Privacy Policy

Last updated: July 6, 2026

Overview

FlowRead is a knowledge capture and organization tool. We take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal information.

1. Information We Collect

1.1 Information You Provide

• Account information: Email address and password you provide during registration. Passwords are hashed with bcrypt — we cannot read your plaintext password.
• Captured content: Text, page clips, images, links, and voice transcriptions you submit via the extension or input bar. This content belongs to you.
• Payment information: If you subscribe to Pro, payment is handled securely by Stripe. We never store your credit card number or payment credentials.

1.2 Automatically Collected Information

• Preferences: Your language and theme settings are stored locally in your browser (localStorage) and never uploaded to the server.
• JWT token: An authentication token generated after login, stored in the browser (chrome.storage) to identify your session.

1.3 Information We Do NOT Collect

• Browsing history
• Bookmarks or favorites
• Personal identification (name, address, phone number, etc.)
• Device identifiers
• Location data
• Analytics or tracking data (no Google Analytics, no Facebook Pixel, no third-party tracking scripts)

2. Data Storage & Security

• Storage location: All captured content is stored on the server you deploy and control. FlowRead does not provide cloud hosting — we cannot access your data.
• Data transmission: All API requests are encrypted via HTTPS.
• Password security: Passwords are salted and hashed using bcrypt, meeting industry security standards.
• Authentication security: HMAC-SHA256 JWT tokens with 30-day validity.

3. Third-Party Services

FlowRead uses the following third-party services, which only process your data when you actively use the corresponding feature:

• AI providers (DeepSeek / OpenAI / Gemini / MiniMax) — Captured content is sent to your configured AI provider for classification, tagging, and summarization. You choose which provider to use (or none at all) in your server configuration.
• Alibaba Bailian ASR — Speech-to-text uses Alibaba Cloud's ASR service. Audio files are sent to Alibaba Cloud for processing.
• Stripe — Payment processing is handled by Stripe. We never access your payment card information.

We do not sell, rent, or share your data with any third party for commercial purposes.

4. Data Retention

• Captured content: Your content is stored permanently on your server until you manually delete it.
• Account: You can delete your account at any time by removing your user record from data/users.json on the server. Captured content remains on disk and can be cleaned up manually.
• Logs: The server outputs standard runtime logs without recording your captured content details.

5. Your Rights

You have full control over your data:

• Access: View all your captured content anytime through the browser extension.
• Modify: Edit titles, body text, folder classification, and tags of any captured content.
• Delete: Remove any captured content from your server.
• Export: Export Markdown study reports with all content and AI analysis via the extension.
• Full control: Since FlowRead is self-hosted, all your data physically resides on your own server with direct filesystem access.

6. Self-Hosting

FlowRead uses a self-hosted architecture. You deploy and maintain your own server instance, keeping all data under your control. This means:

• We cannot access, view, or recover your data
• You are solely responsible for data security and backups
• Your data never leaves your designated server
• Even if FlowRead stops operating, your data remains unaffected

7. Browser Extension Permissions

The FlowRead browser extension requires these permissions:

• activeTab — Reads the current tab's title and URL to record source information when you actively capture content.
• storage — Stores your auth token, preferences, and offline capture queue locally in the browser.
• <all_urls> (host permissions) — Injects the text-selection button and page-clip script into web pages, only active when you trigger a capture.

The extension never silently reads or uploads your browsing data in the background.

8. Children's Privacy

FlowRead is not directed at children under 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via in-app notice or website announcement. Changes take effect upon publication.

10. Contact Us

If you have any questions or suggestions about this Privacy Policy, please contact us:
Email: enoch.z1234567@gmail.com
Website: https://flowread.myhelp.vip