Privacy

What we collect

• Your account. Your email address. If you sign in with Google, Google tells us your email address and name — nothing else. We never post anything anywhere on your behalf.
• What you build. Your flows, projects, phase notes, and register entries. The database enforces that only your account can read them, so a bug in the app is not enough to expose them.
• Documents you upload. Kept in private storage. Links to them are signed and short-lived, and only your account can open them.
• Trial counting. So one visitor can't use up the shared AI allowance, we store a one-way hash of your IP address together with the date. The address itself is never written down and cannot be recovered from the hash.
• Visits. Only if you allow it: Google Analytics, which sets cookies. Vercel's visit counter runs either way — it sets no cookies and does not identify you.

What we send to the AI

When you ask for a draft, your description — and the text of a document, if you picked one — is sent to NVIDIA's hosted Nemotron models through the NVIDIA API catalog. Before anything leaves our server, we replace email addresses, web links, phone numbers, and long runs of digits with placeholders, then put the real values back in the reply. So those never reach the model.

Be aware of the limits of that. It is pattern matching: it does not recognise people's names or street addresses, so please leave those out of what you type. And a picture is sent as it is, because this method cannot find text inside an image — don't upload a photo or scan of something confidential.

Your content is not used to train any model.

Where it is kept

Your account, flows, projects, and documents live in a Supabase project hosted in Sydney, Australia. The site itself is served by Vercel. Both companies process this data on our behalf, and no one else receives it. We do not sell data, and there is no advertising on this site.

Cookies

Signing in sets a cookie that keeps you signed in — the site cannot work without it. Analytics cookies are only set after you choose Allow, and you can change your mind at any time:

Change my choice

Your choices

• Deleting a project, flow, or document in the app deletes it from the database — it is not kept in the background.
• To delete your whole account, including everything in it, email us and we will do it.
• You can export nothing automatically yet; ask us and we will send you your data.

This is an early product

BuildByFlow is a working prototype, offered free. The AI drafting runs on free shared capacity and is deliberately rate-limited. Features and this page will change; the date at the top tells you when it last did.

Contact

Questions, deletion requests, or anything else about your data: privacy@buildbyflow.com.