Privacy Policy

01Introduction

Flowroid (“we”, “our”, or “the app”) is an Android automation platform. This Privacy Policy explains what data Flowroid accesses, how it is used, where it is stored, and your rights with respect to that data.

Core principle: your automation content stays on your device. Flows, variables, execution history and crash reports are never uploaded, and we have no ability to read them. The permissions the app requests are used solely to power automations you configure.

Flowroid contacts a server of ours for two things, and this policy is precise about the difference between them.

• The licence check — to confirm whether this install is in its trial or carries an active entitlement. It carries a one-way hash, no personal data, no automation content, and never your raw device identifier. Section 6 sets out exactly what is sent and why.
• The AI assistant — if you choose to use it, what you type is sent to our AI proxy and on to Google’s Gemini API to be answered. This is real content leaving your device, and Section 7 states plainly what is sent, where it goes, and what happens to it.

Your automations do not depend on either one: flows, triggers and actions run entirely on the device, with no connection at all, and a user who never opens the assistant transmits no content.

02Data Controller

Flowroid is published by an individual developer, not a registered company, based in the Arab Republic of Egypt. For the records described in Section 5, and for the assistant content described in Section 7, that developer is the data controller within the meaning of the General Data Protection Regulation (GDPR). Google acts as our processor in both cases.

• Contact e-mail: support@flowroid.com
• Data deletion requests: flowroid.com/data-deletion

We do not have a data protection officer, and we are not required to appoint one: the server-side records are limited to the fields listed in Section 5, assistant content is not retained at all, and neither is used for profiling or monitoring.

03Permissions and Data We Access

The following table lists every Android permission Flowroid may request, why it is needed, and where the resulting data goes. Each On device? answer describes only what that permission does — none of them covers the AI assistant, whose own data flow is set out in Section 7.

04Background Location

Background location is used exclusively to evaluate geofence boundary crossings via the Google Play Services Geofencing API. Flowroid does not log, store, or upload your GPS coordinates. Location data is processed entirely on-device by Google Play Services; Flowroid only receives a binary “entered” or “exited” event per geofence.

If you do not create any geofence triggers, you can decline this permission and the rest of the app will work normally.

05Data Storage

Local database

All flows, variables, execution history, and app settings are stored in a Room (SQLite) database on your device’s internal storage. This data never leaves the device except when you use the export feature or configure an HTTP Request action to send it.

Secret variables

Variables you mark as “Secret” (e.g., API keys, passwords) are encrypted at rest using the Android Keystore (AES-256). Secret values are never displayed in logs or the execution history UI.

Crash reports

If Flowroid crashes, a local crash report is saved to files/crashes/ on your device. These reports contain the stack trace, app version, Android OS version, and device manufacturer/model. They do not contain notification content, location data, contact data, or any other personal information. Reports are capped at 10 files (oldest deleted automatically). Crash reports are never uploaded; you can view or delete them from the app’s log viewer.

Flow execution logs

When a flow runs, Flowroid writes a log entry that includes the flow name, trigger type, action results, and any error messages. Notification titles and bodies are deliberately excluded from log entries. Logs are stored locally and you can clear them at any time in Settings → Logs.

What we store on our servers

The table below is the complete list of what our server holds. None of these records contains your name, e-mail address, automation content, or any raw device identifier: the hashes below are computed on your device before anything is sent. Two of them exist only because Flowroid Pro includes an AI allowance — they count what you have spent, never what you said (Section 7).

Our server also keeps a single fleet-wide daily counter of AI spend, which exists to cap our own costs. It holds a date and a number, and no identifier of any kind — yours or anyone else’s.

These records are stored on Google Cloud infrastructure in the europe-west1 region (Belgium). See Section 10 for the processors involved and Section 13 for how to have them deleted.

06Licence and Subscription Verification

Flowroid is a paid app with a 14-day trial. The trial, a Flowroid Pro subscription, and a legacy one-time unlock bought before Flowroid moved to a subscription are all verified with a licence server we operate. This section describes that exchange in full.

What the app sends

• A device key. Your device’s ANDROID_ID combined with a secret salt and hashed with SHA-256 on your device. Only the resulting hash is transmitted. The hash cannot be reversed, and the raw ANDROID_ID never leaves your phone.
• A hashed purchase token, once you subscribe or buy a credit pack, so that Google Play’s record of the purchase can be matched to your entitlement without us storing the token itself.
• A Google Play Integrity verdict, which tells us whether the request came from a genuine, unmodified copy of Flowroid. It describes the app and the device, not you.

What the app receives

A short-lived signed licence stating whether this install is in its trial or entitled, and — if you are entitled to the AI assistant — an anonymous metering id and your monthly credit allowance. The metering id is derived from your purchase record by hashing; it is what the AI usage meter and credit ledger in Section 5 are keyed by, and it identifies an entitlement, not a person.

What the app never sends

No flows, flow names, variables, secrets, execution logs, crash reports, notification content, location, contacts, or calendar data. The licence request has no field capable of carrying them.

Why we do it

• Entitlement. Your subscription — or a one-time unlock bought before 2026, which we honour permanently — must keep working across reinstalls and on any device signed into the same Google account. Verifying it against a record is what makes that possible.
• Metering the AI allowance. Cloud inference costs us money per request, so the credits included with a subscription are counted server-side against the metering id above. Only the amount is recorded, never the content.
• One trial per device. The trial needs no payment method, so nothing else stops it from being restarted indefinitely by reinstalling the app. The device record deliberately survives an uninstall, a clear-data, and Settings → Reset App Data. That persistence is the anti-abuse mechanism, and we would rather state it plainly than have you discover it.

If the server is unreachable

A successful check is recorded on your device as a signed licence. Flowroid keeps working on that licence until it expires, and renews it automatically once connectivity returns. Losing your connection does not lock the app.

Legal basis (GDPR Article 6)

07The AI Assistant

Flowroid includes an optional AI assistant: a chat surface where you describe what you want in plain language and it runs Flowroid’s own actions and your flows. It is the only part of Flowroid that sends your content off the device, so this section is deliberately specific.

What is sent, when you use it

When you send a message to the assistant, the following leaves your device over an encrypted, certificate-pinned connection:

• Your message — what you typed, or what your device’s speech recogniser turned your speech into.
• The conversation so far — the earlier messages in that session, because a reply that ignores them would be useless.
• The tool definitions — the list of Flowroid actions and flows the assistant is allowed to use, including your flow names, so it can pick the right one.
• Tool arguments and results — what it decided to run and what came back, so it can carry on from there.
• Your signed licence, carrying the anonymous metering id from Section 6. There is no account, no e-mail address and no name attached to the request.

Anything you put into a message is part of that message. If you paste a password, an address or someone else’s details into the assistant, they are sent with it — the same as with any chat assistant. Your secret variables are never included: the assistant cannot read them, and they are not sent.

Where it goes

Your message goes to Flowroid’s AI proxy, which we operate on Google Cloud in europe-west1 (Belgium), and from there to Google’s Gemini API, which generates the reply. The proxy exists so that the assistant works without you having to sign up with an AI provider, and so the included allowance can be metered.

What happens to it

• We do not store it. Your message and the reply pass through our proxy in memory for the length of the request and are never written to a database or a file.
• We do not log it. Our request logs record the method, route, status and latency of a call — never its body. There is no debugging log of prompts, and a test in our build fails if one is ever added.
• It is not used to train models. We do not train anything on it, and Flowroid uses Google’s paid Gemini API tier, whose terms state that Google does not use prompts or responses submitted through it to improve its products.
• Google logs it briefly for abuse detection. Under those same terms Google retains prompts and responses for a limited period, solely to detect and prevent abuse of its API. That is Google’s processing, on its own retention schedule, and we state it here rather than claim a zero-retention pipeline we do not control.
• What we do count is the cost. Every request adds a number to the AI usage meter in Section 5 — how many credits it consumed, against an anonymous metering id. That meter is how a monthly allowance can exist at all. It holds no content.

Running your own model instead

If you would rather nothing left your device, point Flowroid at a model you host yourself — Ollama, LM Studio, or any OpenAI-compatible server — under Settings → AI → Advanced. Requests then go to the address you entered and nowhere else: not to our proxy, not to Google, and they do not touch your allowance. Flowroid does not offer to send your content to a cloud AI provider under an API key of your own; that route was removed.

Speaking to it

The microphone is used only while you have the assistant open and have started it yourself — there is no wake word and no background listening. Flowroid never records or stores your audio. Speech is converted to text by your device’s recogniser, which on a device without an offline speech pack may be Android’s system provider (typically Google). The text is then treated exactly like a typed message.

What stays on the device

Two assistant features never involve a server at all: the learned shortcuts that let repeated commands run instantly, and the automation suggestions Flowroid draws from your own usage. Both are computed on the phone, are stored only there, and are never uploaded. Reports you file about a bad assistant reply are also stored on the device.

08Embedded HTTP Server

Flowroid includes an optional local HTTP server (off by default) that allows external systems to trigger flows via REST API. By default, the server binds to 127.0.0.1 (loopback only) and is not reachable from other devices on the network. An explicit “Enable LAN access” setting expands the bind address to 0.0.0.0.

When the server is enabled, any HTTP requests received are processed locally. You are responsible for securing access (API key, network configuration). We recommend not enabling LAN access on untrusted networks.

09User-Configured HTTP Requests

The HTTP Request action lets you send data to any URL you configure. You are fully in control of what data is sent and to which endpoint. Flowroid does not inspect, log, or intercept the content of these requests beyond what is necessary to execute them. You are responsible for the privacy implications of the endpoints you call.

10Third-Party Services

Flowroid does not integrate any advertising SDKs, analytics SDKs, or external crash reporting services, and there are no tracking pixels. The app calls a server of ours for exactly two things: the licence check in Section 6, and — only if you use it — the AI assistant in Section 7.

That paragraph is about the app, which is what this table and everything above it describe. The website you are reading is a separate thing with separate answers, and it gets its own section rather than a footnote: Section 11.

11This Website

Everything above describes the Android app, which measures nothing. This website is the one part of Flowroid that does, and this section says exactly what — including how to switch it off, at the bottom.

What is counted

• Page views — the page’s address, the page that linked to it, and the campaign parameters on the link if it carried any. Every other query parameter is stripped in your browser before anything is sent.
• Your browser’s own headline facts — browser, operating system, device type, screen size, language, and the country your network resolves to. Not your IP address: it is used to work out the country and is never stored.
• A short list of interactions — which call to action was pressed, which help question was opened, which table-of-contents entry was followed, how far down a page was read, and which address produced a 404.

What is not

No cookies are set and no identifier is stored in your browser. A visit is recognised only by a one-way hash of your network address and browser, salted with a value that is rotated daily — which means the same person on the same browser is not recognisable across days and is never recognisable across sites. There is no advertising network, no data broker, no cross-site profile, and nothing is sold or shared.

Nothing you type is measured. The support composer and the deletion request on this site assemble a draft in your browser and send nothing anywhere; what is counted is that a draft was opened and which topic it used, never a word of what it says.

Where it goes

To https://umami.pharadev.com/api/send, our account with Umami — an open-source, cookieless analytics engine, hosted here by its maker, which processes these events on our instructions as our processor and for no purpose of its own.

The rows are kept while the site is measured. There is no request to make about them and none we could act on: they carry no name, no address, no account and no identifier of yours, so there is nothing in them to look up, export or erase. The deletion route in Section 13 is about the app’s licence records, which are a different thing entirely.

Turning it off

Three ways, any of which is enough. Your browser’s Do Not Track setting and the Global Privacy Control signal are both honoured, and neither needs anything from us. Or switch it off for this browser here — the setting is kept in this browser only, so it does not follow you to another one:

A content blocker also works, and nothing on this site breaks when the tracker is blocked: it is loaded after the page is usable and nothing waits on it.

12Data Sharing and Disclosure

We do not sell, rent, or share your personal data with third parties, except:

• Google Play Billing — subscription and top-up transactions are handled by Google. We receive a purchase token and the purchase state, not your payment details.
• Google (Gemini API) — if you use the AI assistant, your message and its conversation context are shared with Google as our sub-processor, for the sole purpose of generating that reply. Nothing is shared if you do not use the assistant. See Section 7.
• Our hosting provider — the records in Section 5 are stored on Google Cloud infrastructure in europe-west1 (Belgium) under a data-processing agreement. Google processes them on our instructions only.
• Our website analytics provider — the anonymous page counts described in Section 11 are processed on our instructions by the host of our Umami instance. They concern this website, not the app, and contain no identifier of yours.
• Legal obligations — if required by law, court order, or to protect the safety of any person.
• User-initiated HTTP requests — data you send via the HTTP Request action goes to the endpoints you configure. This is entirely under your control.

13Data Retention and Deletion

On your device

Everything Flowroid creates while automating (flows, variables, execution logs, crash reports) lives on your device, and you can delete it at any time:

• Flows and variables: delete individually within the app, or use Settings → Reset App Data to wipe everything.
• Execution logs: Settings → Logs → Clear Logs.
• Crash reports: Settings → Logs → Clear Crash Reports.
• All app data: uninstalling Flowroid removes every locally stored file from your device.

On our server

The retention period for each record is listed in Section 5: request logs are deleted after 30 days, a purchase record 90 days after the entitlement stops being active, the AI usage meter after 12 months, and the device record is kept for the life of the product unless you ask us to delete it. Your credit ledger is kept while you still have credits to spend, because purchased credits do not expire.

Nothing you asked the assistant is retained by us at any point (Section 7), so there is no conversation history on our side to delete or export.

To have your device, purchase and AI records deleted, follow the request route at flowroid.com/data-deletion. It explains what is removed, what to include so we can find your record, and the two consequences worth knowing in advance: deletion resets the trial for that device, and a subscription or legacy unlock has to be re-linked with Restore purchase. We cannot delete your Google Play order record; that is Google’s, and you can manage it in your Google account.

14Security

We apply the following security measures to protect your data:

• Secret variables are encrypted using AES-256 via the Android Keystore. If Keystore initialisation fails, the app refuses to store secrets rather than falling back to plaintext.
• All traffic between the app and our server — licence checks and assistant requests alike — is encrypted in transit with TLS 1.2 or higher, against a certificate pinned in the app.
• The records in Section 5 are encrypted at rest. Assistant content is never at rest on our side to begin with.
• The licence database has no public IP address. It is reachable only from the licence service over a private network path, never from the open internet.
• The API server requires an API key by default.
• The HTTP Request action maintains a blocklist against Server-Side Request Forgery (SSRF) attacks targeting loopback, link-local, and RFC 1918 private addresses.
• Boot receivers and background services are not exported and cannot be invoked by third-party apps.

15Children's Privacy

Flowroid is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data through the app, please contact us at the address below so we can take appropriate action.

16Your Rights

There are two sets of data and two routes to them.

Data on your device

You hold this outright. No request to us is needed, and none is possible: we cannot reach it.

• Access — view all flows, variables, and logs within the app.
• Correction — edit or delete any flow or variable at any time.
• Deletion — Settings → Reset App Data, or uninstall the app.
• Portability — export your flows as JSON files via the import/export feature.

The records on our server

For the records in Section 5 you have the rights of access, rectification, erasure, restriction of processing, objection, and data portability under the GDPR, and comparable rights under other applicable privacy laws. There is no assistant history among them: we keep none.

Erasing your device record resets the 14-day trial for that device, and erasing your purchase record detaches your subscription or legacy unlock from it — along with the AI meter and credit balance keyed to it. If you have paid for Flowroid and then ask us to erase these records, use Restore purchase afterwards: your entitlement lives with your Google account, not with the record we deleted.

You may object at any time to the processing we carry out on the basis of legitimate interests (Section 6). If you believe we have handled your data unlawfully, you can also complain to your national data protection supervisory authority.

Your Google Play order record is held by Google as its own controller. To exercise rights over it, contact Google directly.

17Changes to This Policy

We may update this Privacy Policy when the app’s data practices change. We will update the “Last updated” date at the top of this page. For significant changes, we will provide notice within the app. Your continued use of Flowroid after an update constitutes acceptance of the revised policy.

18Contact

For privacy-related questions or requests, please contact:

• E-mail: support@flowroid.com

Back to top