Flow Privacy Policy

1. Who is responsible

Flow is presented as a product of O’Riley Foundation. The formal contracting entity, registration details, and jurisdiction of establishment have not been confirmed in the project materials. A dedicated privacy contact or data protection officer has not been published. These details must be confirmed and published before launch in any jurisdiction that requires them.

2. Where this notice applies

This notice covers the public Flow website at zimlive.app, the separate Flow browser workspace, and the current Android and iOS applications. The browser sites have separate origins and sessions. Sign-in credentials may be shared only if both sites are configured with the same Firebase Authentication project and provider; profile and Firestore data are not automatically shared. Mobile apps do not currently share a Flow online account.

3. Information and purposes

• Public website: the site does not include analytics, advertising pixels, or an advertising SDK in the reviewed source. The hosting provider may process request and security logs, such as IP address, time, and browser information; the deployed provider’s exact fields and retention must be confirmed.
• Account and browser workspace, when Firebase is configured: the browser code handles the email address and password briefly in memory to submit sign-in or account requests to Firebase Authentication. Flow’s application server and Firestore do not store the password; Firebase Authentication processes the credentials and handles verification and recovery. Google may also process technical information such as IP address, app or project identifiers, user-agent data, and service usage information to provide Firebase and help prevent abuse. Firestore may store a profile display name, private listing drafts (title and description), report records (reason and details), timestamps, and identifiers needed to associate records with the signed-in account. Published listings may be displayed publicly if an authorized service publishes them. Administrators with access to the Firebase project may be able to access stored records. See Google’s Firebase privacy information; actual processing and transfer details depend on the configured services and terms.
• Browser session and preferences: Firebase Authentication may use browser storage to maintain the session needed for a requested sign-in. This site stores your cookie-choice preference in local browser storage. These are separate from optional analytics or advertising technologies, which are not active in the reviewed web source.
• Android: the current app stores profile and demonstration content on the device, including local messages, posts, directory entries, and wallet-style records. Room database content is not encrypted by the app. App-lock credentials are protected with Android Keystore. Older installations can retain earlier demonstration data. When media screens are viewed, sample images or videos may be requested from Unsplash, Picsum, or Mixkit hosts, which receive connection metadata. No Android server account or sync is connected.
• iOS: the current app is an informational SwiftUI introduction. It does not provide an account, server connection, or persistent user profile.

Data is used to provide the feature a person requests, maintain account security, operate the service, respond to valid legal requirements, and administer the platform. The operator must map each purpose and data field to the lawful basis applicable in each launch jurisdiction; this mapping has not yet been approved.

4. Cookies and similar technologies

The reviewed website source contains no analytics or advertising cookies, pixels, or tags. The consent choice is saved in local storage for up to 180 days so the choice can be remembered. Essential browser storage used by Firebase Authentication supports a session after a user asks to sign in. Choosing “Essentials only” does not disable account sign-in or the browser features the user requests. Optional analytics and advertising technologies are not currently active. If optional technologies are added, Flow must describe them and ask again before using them.

You can change your choice at any time using “Cookie choices” in the site footer. Browser settings can also clear local storage and session data.

5. Service providers and transfers

When configured, the browser workspace uses Google Firebase Authentication and Cloud Firestore. Google states that Firebase Authentication processes data in the United States; other Firebase products and project settings may involve different processing locations. The public website is deployed through its configured hosting provider; the browser workspace is hosted separately. Provider locations, contractual terms, international transfer safeguards, and production settings have not been verified in this repository. The separate Supabase/NestJS API is a development scaffold and is not connected to the current browser workspace. External store and Foundation links take you to those services when selected. The operator must review current provider terms, regional settings, and transfer safeguards before enabling real accounts.

6. Retention, access, and deletion

Android data remains on the device until it is cleared in the app or removed with the app, subject to device behavior. For configured Firebase accounts, no published retention schedule or complete self-service account-deletion and data-export flow is currently documented. A user can delete private draft listings through the workspace, but profile deletion and deletion of saved report records are not currently available there. The operator must define and implement verified access, correction, export, deletion, backup, and retention procedures before collecting real account data. Do not use Flow for sensitive personal data.

7. Your privacy rights

Depending on your location and the law that applies, you may have rights to request access, correction, deletion, restriction, portability, or to object to certain uses, withdraw consent where processing relies on consent, and complain to a supervisory authority. The exact rights and response timelines vary by jurisdiction. A dedicated privacy request channel is not yet published; this is an unresolved launch requirement. The operator must provide a working contact and process before account features are used for real personal data.

8. Children

The minimum user age, child-directed status, and age-assurance approach have not been confirmed. Do not create an account for a child or submit a child’s personal information until the operator publishes an age policy and the required safeguards for the jurisdictions where Flow is offered.

9. Security and incidents

Flow applies technical controls documented in its source, but no system can be guaranteed secure. The browser workspace relies on Firebase configuration and deployed Firestore rules; production deployment and settings have not been independently verified. Android’s local Room database is not encrypted by the app. A documented public incident contact and a complete operational incident-response process have not been confirmed.

10. Account acknowledgment

Before account creation, the current web forms require the user to check that they have read and understand this notice. That checkbox is a user-interface gate; the current forms do not create a durable record of the acknowledgment, and it is not used as consent for unrelated or optional processing. The Android app records a local first-run acknowledgment on the device. These controls do not replace a lawful-basis assessment or any consent required for a particular processing activity.

11. Changes and questions

When data practices change, this notice and its version should be updated before the new practice begins. The responsible operator must add its confirmed legal identity, postal address, privacy contact, and any required representative or regulator details here. Until that information and the controls above are complete, this page is an interim engineering disclosure, not a final jurisdiction-specific privacy policy.