Privacy Policy

Brain-Based Workplace, LLC ("we," "us," or "our") operates Flow State (available at myflowstate.ai). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our service.

By using Flow State, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Account Information

When you create an account, we collect your email address and an encrypted password. If you sign up via a third-party provider, we receive the profile information that provider shares (such as your name and email).

Task and Productivity Data

Flow State stores the content you create within the app, including:

• Tasks, next actions, and their priorities
• Weekly priorities and progress tracking
• Projects and project information
• Context Library items and folders
• Notes and other user-generated content

AI Chat Messages

When you use the AI Coach, Plan My Week, Plan My Day, or other AI-powered features, we collect the messages you send and the responses generated. These messages are used to provide the service and to build your personal memory and pattern analysis (described below).

We may review AI chat conversations to evaluate the quality of AI responses and improve the service. This review is conducted by Flow State staff only and conversation content is never shared externally or used for advertising.

Memories and Patterns

Flow State analyzes your usage patterns to provide personalized coaching insights. This includes patterns about your work habits, preferences, and productivity trends. These memories are stored in your account and are only accessible to you.

Google Calendar Data

If you connect your Google Calendar, we access your calendar events (titles, times, and metadata) to provide scheduling features such as conflict detection and event management. We request read and write access to your calendar. You can disconnect your calendar at any time from the app settings.

LinkedIn Profile Data

During onboarding, you may optionally provide your LinkedIn profile URL. If you do, we retrieve publicly available profile information (such as your job title, company, and professional summary) to personalize your experience and provide relevant coaching context. This data is stored in your account profile.

Usage and Analytics Data

We collect anonymized usage data to improve the service, including page views, feature usage, and performance metrics. This data is collected via PostHog and does not include your task content or chat messages.

If you accept analytics cookies, we may also collect session recordings — anonymized replays of how you navigate the app, with text inputs masked by default — to identify usability issues and improve the experience.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve Flow State
• Power AI coaching features (weekly planning, daily planning, general chat)
• Build personalized memory and pattern insights for your account
• Sync with your Google Calendar for scheduling features
• Send service-related communications (e.g., password resets)
• Analyze aggregate usage trends to improve the product

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contractual necessity — processing your tasks, priorities, projects, AI coaching messages, and calendar data is necessary to provide the Flow State service you signed up for.
• Legitimate interest — we use anonymized analytics (via PostHog) to understand how the product is used and to improve it. You may opt out of analytics cookies at any time.
• Consent — optional features such as Google Calendar integration and LinkedIn profile import are only activated with your explicit consent. You may withdraw consent by disconnecting these integrations in your settings.

3. AI Processing

Flow State uses Anthropic's Claude API to power its AI features. When you interact with the AI Coach or other AI-powered features, your messages and relevant context are sent to Anthropic's servers for processing.

Important: Your data is not used by Anthropic to train their AI models. Anthropic processes your messages solely to generate responses for your session. Please refer to Anthropic's Privacy Policy for details on how they handle API data.

4. Data Storage and Security

Your data is stored in a PostgreSQL database managed by Supabase. All data is encrypted at rest and in transit (TLS). We use Row Level Security (RLS) policies to ensure that each user can only access their own data.

Google Calendar OAuth tokens are stored encrypted using AES-256 encryption. We never store your Google account password.

While we implement industry-standard security measures, no method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

5. International Data Transfers

Flow State is operated from the United States. If you are located outside the United States (including in the EEA, UK, or Switzerland), your personal data will be transferred to and processed in the United States by us and our service providers (Supabase, Anthropic, Vercel, PostHog, and Resend).

These transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) as adopted by the European Commission, which our service providers maintain as part of their data processing agreements. By using Flow State, you acknowledge that your data will be processed in the United States.

6. Data Sharing

We do not sell your personal data to third parties.

We share data only with the following service providers, solely to operate Flow State:

• Supabase — database hosting and authentication
• Anthropic — AI processing (Claude API)
• Vercel — application hosting
• Google — calendar integration (only if you connect your calendar)
• PostHog — anonymized product analytics
• Sentry — error monitoring and performance tracking
• Resend — transactional email delivery (welcome emails, notifications)

We may disclose your information if required by law, such as in response to a valid subpoena or court order.

7. Cookies

Flow State uses the following cookies:

• Authentication cookies (Supabase) — essential for keeping you logged in. These are strictly necessary and cannot be disabled.
• Analytics cookies (PostHog) — used to collect anonymized usage data to help us improve the product.

We do not use advertising or third-party tracking cookies.

8. Data Retention and Deletion

We retain your data for as long as your account is active. You may:

• Export your data — request a full export of your tasks, priorities, and other content in JSON or CSV format.
• Delete your account — request complete deletion of your account and all associated data. Upon deletion, your data will be permanently removed from our systems within 30 days.

You can export your data from Settings at any time. To delete your account, use the "Delete Account" option in Settings > Data, or contact us at jack@brainbasedworkplace.com.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request a portable copy of your data

To exercise any of these rights, please contact us using the information below.

10. Children's Privacy

Flow State is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: