The short version: FlowState helps you focus, grow, and ship. We collect only what we need to make the product work. We don't sell your data. We use industry-standard security. You own your data and can delete it anytime.
1. Who We Are
FlowState ("we," "us," or "our") is a productivity and creative intelligence platform operated as a software service. Our website and application are available at flowst8.cc and related subdomains. FlowState is an independent product — not affiliated with any corporation.
This Privacy Policy explains how we collect, use, disclose, and protect information when you use FlowState, including the web app, embed widget, public profile pages (/u/:slug), the launch page, and all associated API endpoints.
2. What We Collect
2.1 Information You Provide Directly
- Account information: When you sign in with Google OAuth, we receive your email address, display name, and profile picture URL from Google.
- Onboarding preferences: Focus duration, timezone, working hours, and productivity goals you enter during onboarding.
- Session data: Focus session duration, output type (code, writing, design, etc.), notes, FlowScore, and streak data you log manually or through the timer.
- Tasks & deadlines: Task titles, statuses, tags, owners, deadlines, and progress percentages you create in the Kanban board or Smart Deadlines panel.
- Team standup updates: Your standup text when you post updates in the Team Hub.
- Profile information: Your public FlowState slug, bio, and display preferences for your public profile page (
/u/:slug).
- Referral codes: Referral codes you generate or claim.
- AI chat messages: Prompts and conversation history you send to the AI chat, AI Flow Coach, ClawBot, or other AI assistants.
- Generated content: Images, videos, audio, or text generated using AI tools, stored in Cloudflare R2 if you choose to save outputs.
- Music playlist settings: YouTube playlist URLs you save for Pomodoro focus music.
- Uploaded files: Files you upload using the file-conversion tools (PDF, images, SVG, PPTX, TXT, CSV). These are processed in-memory and not permanently stored unless you explicitly save them to R2.
2.2 Information Collected Automatically
- Session cookies: An
fs_session HTTP-only cookie containing your encoded session (email, name, avatar, tier, Google access token) — set for 7 days after login.
- Integration tokens: OAuth access tokens for Google Calendar (
fs_session), Notion (fs_notion), and Slack (fs_slack), stored as HTTP-only cookies.
- IP address: Used transiently for rate limiting and abuse prevention via Upstash Redis. Not stored permanently.
- Usage metadata: Daily AI token usage counts (keyed by email), velocity (requests per minute window), and tier information — stored in Redis and automatically expired.
- Cloudflare headers: Standard Cloudflare edge headers such as
CF-Connecting-IP and geolocation data are processed at the edge for abuse prevention and are not logged.
2.3 Information from Third-Party Integrations (Optional)
You may optionally connect the following third-party services. We only request the minimum permissions needed:
- Google Calendar: Read and create calendar events to enable focus-block scheduling. We store your Google OAuth token in the session cookie (never in a database).
- Notion: Read databases and pages you authorize, and create pages when you use the Notion sync feature. Token stored in
fs_notion cookie.
- Slack: Send messages to channels you authorize. Token stored in
fs_slack cookie.
- DistroKid / UnitedMasters / SubmitHub: Music distribution integrations for the CLAW Release Manager feature — OAuth tokens used only for the duration of the distribution workflow.
- 264Pro: If you connect your 264Pro account, we sync project data and activity logs. Token stored for the session.
3. How We Use Your Data
- Providing the service: Running your timer, tracking sessions, computing FlowScore, managing tasks, and serving your public profile.
- AI personalization: Your session history, output types, focus patterns, and streak data are used to generate personalized AI Flow Coach insights, behavioral pattern analysis, smart focus-time suggestions, and weekly digests.
- Billing & subscriptions: Your email is passed to Stripe to manage subscriptions and token top-ups. We store a
stripe_customer:{email} reference in Redis to link your Stripe account.
- Rate limiting & abuse prevention: IP addresses and email-based keys in Redis to enforce daily AI token limits, velocity checks, and anti-abuse rules.
- Email communications: Streak reminder emails and weekly digest emails sent via Resend, using your email address from your session. You can opt out by unsubscribing from any email or by not enabling the feature.
- Team features: When you join a team workspace, your display name, avatar, FlowScore, and session stats are visible to team members on the leaderboard and team hub.
- Accountability pairing: Your email and session stats are temporarily shared with your paired partner during active pairing sessions.
- Public FlowScore widget: If you use the embed widget or public profile, your FlowScore, streak, and session count are publicly visible at
/u/:slug.
- Product improvement: Aggregate, anonymized patterns (not tied to individual users) may inform product decisions.
4. AI Features & Your Data
FlowState routes your AI requests to multiple large language model providers depending on the nature of the task:
- OpenAI (GPT-4o, GPT-4o mini, DALL-E 3) — creative tasks, general chat, image generation
- Anthropic (Claude Sonnet, Claude Haiku) — code tasks, technical writing
- Google AI (Gemini models) — quick queries, multimodal tasks
- OpenRouter — aggregates multiple models including xAI Grok, Mistral, DeepSeek
- Replicate / fal.ai / Higgsfield AI — AI image and video generation
- ElevenLabs — AI text-to-speech
- Suno / MusicGen / Udio — AI music generation
- ACRCloud / Moises / Dolby — audio analysis and enhancement
When you use an AI feature, your prompt and relevant context (session stats, behavioral data you've consented to share) are sent to the relevant provider. Each provider has their own privacy policy and data-handling practices. We do not share your account email or personally identifiable information with AI providers — only the content of your prompts and relevant anonymized context.
Important: Do not include sensitive personal information (passwords, payment card numbers, government IDs, medical information) in AI chat messages or prompts. FlowState does not scrub prompt content before forwarding to AI providers.
AI-generated outputs (images, videos, audio) are stored in Cloudflare R2 under your account and are accessible via your private R2 key path. They are not publicly accessible unless you explicitly share them.
5. Third-Party Services
FlowState integrates with the following third-party services. Each has its own privacy policy:
6. Data Storage & Security
6.1 Where Data Lives
- Cloudflare D1 (SQLite): Permanent relational data — user accounts, subscription records, billing transactions, session history, tasks, and referral codes.
- Upstash Redis: Ephemeral operational data — AI token usage (daily, auto-expiring), tier assignments, rate-limit counters, session-share cards, pairing queue state. Data in Redis is keyed by email or IP and expires automatically.
- Cloudflare R2: Files you upload or generate — AI image/video/audio outputs, cover art, and file-conversion results you choose to save.
- Browser (localStorage): Timer state, task data (if not synced to D1), playlist settings, UI preferences, onboarding completion flags, and standup drafts are stored locally in your browser. This data never leaves your device unless you're signed in and use a sync feature.
- HTTP-only cookies: Session tokens, OAuth tokens for integrations. Not accessible to JavaScript.
6.2 Security Measures
- All traffic is served over HTTPS via Cloudflare's global edge network.
- Session cookies are marked
HttpOnly, Secure, and SameSite=Lax (or None for cross-domain integrations).
- AI token rate-limiting and velocity checks prevent abuse.
- Stripe webhook verification using
STRIPE_WEBHOOK_SECRET protects billing events.
- OAuth
state parameter validation on all OAuth flows prevents CSRF attacks.
- Input sanitization and XSS escaping on all user-generated content rendered in the UI.
No method of transmission over the internet is 100% secure. We take commercially reasonable steps to protect your information but cannot guarantee absolute security.
7. Cookies & Local Storage
We use the following browser storage mechanisms:
- fs_session (cookie, 7 days): Your login session — email, name, avatar, tier, Google token.
- fs_notion (cookie, 30 days): Your Notion OAuth token, if connected.
- fs_slack (cookie, 30 days): Your Slack OAuth token, if connected.
- fs_onboarded (cookie, 365 days): Records that you've completed onboarding.
- oauth_state (cookie, 10 min): CSRF state token for in-progress OAuth flows.
- localStorage (browser): Timer state (
fs_state), tasks, playlist config, pomodoro settings, volume preferences, onboarding flags, standup entries, deadline data, and YouTube playlist items. This is cleared when you clear browser data.
We do not use third-party advertising cookies or tracking pixels. We do not use Google Analytics or similar analytics services.
8. Your Rights
Regardless of your location, you have the following rights with respect to your data:
- Access: Request a copy of the data we hold about you.
- Correction: Ask us to correct inaccurate data.
- Deletion: Request deletion of your account and all associated data. Deleting your account will remove your D1 records, R2 files, and Redis keys. Data in Stripe will be subject to Stripe's retention policy.
- Portability: Request an export of your session history and task data.
- Opt-out: Opt out of streak reminder emails and weekly digest emails at any time via the unsubscribe link or by contacting us.
- Revoke integrations: Disconnect Google, Notion, or Slack at any time via Settings. This deletes the stored token cookie.
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
EU/EEA residents (GDPR): You have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local supervisory authority. Our lawful basis for processing personal data is primarily "performance of a contract" (providing the service you signed up for) and "legitimate interests" (security and abuse prevention).
California residents (CCPA/CPRA): We do not sell personal information. You have the right to know, delete, and opt-out of the sharing of personal information. FlowState qualifies as a small business under CCPA thresholds, but we honor these rights regardless.
9. Children's Privacy
FlowState is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at [email protected] and we will delete it promptly.
10. International Users
FlowState is operated from the United States. If you access FlowState from outside the United States, your information may be transferred to and processed in the United States and other countries where our service providers operate (including Cloudflare's global edge network). By using FlowState, you consent to this transfer.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date and, where appropriate, by sending an email to your registered address or displaying a notice in the app. Continued use of FlowState after changes are posted constitutes acceptance of the updated policy.
12. Contact Us
By using FlowState, you agree to these terms. If you don't agree, please don't use the service. These terms apply to all users including free, Pro, and Team plan subscribers, as well as users of the embed widget and public APIs.
1. Acceptance of Terms
These Terms of Use ("Terms") constitute a legally binding agreement between you ("User," "you") and FlowState ("we," "us," "our") governing your access to and use of the FlowState platform, including the web application at flowst8.cc, all associated APIs, the embed widget (/widget.js), public profile pages, the launch page, and any related services (collectively, the "Service").
By creating an account, signing in, or using any part of the Service, you confirm that (a) you are at least 13 years old; (b) you have the legal capacity to enter into this agreement; and (c) you agree to be bound by these Terms and our Privacy Policy.
2. Description of Service
FlowState is an AI-native productivity and creative intelligence platform. The Service includes, but is not limited to:
- Pomodoro Focus Timer — customizable focus/break timer with FlowScore tracking, streak system, and session history.
- AI Chat Assistant — multi-model AI chat routed to OpenAI, Anthropic, Google, and other providers based on task type.
- AI Flow Coach — personalized behavioral pattern analysis and productivity insights derived from your session history.
- Smart Deadlines (Pro) — deadline tracking with AI risk analysis, progress bars, and team assignment.
- Team Hub — standup updates, leaderboard, sprint health monitoring, and accountability pairing.
- Accountability Pairing — real-time focus pairing with another FlowState user.
- Kanban Board — task management with drag-and-drop, tags, and D1 sync for Pro users.
- Google Calendar Integration — read and create focus blocks in your calendar.
- Notion & Slack Integration — sync tasks and send standup updates to Notion and Slack.
- Generate Tab — AI image, video, and audio generation using Replicate, fal.ai, Higgsfield AI, ElevenLabs, and music AI models.
- FlowState Audio (FSAudio) — AI music production tools including arrangement suggestions, track generation, and audio analysis.
- CLAW Release Manager — music release pipeline including cover art generation, pitch drafting, metadata management, and distribution prep for DistroKid and UnitedMasters.
- ClawBot — AI creative assistant specialized for music and content creators.
- 264Pro Integration — creative project sync, AI context memory, video generation, and diagnostic tools for 264Pro users.
- File Tools — browser-based file conversion (PDF↔Images, SVG→PNG, TXT→PDF, CSV→JSON, PPTX→PDF).
- Ambient Sound & Music Player — built-in ambient sounds (Web Audio API) and YouTube/Spotify playlist integration for focus sessions.
- Pomodoro Volume Slider — in-app music volume control for ambient and playlist audio.
- Public FlowScore Widget — embeddable widget and public profile page displaying your productivity stats.
- Weekly AI Digest — automated weekly email summarizing your focus patterns, sent via Resend.
- Token Top-Up — one-time purchase of additional AI token credits via Stripe.
- Referral Program — refer new users and earn token credits.
- Launch Page — public marketing and Product Hunt launch page.
3. Accounts & Authentication
FlowState currently supports sign-in via Google OAuth and Magic Link (email). By signing in with Google, you authorize FlowState to access your Google profile information (email, name, avatar) and, optionally, your Google Calendar.
- You are responsible for maintaining the security of your Google account and any sessions you initiate on FlowState.
- You must not share your session with others or use another person's account.
- You must not attempt to circumvent authentication, rate limits, or tier restrictions.
- We reserve the right to suspend or terminate accounts that violate these Terms.
- Your FlowState public slug (
/u/:slug) must not impersonate another person or organization.
4. Subscription Plans & Billing
4.1 Plans
FlowState offers the following plans (prices and features subject to change with notice):
- Free: Timer, basic AI chat, limited daily AI tokens (1,500/day), local Kanban, public FlowScore widget, ambient sounds.
- Pro ($18/month monthly, $14/month billed annually): All Free features, plus multi-LLM routing, Smart Deadlines, D1-synced tasks, all integrations, AI Flow Coach, CLAW Release Manager, FlowState Audio, full Generate tab, and 100,000 daily AI tokens.
- Team ($15/seat/month monthly, $12/seat/month billed annually): Pro features plus Team Hub, leaderboard, burnout risk monitoring, sprint health, shared standup, and 100,000 daily AI tokens per seat.
- Enterprise (contact us): Custom pricing, dedicated support, white-label options, SSO, and volume token pricing. Contact [email protected].
4.2 Billing
- Subscriptions are billed via Stripe. By subscribing, you agree to Stripe's Terms of Service.
- Subscriptions auto-renew at the end of each billing cycle. You can cancel anytime via the billing portal (accessible from Settings).
- Annual subscriptions are non-refundable after 14 days from the initial purchase date.
- Monthly subscriptions may be cancelled at any time; your access continues until the end of the current billing period.
- We reserve the right to change pricing with 30 days' notice. Existing subscribers will be notified by email before any price change takes effect.
4.3 Token Top-Ups
- You may purchase additional AI token credits as a one-time purchase (not a subscription) in packs of 50k tokens ($5), 200k tokens ($15), or 500k tokens ($30).
- Purchased tokens are non-refundable once credited to your account.
- Purchased tokens do not expire and are consumed after your daily token budget is depleted.
- Token credits are tied to your account and are not transferable.
4.4 Free Trial & Demo Mode
FlowState may be used without an account in demo mode with limited functionality. Demo mode data is stored locally and is not backed up. Creating an account activates full free-tier features.
5. AI Features & Token Credits
AI features on FlowState consume token credits from your daily budget. Token consumption is measured in approximate LLM input/output tokens.
- Daily budgets reset at midnight UTC.
- Free users receive 1,500 tokens/day. Pro and Team users receive 100,000 tokens/day.
- When your daily budget is depleted, AI features will return a rate-limit response until reset or until you use purchased tokens.
- We do not guarantee that AI outputs will be accurate, appropriate, or free from errors. AI models may produce incorrect, biased, or unexpected responses.
- You are responsible for reviewing AI-generated content before acting on it, publishing it, or distributing it.
- AI image, video, and audio generation features are subject to additional content policies imposed by the underlying model providers (Replicate, fal.ai, Higgsfield, ElevenLabs, etc.).
- The AI Flow Coach provides insights based on your personal usage patterns and is not a substitute for professional health, medical, or psychological advice.
6. Acceptable Use
You agree not to use FlowState to:
- Generate, distribute, or promote content that is illegal, harassing, defamatory, threatening, obscene, or violates any applicable law.
- Create content that infringes on third-party intellectual property rights, including copyrighted text, images, music, or code.
- Generate deepfakes, non-consensual intimate images, or any content that misrepresents real persons.
- Attempt to bypass token limits, rate limits, or tier restrictions through automated scripts, bots, or abuse of multiple accounts.
- Scrape, mirror, or reverse-engineer the FlowState application or APIs.
- Interfere with the security, integrity, or availability of the Service.
- Use the Service for any commercial purpose not expressly authorized, including reselling access to FlowState APIs.
- Upload malicious files, scripts, or content designed to harm other users or the Service infrastructure.
- Circumvent or attempt to disable any geographic restrictions or content filters.
- Use the CLAW Release Manager or distribution features to distribute content you do not have the rights to distribute.
We reserve the right to immediately suspend or terminate access for violation of these rules, without refund.
7. User Content & Intellectual Property
7.1 Your Content
You retain ownership of content you create, upload, or generate using FlowState, including AI-generated outputs where you provided the prompts. By using the Service, you grant FlowState a limited, non-exclusive, royalty-free license to store, process, and display your content solely for the purpose of providing the Service to you.
We do not claim ownership of your tasks, session notes, generated images, music, or other creative work.
7.2 AI-Generated Content Ownership
Ownership of AI-generated content is a complex and evolving legal area. FlowState makes no representations about the copyright status of AI-generated outputs. You are responsible for reviewing applicable laws in your jurisdiction before publishing, selling, or distributing AI-generated content.
7.3 FlowState Intellectual Property
All FlowState trademarks, logos, branding, application code, UI design, and proprietary algorithms (including the FlowScore formula, Intent Layer logic, and AI routing system) are the exclusive property of FlowState. You may not copy, reproduce, or create derivative works from these elements without prior written consent.
7.4 Feedback
If you submit feedback, feature requests, or bug reports, you grant us the right to use this feedback without compensation or attribution to improve the Service.
8. Third-Party Integrations
FlowState integrates with third-party services including Google, Notion, Slack, Stripe, DistroKid, UnitedMasters, SubmitHub, YouTube, Spotify, and various AI providers. Your use of these integrations is subject to the respective third-party terms of service.
- FlowState is not responsible for the availability, accuracy, or conduct of third-party services.
- Connecting a third-party integration grants FlowState limited access to that service on your behalf. You can revoke this access at any time via the Settings modal or directly through the third-party service's authorization settings.
- Using YouTube embedded players is subject to YouTube's Terms of Service and Google Privacy Policy.
- Music distribution via DistroKid or UnitedMasters through the CLAW Release Manager is subject to those platforms' own distribution agreements and content policies.
9. Availability & Modifications
FlowState is provided on an "as is" and "as available" basis. We strive for high availability but do not guarantee uninterrupted access. The Service may be temporarily unavailable due to:
- Scheduled maintenance (we will notify users in advance when possible).
- Cloudflare infrastructure events or outages.
- Third-party API provider outages.
- Security incidents requiring immediate response.
We reserve the right to modify, discontinue, or sunset any feature with or without notice. For paid features being removed, we will provide at least 30 days' notice and a pro-rated refund if applicable.
10. Disclaimers
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:
- THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT.
- WE DO NOT WARRANT THAT THE SERVICE WILL BE ERROR-FREE, UNINTERRUPTED, SECURE, OR FREE FROM VIRUSES OR OTHER HARMFUL COMPONENTS.
- AI-GENERATED CONTENT MAY BE INACCURATE, INCOMPLETE, OR OUTDATED. FLOWSTATE IS NOT RESPONSIBLE FOR DECISIONS MADE BASED ON AI OUTPUTS.
- THE AI FLOW COACH AND BEHAVIORAL INSIGHTS ARE FOR INFORMATIONAL PURPOSES ONLY AND DO NOT CONSTITUTE PROFESSIONAL ADVICE OF ANY KIND (MEDICAL, PSYCHOLOGICAL, LEGAL, FINANCIAL, ETC.).
- MUSIC DISTRIBUTION SERVICES ENABLED THROUGH THE CLAW RELEASE MANAGER ARE PROVIDED AS A CONVENIENCE. FLOWSTATE DOES NOT GUARANTEE ACCEPTANCE, DISTRIBUTION SUCCESS, OR PLACEMENT BY ANY DISTRIBUTION PARTNER.
11. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL FLOWSTATE, ITS OPERATORS, AFFILIATES, OR LICENSORS BE LIABLE FOR ANY:
- INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES;
- LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITIES;
- DAMAGES RESULTING FROM UNAUTHORIZED ACCESS TO OR ALTERATION OF YOUR DATA;
- DAMAGES RESULTING FROM THIRD-PARTY SERVICE OUTAGES OR FAILURES;
- DAMAGES RESULTING FROM AI-GENERATED CONTENT OR DECISIONS MADE BASED ON AI INSIGHTS.
IN ANY CASE, OUR TOTAL LIABILITY TO YOU FOR ALL CLAIMS ARISING FROM OR RELATED TO THE SERVICE SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL AMOUNT YOU PAID TO FLOWSTATE IN THE 12 MONTHS PRECEDING THE CLAIM, OR (B) $50 USD.
Some jurisdictions do not allow certain limitations of liability — in those cases, our liability is limited to the minimum extent permitted by law.
12. Indemnification
You agree to defend, indemnify, and hold harmless FlowState and its operators from and against any claims, damages, losses, and expenses (including reasonable legal fees) arising from or related to: (a) your use of the Service; (b) your violation of these Terms; (c) content you submit, generate, or distribute using the Service; (d) your violation of any third party's rights; or (e) your use of any third-party integration in violation of that party's terms.
13. Termination
You may terminate your account at any time by contacting us at [email protected]. Upon termination, your data will be deleted in accordance with our Privacy Policy (typically within 30 days, subject to legal retention requirements).
We may terminate or suspend your access immediately, without prior notice or liability, if you breach these Terms or engage in conduct we determine to be harmful to the Service, other users, or third parties. Upon termination by us for cause, you will not be entitled to a refund of any prepaid subscription fees.
14. Governing Law & Dispute Resolution
These Terms are governed by the laws of the State of Georgia, United States, without regard to its conflict of law provisions. Any disputes arising from these Terms or the Service shall be resolved first through informal negotiation. If informal resolution fails, disputes shall be submitted to binding arbitration in accordance with the rules of the American Arbitration Association, conducted in English in Atlanta, Georgia.
Class action waiver: You agree that any arbitration or proceeding shall be limited to the dispute between us individually. You waive the right to participate in a class action lawsuit or class-wide arbitration.
Nothing in this section prevents either party from seeking emergency injunctive or other equitable relief from a court of competent jurisdiction.
15. Changes to These Terms
We reserve the right to modify these Terms at any time. We will provide notice of material changes by updating the "Last updated" date above and, where appropriate, by sending an email to your registered address or displaying a prominent in-app notice at least 14 days before the change takes effect. Your continued use of the Service after the effective date of the revised Terms constitutes your acceptance of the changes.
16. Contact