Privacy Policy

1. Introduction

FlowGen ("we", "us") is an AI screen builder: you describe an interface, and we generate front-end screens and exportable code for it. This policy explains what personal data we collect when you use the Service, why we collect it, who processes it on our behalf, and what control you have over it. It covers our website and application, and applies alongside our Terms of Service.

We have written this to describe what the product actually does today, not what a generic policy template says. Where a protection is planned rather than in place, we say so.

2. Information We Collect

Account and billing information

• Account data. Sign-in is handled by Clerk. From it we store your email address and your Clerk user identifier in our own database. Passwords, one-time codes, and any social-login credentials are held by Clerk — we never see or store them.
• Billing data. Payments are handled by Stripe. We store your Stripe customer and subscription identifiers and your subscription status so we know which plan you are on. Card numbers and CVCs go directly to Stripe and are never stored by us. Stripe can include limited billing or contact details in signed billing events; we process those events to update your subscription but do not persist those details in our database.
• Plan usage counters. Your generation count for the current month, remaining credits, and the date the counter next resets.

The work you create

• Prompts. The text descriptions you submit to generate or edit a screen, and the screen code produced from them.
• Projects. Project names and descriptions, the canvas layout, generated screen code, any project-scoped components you create, and the thumbnail shown in your dashboard.
• Brand and import inputs. Logos and reference images you upload, website URLs you ask us to analyse, Figma file or node links you import, colors and fonts extracted from those sources, and theme selections. These inputs can be stored with your project and sent to the processors described below; a reference image is not automatically published or embedded as media in the generated screen.
• Published screens. If you publish to the public gallery, the screen title, its prompt, its code, and its thumbnail.

Connected developer accounts

If you use GitHub or Vercel export, we store the access token you supply so that exports work without reconnecting each time. These tokens are used for nothing except the export you ask for. See Section 13 for how they are handled, and how to disconnect and revoke them.

Technical and usage data

Standard information generated by using a web application: IP address, browser and device type, pages viewed, and the product actions described in Section 6. Our hosting provider processes request metadata, including IP addresses, in the ordinary course of serving the site.

3. How We Use Your Information

We use personal data to:

• Operate the Service — authenticate you, generate screens from your prompts, store and reload your projects, and export or publish them when you ask.
• Take payment, manage subscriptions, and enforce plan limits and rate limits.
• Diagnose failures and keep the Service reliable and secure, including detecting abuse of generation quotas.
• Understand which features are used, in aggregate, so we can improve the product.
• Respond to your support requests and, where necessary, comply with legal obligations.

Where the UK GDPR or EU GDPR applies, our legal bases are: performance of a contract (running the Service and billing you), legitimate interests (security, abuse prevention, product analytics, and error monitoring), consent where we ask for it, and legal obligation (for example, retaining transaction records).

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We do not use your prompts, designs, or generated code to train any AI model of our own — we do not train models.

4. AI Processing of Your Prompts and Assets

Generating a screen requires sending your input to third-party AI providers. When you generate or edit a screen:

• Your prompt, your selected theme, any brand assets or reference images, and the current screen code are sent to Google (Gemini models) and, if Google is unavailable, to OpenAI as a fallback.
• A search query derived from your prompt is turned into a numeric embedding by Google and matched against our component catalogue in Pinecone. The project-component upload API is disabled in the production Service. Historical project-component records are isolated by project identifier and are not available across projects.
• When the production stock-photography integration is enabled, image search terms derived from your prompt are sent to Unsplash. Selected photos are hotlinked from Unsplash, visibly credit the photographer and Unsplash, and trigger the provider's required final-selection notification. If that contract cannot be completed, the Service removes the stock-image reference while preserving the generated screen structure.
• If you explicitly describe an image you want, we first look for an approved existing asset or suitable stock image. Only when the optional AI-image fallback is enabled and those sources return no result is the image description sent to Pollinations.ai. That fallback may be disabled.

Third-party photography and other media remain subject to their source licenses. When a media provider requires attribution or usage reporting, the Service must preserve that provenance in the generated screen or decline to use that source; ownership of generated code does not transfer ownership of third-party media.

5. The Shared Image Library

The Service maintains a shared library of images previously produced by its optional AI-image fallback. When that fallback is enabled, you explicitly ask for a particular image, and no approved existing or stock asset matches, the generated image, its description, and a few keywords can be saved so it can be reused instead of regenerated. The fallback can be disabled, in which case a new AI-generated library entry is not created. The shared library is global: a pipeline-generated image used for your screen may be reused in another user's screen, and vice versa.

Pipeline-generated records created this way are not linked to your account — nothing in them says who created them. But they do store the image description you wrote, word for word, and we do not filter it, so anything identifying you put in that description is stored and may be matched and reused for another user's screen. Treat an explicit image request exactly like a prompt: describe the picture, not a real person or place you would not want recorded. Stock-image candidates evaluated by the Unsplash integration are not saved to this shared image library. When the production integration is enabled, only provenance for photos actually selected into a successful screen is retained with that screen.

Only images our own pipeline generates are shared this way. The account-scoped image-library API is disabled in the production Service. If an entry was previously added through that API — where the image address came from the request rather than from us — that entry is linked to the account that created it and is only ever used for that account's own screens, and it is deleted with that account. An image address someone else supplied is never used to build your screens.

6. Analytics and Error Monitoring

We use PostHog for product analytics and, where configured, Sentry for error monitoring. Specifically:

• After you choose Allow analytics, the browser records page views and a defined list of product events — for example that checkout was started, that a project was shared or published, or that an export was clicked — along with properties such as the theme used.
• After that choice, PostHog also captures browser interactions automatically (its "autocapture" feature), which is not limited to the list above. Visible text is masked and common text-bearing attributes are excluded before capture.
• Whether or not you allow optional browser analytics, our servers record a limited set of sanitised operational events needed to run and protect the Service — for example that generation succeeded or failed, its duration and estimated provider cost, checkout/webhook state, quota enforcement, and security or reliability failures. These events do not use PostHog browser cookies or storage.
• Analytics events are associated with your Clerk user identifier only. We deliberately do not send your name or email address to these tools.
• Unhandled errors in your browser and on our servers are captured so we can fix them.
• Session Replay is switched off. It would record the rendered page, and the rendered page here is your design work.
• Before any error report leaves our servers, it is passed through a filter that removes access tokens, API keys, session tokens, embedded image data, and other secrets — both by field name and by scanning the text of the report itself.

7. Cookies and Similar Technologies

We use cookies and browser storage for two purposes only:

• Strictly necessary. Clerk sets session cookies that keep you signed in. The Service cannot function without them.
• Optional browser analytics. PostHog browser capture and its analytics storage are off until you choose "Allow analytics." If allowed, PostHog uses browser storage to recognise a returning browser and group events into sessions, as described in Section 6. You can change that choice at any time with the persistent "Privacy choices" control.

We do not use advertising cookies, and we do not embed third-party advertising or social-media tracking pixels. Declining optional browser analytics does not affect the Service. Blocking or deleting strictly necessary Clerk storage will prevent you from signing in.

8. Share Links and the Public Gallery

Two features make your work visible to other people. Both are opt-in — nothing you create is public by default.

• Share links. Creating a share link produces an unguessable URL that renders your project's screens. It requires no sign-in: anyone who has the link can view those screens and receive the generated code, component files, styling, and media needed to render them. That can include brand styling or assets you placed in the shared screen. The share does not expose your email address, account credentials, billing details, or unrelated project settings. Revoking a share link immediately blocks the share page and prevents new private-media links from being issued. A private-media link already issued to a viewer can remain usable until its short expiry, which is no more than one hour.
• The public gallery. Publishing a screen to the gallery makes its title, its prompt text, its code, and its thumbnail publicly visible to anyone, signed in or not. Do not publish a screen whose prompt or content you would not want public. While private curated-media delivery is enabled, public gallery publishing is paused entirely because a client-created thumbnail cannot prove that it contains no licensed private pixels; use a private share link or export instead.

9. Service Providers

We do not sell or rent personal data. We share it with a small set of providers who process it on our behalf so the Service can run:

• Clerk — authentication and account management.
• Stripe — subscription payments and the billing portal.
• Vercel — application hosting and delivery.
• CodeSandbox — the isolated Sandpack preview runtime. It receives the generated preview files needed to render a screen. If private curated media is enabled, it also receives short-lived signed media URLs used by that preview.
• Neon — the managed Postgres database where your account, projects, and generations are stored.
• Google (Gemini) and OpenAI — the AI models that process your prompts, brand assets, and images.
• Pinecone — vector search over our component catalogue and your project-scoped reusable components during generation.
• Jina Reader and thum.io — when you request website analysis, the public URL you supply is sent to them to retrieve readable page content and a rendered screenshot. Do not submit a private or credential-bearing URL.
• Figma — when you choose Figma import, the file or node reference you supply is sent to Figma to retrieve its name and rendered image.
• Unsplash — optional intent-driven stock-photography search and hotlinked delivery. We send a prompt-derived search phrase; selected screens retain linked photographer/source attribution and perform the provider's required selection notification. Customer export remains separately gated.
• Pollinations.ai — optional fallback AI image generation for an explicit image request when approved existing and stock sources return no result. This integration may be disabled.
• Upstash — Redis used to enforce per-user rate limits, auxiliary-tool allowances, and the fleet-wide monthly generation-spend circuit breaker. The fleet meter stores aggregate exposure and a one-way hash of each generation request identifier, not prompts or generated code.
• PostHog and Sentry — product analytics and error monitoring, as described in Section 6.
• GitHub and Vercel — only when you choose to export a project to them, using the token you connected.

We may also disclose data where we are legally required to, or to protect our rights, safety, or property. If FlowGen is acquired or merged, personal data may transfer as part of that transaction; we will tell you before your data becomes subject to a different privacy policy.

10. Data Retention

• Account data, projects, prompts, and generated code are kept for as long as your account is open, so that your work is there when you come back.
• Deleting a project removes its screens and generated code from our active database. Deleting your account permanently deletes your account record, your projects, your generation history, and your published screens from that database — see Section 11 before you do it. We also send Pinecone a deletion request scoped to each affected project for any historical project-component vectors. Because Pinecone is an external processor, a temporarily unavailable deletion request can leave those project-isolated records there until processor or operator cleanup; the Service reports that failure, and the records are not available to another project.
• Pipeline-created records in the shared image library (Section 5) are not tied to your account and are retained as part of the library. Historical account-scoped API entries are deleted when that account is deleted.
• Billing and transaction records are retained by Stripe and by us for as long as tax and accounting law requires.
• Analytics and error data are retained according to the retention settings of PostHog and Sentry.

11. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; and to withdraw consent. If you are in California, you may also request disclosure of the categories of personal information we collect and ask us not to sell or share it — we do not sell or share it.

You can update your email address and sign-in details from your account, and delete individual projects from your dashboard.

12. International Transfers

We and our providers are primarily based in the United States, and your data is processed there. If you access the Service from outside the United States, you are transferring data to a country whose data protection laws may differ from your own. Where transfers of data from the UK, EEA, or Switzerland are involved, our providers rely on Standard Contractual Clauses or an equivalent approved transfer mechanism.

13. Security

• All traffic to and from the Service is encrypted in transit over HTTPS, and the site is served with HTTP Strict Transport Security so browsers refuse to connect over plain HTTP.
• Card details never touch our servers — Stripe collects and stores them. Sign-in credentials never touch our servers — Clerk holds them.
• Projects, prompts, and generated screens are readable only by the account that owns them; the only exceptions are the share links and gallery publishing you choose to create (Section 8).
• Access tokens you connect for GitHub or Vercel export are stored in our database, encrypted at rest, and used solely to perform the export you request. They are never returned to the browser and are stripped out of error reports. You can disconnect either one at any time from the export dialog, which deletes our stored copy immediately; deleting your account removes it along with the rest of your record. Disconnecting does not revoke the token at GitHub or Vercel — we cannot do that on your behalf — so also revoke it in your GitHub or Vercel account settings if you want it to stop working everywhere.

No system is perfectly secure, and we cannot guarantee absolute security. If you believe you have found a vulnerability, please contact us at support@flowgen.design rather than disclosing it publicly.

14. Children

The Service is not directed to children. You must be at least 13 years old to use it, and at least 16 if you are in the EEA or the UK. We do not knowingly collect personal data from children below those ages; if you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to This Policy

We may update this policy as the product changes. When we do, we will update the "Last updated" date above, and for material changes we will notify you through the Service or by email before they take effect.

16. Contact Us

Questions about this policy, or want to exercise any of the rights above? Email us at support@flowgen.design.