Flow Notes

Privacy Policy

Last updated: 10 September 2026

Flow Notes is a Chrome extension that saves passages you highlight while reading into notes you own. This policy describes exactly what is collected, what is not, and who it reaches.

The short version. Your highlighted text, the pages you read, and the contents of your notes are never stored on our server. They live only in your own Google Doc, Apple note or Markdown file. Our server keeps a small index — which notes exist, what they are called, and where their content lives — and nothing else.

What we store

Our server keeps one record per note, containing only:

Your Google account identifier (the sub value — a pseudonymous id, not your email or name)
The note's title, as you typed it
Which storage target it uses (Google Drive, Apple Notes, or a local file)
A reference to where its content lives: a Google Doc id, an Apple Notes id, or a file path on your machine
When it was created and last updated

What we do not store

The text you highlight. It goes straight into your note and is never written to our database.
The URLs of pages you read. Source links are written into your note, not kept by us.
The contents of your notes.
Your name, email address, or profile picture.
Browsing history, analytics, or tracking of any kind. There are no third-party analytics or advertising services in this extension.

What passes through without being kept

Organising a note

When you choose Organise or Summarise, that note's current content is read, sent to an AI model provider (Groq) to be rewritten, and the result is written back into your note. The content passes through our server in the process and is not retained afterwards.

This only ever happens when you explicitly press one of those buttons. No note content is sent anywhere when you capture a highlight.

You may supply your own Groq API key in the extension's settings. If you do, it is stored in your browser profile, sent with organise requests, used for that request, and never stored or logged by us.

Signing in

Your Google access token is verified with Google and held in memory for at most five minutes so that repeated requests do not need re-checking. It is never written to disk or to a database.

Google user data

Flow Notes requests two OAuth scopes and no others:

openid — to identify your account, so your notes are yours and not someone else's.
https://www.googleapis.com/auth/drive.file — access limited to files this app itself created. Flow Notes cannot see the rest of your Google Drive, and does not ask to.

Flow Notes' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through Google APIs is used only to provide the features described here, is not transferred to others except as required to provide those features, is not used for advertising, and is not read by any human except with your explicit permission or where required by law.

Data stored on your own device

Extension settings — whether capture is paused, and your own AI key if you set one. Stored via Chrome's storage, which Google syncs to your Chrome profile. It is never sent to us except as described above.
The local helper — if you use Apple Notes or local file storage, an optional program on your machine writes those notes. It reads and writes only inside the notes folder you choose, and sends nothing anywhere.

Who else is involved

Google — sign-in, and the Drive and Docs APIs that hold your Drive-backed notes.
Groq — the AI model provider, which receives a note's content only when you press Organise or Summarise.
Google Cloud Run and Neon — hosting for the server and its database, which hold the index described above.

Your data is not sold, rented, or shared with anyone else.

Deleting your data

Open the extension, choose Settings, and press Delete my data from the server. This erases every record we hold about you.

Your notes themselves are deliberately left alone. They are your Google Docs, your Apple notes and your files; they hold the only copy of your writing, and they are yours to keep or delete. You can also revoke Flow Notes' access to your Google account at any time at myaccount.google.com/permissions.

Children

Flow Notes is not directed at children under 13 and does not knowingly collect their data.

Changes

If this policy changes materially, the date at the top will change and the revision will be visible in the public repository's history.

Contact

Questions about this policy or your data: d6750133@gmail.com