

4.4 Visitors in the European Union and the European Economic Area

If you visit from a country of the European Union or the European Economic Area (the European Union plus Iceland, Liechtenstein and Norway), the Meta and Google tools never load and our servers send nothing about you to either platform, whatever you answered — the site does not ask the question there. We tell where you are visiting from by the country our content-delivery network, Amazon CloudFront, works out from your IP address for each request; we do not keep it. If it cannot work out a country, the tools stay off too. Because the country comes from the network address, what counts is where the request comes from on that visit: a VPN or a trip abroad can change it.

5. Who we share information with

Our service providers process information on our behalf, under contract with us, only to run FlowForge:

• Stripe — payment processing and subscription billing.
• Supabase — our authentication and database provider, which stores your account, entitlement, and product-usage records, and the monthly-letter list (2.7).
• Amazon Web Services — hosting for flowforgesoft.com and get.flowforgesoft.com, the checkout backend that also receives letter sign-ups, and the server request logs described in 2.6.
• Resend — delivery of the emails we send you, such as your welcome message, account notices, the monthly letter and its confirmation email.

Separately, and only if you accept advertising measurement, Meta Platforms and Google receive the data described in section 4. They do not act only on our instructions: under their own terms, they also use what they receive for their own purposes.

We do not sell your personal information for money, and we do not share it with data brokers. Under California law, the advertising data described in section 4 may count as "sharing" for cross-context behavioral advertising; it happens only if you accept, and declining or withdrawing is your opt-out.

5.1 Our commitment on how your data is used

6. Why we are allowed to use it

Where the law requires a legal basis for using personal information (for example the EU and UK GDPR, or Brazil's LGPD), ours are:

• To provide what you asked for (the contract with you) — your account, subscription, payments, and the time-tracking feature.
• Our legitimate interest in running a secure, working website and download service and in counting our own visits, including which links, campaigns and referring sites bring them — the server request logs in 2.6 (6.2).
• Your consent — advertising measurement (section 4). You can withdraw it at any time from the privacy-choices link; withdrawing does not affect what happened before.
• The monthly letter and other marketing email (2.4, 2.7) — consent or legitimate interest, depending on how you came to receive it (6.1).
• Legal obligations — tax, accounting and similar records we are required to keep.

6.1 The monthly letter and other marketing email

• If you subscribed from the website (2.7): your consent, which you give by asking and then clicking the confirmation link.
• If you have a FlowForge account but never bought a subscription: your consent. If you signed up while the product-update box arrived ticked (2.4), we do not treat it as your consent: we will ask you once, by email, to confirm that you want the letter. If you do not confirm by the date that email gives, we stop sending it; your account and its emails carry on unchanged.
• If you are a paying customer, while your subscription is active, and the product-update box was ticked when you signed up: our legitimate interest in telling the people who pay for FlowForge what changed in it and how to get the most from it. You can object at any time — the unsubscribe link in every letter is enough — and we stop.
• If you ask us to erase your address: our legitimate interest in honouring your own request, explained in section 8.

Our balancing test for paying customers. Before relying on legitimate interest, we weighed it against your rights and expectations. The purpose is specific: telling the people who pay for FlowForge, once a month, what changed in the product and how to get the most from it. It applies only if the product-update box was ticked when you signed up; if it was unticked, you do not receive the letter this way. For it we use only your email address, your language and whether you are subscribed, plus a record of when and how you joined and left the list. The letter has no tracking pixel and no click counting. A paying customer reasonably expects to hear from the company about the product they bought; every issue says why you receive it; and you can leave in one click from any issue, without any effect on your subscription. We concluded that this use does not override your interests or rights. You can ask us for the full assessment at privacidade@flowforgesoft.com.

6.2 Counting where our visits come from

Our assessment for counting visits by link, campaign and referring site. Before relying on legitimate interest, we weighed it against your rights and expectations. The purpose is specific: knowing which of our links, campaigns and referring sites bring visitors to our website, so we stop paying for what brings nobody. For it we read only two things from the request logs in 2.6: the campaign tags in the address (the utm_ parameters) and the site you came from, cut down to its name (for example, dev.to). We turn them into daily counts per page — a number of visits, nothing more. We never link requests to one another by IP address or by browser (user-agent) string, we never use the logs to follow a person or to build a profile, and we give neither the logs nor the counts to advertising platforms. We count only from logs written after this section was published, never from older ones. Campaign tags sit in the link you click, where you can see them, and a visitor can reasonably expect a company to count how many visits each of its links brings. You can object at any time (section 8). The counts hold nothing that identifies you, and the logs they are made from are deleted after 90 days. We concluded that this use does not override your interests or rights. You can ask us for the full assessment at privacidade@flowforgesoft.com.

7. How we protect your information

Traffic to flowforgesoft.com is encrypted in transit (TLS 1.2+). Every table holding customer data is protected by database-level access controls: your account, billing, and license records are readable only by you, and team-oriented data — the tickets and usage records that make sense to share within a project — is readable only by members of that project or organization, never by anyone outside it. Internal writes go through server-controlled procedures rather than direct client access. See our Security page for the full, specific breakdown of what we do — and what we don't yet claim.

8. Your choices and rights

You can review and update your account details from within the product. To request a copy of your data, ask us to correct it, or ask us to close your account and delete associated personal data, email alex@flowforgesoft.com. We handle these requests manually today — we don't yet have a self-serve export/delete tool. Depending on where you live, you may also ask us to restrict or stop certain uses, to receive your data in a portable format, or to tell you who we shared it with, and you may complain to your data-protection authority (for example, Brazil's ANPD or your EU/UK supervisory authority). Where we rely on legitimate interest (section 6), you can object, and we will stop unless we have compelling grounds or need the data for a legal claim — for the monthly letter we always stop (6.1). We won't treat you differently for exercising these rights, and we respond within the time the law that applies to you requires. Deleting your account removes your active account and product-usage data; it does not remove the billing-event forensic ledger described in section 9, which we keep separately to resolve billing disputes.

Advertising measurement: you can turn it off at any time from the privacy-choices link at the bottom of every page. If you ask us to delete your data, we also stop sending anything about you to Meta and Google. We cannot delete what those platforms already hold; each gives you its own controls for that — your activity off Meta technologies and Google's My Ad Center.

Server request logs are not organised by person and are not linked to your account, so we don't search or edit them on individual request; every entry is deleted automatically after 90 days.

The monthly letter: you can unsubscribe from any issue in one click. If you also ask us to erase your address, we delete it and the whole history of your subscription, including the proof that you asked for the letter. What remains is a keyed hash of the address — a code computed from it with a secret key, from which the address cannot be read back; with the key, we can only check whether a given address matches it — so that it is never added to the list again unless you ask. We keep that code on our legitimate interest in honouring your own request (section 6.1). If you would rather we keep not even that code, tell us; we will delete it too, and we will then be unable to stop someone else from signing your address up again. We also ask Resend to delete your address from its records.

9. Data retention

We keep account and billing records for as long as your account is active, and afterward only as needed to satisfy tax, accounting, and legal obligations. Time-tracking session data is retained so your historical reports remain accurate for as long as you keep your account. The billing-event record described in §2.2 is kept as a forensic ledger — separate from your active account record — so we can resolve a billing dispute or reconstruct what happened on your subscription even after an account is closed; it is not linked back into your day-to-day account data once you've deleted your account.

Server request logs (2.6) are deleted automatically 90 days after they are written; the checkout backend's operational logs are deleted on the same 90-day schedule. The daily visit counts made from the request logs (2.6, 6.2) hold no IP address and no browser detail; we keep them for as long as we report on our marketing. Your answer to the advertising-measurement question stays in your own browser until you change it or clear your browser's storage. We keep no copy of the hashed email we send to Meta or Google; what they receive is kept under their policies (section 4.3).

For the monthly letter (2.7):

• Your address, language and subscription state: while you are subscribed.
• A request nobody confirmed: deleted 30 days after it was made.
• The proof of your consent (the wording, its version, the date and time, and the confirmation click): 5 years after the last letter we sent on it or after you unsubscribe, whichever is later, so we can show that you asked — unless you ask us to erase your address first (section 8).
• The keyed hash that keeps an erased address off the list (section 8): for as long as the list exists, unless you ask us to delete it.
• The request logs of your sign-up and confirmation (2.6): deleted after 90 days, like every other request log.

10. International users

FlowForgeSoft, LLC is a US company. Almost all of your data comes directly from you; it is stored with cloud providers in the United States (Supabase and Amazon Web Services), with our email provider (Resend) and, for payments, with Stripe. Our team accesses it from the United States and Brazil.

If you use FlowForge or subscribe to the letter from outside the United States, your information is processed in the United States, and by our team from Brazil. For readers in Brazil, giving us your data through our website or the product is what Brazil's data-protection authority calls international collection (coleta internacional, ANPD Resolution 19/2024, Annex I, art. 6): we, the company abroad, collect it directly from you. Brazil's LGPD applies to that data, and to every reader's data whenever our team works on it from Brazil. If you accept advertising measurement, Meta and Google may also process the data described in section 4 in the United States and other countries, under their own transfer safeguards.

11. Children's privacy

FlowForge is a professional developer tool and is not directed at, or knowingly used to collect information from, children under 16. The monthly letter is not directed to children either, and we ask for no birth date anywhere. If we learn that we hold the email address of a child under 16, we delete it.

12. Changes to this policy

If we make a material change to how we handle your information, we'll update the date at the top of this page, and if the change alters why we use your data, we will tell you before it takes effect. We encourage you to check back periodically.

13. Contact us

Questions about this policy or how we handle your data: alex@flowforgesoft.com, or by mail at FlowForgeSoft, LLC, 2810 N Church St STE 88527, Wilmington, DE 19802.