Privacy policy

Who is responsible for your data

Privacy enquiries and data requests reach us through the contact form on this site or at contact@flowreader.io.

For data that never leaves your device, which is most of what FlowReader holds, there is no processing by us at all. We are not a controller of your local library, because we have no access to it.

What we process, why, and on what legal basis

Under the GDPR every processing activity needs a lawful basis. These are ours, activity by activity.

• Account and authentication (email address): performance of your contract with us, Art. 6(1)(b)
• Cross-device sync of your library: performance of your contract, Art. 6(1)(b), and only while you have sync turned on
• Subscription, entitlement and billing records: performance of your contract, Art. 6(1)(b), and legal obligation for accounting records, Art. 6(1)(c)
• Newsletter ingestion and Monitors run on the server: performance of your contract, Art. 6(1)(b)
• Sending your content to an AI provider: carried out on your explicit instruction, using your own credentials, and only when you trigger it or set up a Monitor that uses AI
• Collection sharing: performance of your contract, and your own decision to invite a named person
• Publishing a note you share online: performance of your contract, Art. 6(1)(b), and your own decision to publish it. Using a visitor’s IP address for at most a minute to limit how often one address can request it: our legitimate interest in keeping the service available, Art. 6(1)(f)
• Contact and vulnerability report forms, and error reports you send from the app: our legitimate interest in answering you, fixing what went wrong and keeping the service secure, Art. 6(1)(f)
• Rate limiting the public contact endpoint using a salted hash of your IP address: our legitimate interest in not operating an open spam relay, Art. 6(1)(f)
• Counting downloads and app use anonymously, which uses your IP address for at most a minute to stop one address inflating the counts: our legitimate interest in knowing how many people install and use each version of FlowReader, Art. 6(1)(f). You can turn the app’s counts off
• Remembering your language choice on this website, and the preview password while the site is in closed preview: strictly necessary to provide what you asked for; no consent is required and none is sought

Data stored locally on your device

This never leaves your device unless you enable cloud sync or a feature that sends it elsewhere. We cannot read it, and we cannot produce it for anyone who asks us to.

The browser extension reads a web page’s content when you open it in the reader or save it, and fetches the feeds and sites you subscribe to. That happens on your device; the content leaves it only through the features described below.

• Saved articles, web pages and ebook content
• Reading progress, annotations, highlights and notes
• Collections, tags and Smart Rules configuration
• Feed subscriptions and cached feed content
• Reading statistics and usage history
• Application preferences and settings

Optional synchronized data

If you enable Online Sync, your library data is synchronized to FlowReader’s Firebase project: saved items and their content, highlights and notes, reading progress and reading statistics, collections, tags, feeds, Monitors, your AI chat history and assistant tasks, and your settings. Chat history and assistant tasks are stored with your account only while Online Sync is on; otherwise they stay on your device. Authentication is Firebase Auth; storage is Cloud Firestore, protected by per-user security rules so that one account cannot read another’s. Your entitlement and billing status are stored so paid features unlock across your devices.

Online Sync is not end-to-end encrypted: the service can technically read what it stores. Dropbox sync and local-folder sync write your library as an unencrypted file to your own Dropbox or folder and involve no FlowReader-operated server at all; that file is protected by your Dropbox account or by whatever protects the folder. The security page explains the difference and when each matters.

Account and subscription data

If you subscribe, Stripe processes checkout and billing for desktop, Chrome and Firefox, and Apple processes iOS in-app purchases for the mobile app. We store entitlement status, trial dates, provider identifiers and the billing event records needed to unlock Pro and to support account recovery.

We never store full card numbers or Apple payment credentials. Billing support may involve looking at your account email, Firebase user id, entitlement document and provider event records, and nothing else.

Newsletter and Monitor data

These are optional Pro services. Newsletters sent to your private alias are sanitized and delivered into your archive; raw message sources are not retained. A Monitor runs on the FlowReader server: it fetches the sources you ask it to watch, on the interval you set, and collects matching items or tracks a signal and tells you when it changes. The Monitor’s definition states what it watches, how often, and what it does with a match.

Newsletters carry the sender’s data as well as yours. We process it only to deliver the issue into your archive, and we do not use it for anything else.

Notes you share online

Share online is an optional Pro feature. It publishes one of your own notes at notes.flowreader.io, a FlowReader service on Cloudflare Workers, on a long, random link that anyone who has it can read. It needs Online Sync and a verified email address, and the page is built from the copy of the note that Online Sync already stores: its title, its text and images, its cover, the names of its tags, and when it was created and last changed. Nothing else in your library is shown, and a card in the note that points to a saved item shows that item’s title, author and source but not its id or cover. The page follows the note as you edit it. A copy is kept in Cloudflare’s cache for about a minute, and its images for up to a day, but every request first checks that the note is still shared.

For each shared note we store a record in Cloud Firestore: your account id, the note’s id, the link, whether search engines may index it, and when the share was made and last changed. If you set a password, we store a salted PBKDF2 hash of it, never the password itself, and the app does not keep it on your device. A visitor who enters the right password gets a cookie on notes.flowreader.io that keeps that note open for 30 days. It holds no password and nothing that identifies the visitor, and changing the password ends every such session.

Search engines are told not to index the page unless you allow it, and only a note without a password can be indexed. To limit abuse, the service uses a visitor’s IP address, for at most a minute, to limit how many requests one address can make, and never stores it. Its logs record event names and error categories, never an account id, a link or a password.

Stop sharing deletes the record, and the link stops working on the next request. Deleting your account does the same. Deleting the note takes the link down once the deletion is final (after Undo) or once it has synced. If your Pro subscription ends or you turn Online Sync off, the page stops being shown but the share is kept, so the note returns on the same link once both are back on. Stop sharing to remove it for good. A copy that a visitor or a search engine has already made is outside our control.

Error reports you send

The app has a Report an error form. Nothing is sent until you send it. A report carries what you typed, the error notification you are reporting and, if you are signed in, your account email and a Sync & Data Support Bundle: sync status, counters, timings and error codes, which the form lets you read before sending. It contains no document content and no credentials. If you are not signed in, it carries the reply email you give instead of the Support Bundle. In Firefox, the notification and the Support Bundle are sent only if you allow Firefox to share technical data; otherwise only what you typed is sent.

The report is posted to a FlowReader Cloud Function in europe-west1 and relayed by email to our support mailbox through Resend. To limit how many reports can be sent, a hash of your account id, or of your IP address if you are not signed in, is stored with a counter.

Anonymous usage counts

The browser extension and the desktop app tell us, anonymously, that they are being used. At most once a day, on the first use of the day, an install sends one short report: that it was used that day, how many times it was opened again after half an hour or more without use and how many times you signed in since its previous report, whether it is a new installation sending its first report, the app version, and which app it is, such as “Chrome extension” or “desktop app on macOS”. Because the sessions and sign-ins are sent with the next day’s report, they are counted on the day they are sent rather than the day they happened. The report goes to get.flowreader.io, the FlowReader service on Cloudflare Workers that also counts the download buttons, which adds it to that day’s totals and keeps nothing else. No account, email address, device or install identifier, IP address or browser identification string is stored, and nothing about what you read is part of it, so a report cannot be connected to you, to your device or to any other report. Your IP address is used briefly, for at most a minute, to stop one address inflating the counts, and is never stored.

To send only one report a day, the app keeps on your device the date of its last report, when it was last used, and the sessions and sign-ins it has not reported yet. That record never leaves your device except as the counts in the next report.

You can turn the counts off in Settings, under Advanced, “Send anonymous usage counts”. The choice applies to the device you make it on. In Firefox, nothing is sent unless you have allowed FlowReader to share technical and interaction data, and the app never asks for that permission to send these counts.

The desktop app checks for updates by way of get.flowreader.io too, which sends the check on to the update information on flowreader.io. Each check adds one to that day’s count for the operating system and app version, such as “macOS, 1.0.2”, and nothing else about it is kept: no IP address, browser identification string or other identifier is stored. Your IP address is used briefly, for at most a minute, to stop one address inflating the count, and is never stored. This count is part of the update check itself, so turning off the usage counts does not stop it.

AI requests

If you use AI features, text from your saved content goes to the provider you select. FlowReader supports Anthropic, OpenAI, Google, Hugging Face and OpenCode Go as hosted providers, and Ollama and LM Studio for models running on your own machine. With a local model, the text never leaves your computer.

Some AI features, including assistant Tasks, can also search the web. When one does, the search query, which may contain text taken from whatever you are reading, goes to the search provider you configured: Brave, Perplexity, LangSearch, TinyFish or Tavily, each on an API key you supply yourself, or a SearXNG instance. If you have not named a SearXNG instance, FlowReader uses a built-in list of public ones, and asks your permission for each instance before it receives a query. OpenAI and Anthropic can alternatively run the search inside the model request itself. The web search tool in chat is off until you turn it on.

You supply your own API key. When you use AI in the app, your device sends the request to the provider directly; we do not proxy it, so we do not see the content or the response. The one exception is a Monitor that uses AI, described below: it runs on our server, which sends the text it collected to your provider. The provider’s privacy policy governs what happens to the content there, and it is worth reading. Providers differ on retention and on training.

API keys are stored encrypted on your device and are never part of library sync; Dropbox sync and Folder Sync do not carry them at all. While Online Sync is on with Pro, the app copies your API keys to your other signed-in devices: your device encrypts each key to a key held by our server, the encrypted key is stored with your account in Cloud Firestore, and when another of your devices asks for it, our server decrypts it and encrypts it again for that device. This is not end-to-end encryption, and our server can read a key while it copies it. When a Monitor uses AI, your device stores the provider key, and a web search key if you use one, encrypted the same way; when the Monitor runs, our server decrypts the key and sends the text the Monitor collected to your provider. Collecting from sources and tracking signals do not require an AI key.

If you add an external MCP server, the assistant can call the tools it offers, and what the assistant passes to a tool, which can include text from your conversation or your library, goes to that server. You choose the server, each server and each of its tools can be switched off, and the ability to call them at all starts off.

If you connect an AI client, such as Claude, to FlowReader’s Remote MCP service at mcp.flowreader.io, that client can read your synced library through the service and, with the permissions you grant on the consent screen, change it or fetch public web pages for you. The service runs on Cloudflare Workers, reads only what Online Sync stores, never your device, and passes what the client asks for to that client, where its provider’s privacy policy applies. You can revoke a connection at any time in Settings.

What we do not do

FlowReader uses no analytics or telemetry service. The only counts it keeps are anonymous ones: how often the apps are used and check for updates, described under “Anonymous usage counts”, and how often FlowReader is downloaded, described under “This website”, never by whom. We do not track your reading, serve advertisements, use fingerprinting or tracking cookies, or build a profile of you. We do not sell your personal data, and we do not share it with anyone for their own purposes. The service providers listed below act only on our instructions.

The use of information received through the FlowReader browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

This website

This site loads no analytics, no tracking scripts, no third-party fonts and no advertising, and it sets no cookies. One external resource is loaded, on two pages only: the contact page and the vulnerability disclosure page each run a Cloudflare Turnstile check, which is what stops the message form being used as a spam relay. It is named on the page it appears on, it is not analytics, and it does not follow you to any other site. Every other page on this site loads nothing but this site. It writes two things to local storage in your browser, both of which stay on your device and neither of which is ever sent anywhere: your language choice under “flowreader.lang” and, for as long as the site is in closed preview, the preview password you entered, under “flowreader-preview-unlock”. Both exist only so the site does not forget something you have already told it, which is what makes it strictly necessary and why no consent is asked for it.

The download buttons are counted. When one sends you to a store listing or a download, it goes there by way of get.flowreader.io, a FlowReader service on Cloudflare Workers, which records that a download button was clicked: the platform, which button it was, the date, the country Cloudflare reports for the request, and the family of browser and operating system, such as “Chrome on macOS”. A click that looks automated, such as a search engine crawler or a link preview, is marked as such so it can be left out of the count. It sets no cookie and stores no IP address, no browser identification string and no other identifier, so a recorded click cannot be connected to you or to any other click. Your IP address is used briefly, for at most a minute, to stop one address inflating the count, and is never stored. Nothing is loaded into the page to do this: it is the link itself.

Downloads that do not start on this site are counted the same way. Installing FlowReader with Homebrew, Scoop or the AUR, and the desktop app downloading an update, fetch the file by way of get.flowreader.io, which records the same details as a button click together with the app version and how the file was fetched, such as “Homebrew” or “update”, and then sends the download on to the release on GitHub.

The contact and vulnerability report forms do submit to us. When you send one, the name, email address, topic and message you typed are posted to a FlowReader Cloud Function hosted in europe-west1 and relayed by email to our contact or security mailbox through Resend, our email delivery provider. The message is not stored in a database and is not written to any log.

Before the message is relayed, the Turnstile check on the form is verified with Cloudflare. That verification sends Cloudflare the token the check produced and your IP address; it sets no cookie on this site and Cloudflare does not use it to build a profile of you. To stop the endpoint being used as a spam relay, it also rate-limits by IP address. What is written down is your address combined with a secret salt and hashed with SHA-256, never the address itself, and the record is deleted automatically two hours later. Nobody who does not hold that salt can work back from a stored value to an address. We still treat the hash as your personal data, because we hold the salt, so every right below applies to it. If you would rather not use the form at all, the same addresses accept ordinary email.

Service providers

Each of these is involved only when you use the feature it supports, and each acts on our instructions rather than for its own purposes. The subprocessors page lists them in full, with what each one receives, where it is, and the transfer mechanism relied on.

• Google Firebase: authentication, Firestore sync storage, Cloud Functions
• Stripe: subscription checkout, billing portal and payment processing
• Apple: in-app purchases for the mobile app
• Resend: delivery of contact and vulnerability report emails, and of error reports sent from the app
• Cloudflare: the Workers running newsletter ingestion, subscriptions, flows, the Remote MCP service, notes you share online and the download and usage counter, and the Turnstile spam check on this site’s contact and vulnerability report forms
• Your chosen AI provider: only the content you send it, using your own key
• Your chosen web search provider: only the query, when an AI feature searches the web, using your own key

Where your data is, and international transfers

The FlowReader-operated services are pinned to the EU. Cloud Firestore and our Cloud Functions run in europe-west1, in Belgium. That is where synced library data, entitlement records and the contact endpoint live.

Some of the providers above are established outside the EEA, or may process data outside it: Stripe, Apple, Resend, Cloudflare, and any hosted AI provider you choose. Where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses or on an adequacy decision covering that provider. The mechanism relied on for each one is stated on the subprocessors page.

If you use a local model through Ollama or LM Studio, no transfer occurs at all, because nothing leaves your machine.

How long things are kept

Data on your device is kept until you delete it: that is your decision, not ours, and we cannot delete it for you.

• Synchronized library data: while sync is enabled, and until you delete it or your account. Account deletion removes it
• Account record: until you delete your account
• Billing and accounting records: for the statutory accounting retention period that applies to us, which is five years in Norway. These survive account deletion because the law requires it
• Contact and vulnerability messages, and error reports: kept in the mailbox while the matter is open, and deleted within 24 months
• Contact rate-limit hashes: two hours, then deleted automatically
• Anonymous download and usage counts: kept as daily totals, with nothing in them that identifies anyone
• Newsletter issues: held in your archive until you delete them
• Notes you share online: the share record is kept until you stop sharing, or delete the note or your account

Security and what happens if something goes wrong

Local data is stored in a SQLite database on your device, and credentials in platform-secure storage. Online Sync is protected by account authentication, TLS in transit, and per-user Firestore rules. Folder and Dropbox sync files are not encrypted by FlowReader; they are protected by your Dropbox account or by whatever protects the folder. We claim no security certification, no external audit and no zero-knowledge architecture, because we have none.

If a personal data breach happens and it is likely to result in a risk to your rights and freedoms, we will report it to Datatilsynet, the Norwegian Data Protection Authority within 72 hours of becoming aware of it. If the risk to you is high, we will tell you directly and without undue delay, and we will say what happened rather than what is comfortable.

If you have found a weakness, the vulnerability disclosure page tells you how to report it and what we commit to in return.

Your rights

If the GDPR or UK GDPR applies to you, you have the rights below. Most of them you can exercise yourself, in the app, without asking us, which is faster than any request process we could offer.

• Access: your data is visible in the app, and you can export it at any time: reading history and annotations as JSON, CSV or Markdown, feeds as OPML, and collections as FlowCollection files
• Rectification: edit anything in the app; for account or billing records, ask us
• Erasure: delete local data from Settings; with sync on, delete your remote data and your account from the same place
• Restriction and objection: ask us to stop a particular processing, including anything we do on the basis of legitimate interests
• Portability: exports are in open formats, and importable elsewhere
• Withdraw consent: where processing rests on consent, withdrawing it is as easy as giving it, and does not affect what was lawful before
• Complain: you can lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority, or with the supervisory authority where you live or work, at any time and without going through us first

Making a request

Send data requests through the contact form or to the address below. We answer within one month, and will tell you if a request is complex enough to need longer, up to two further months, with reasons. There is no charge unless a request is manifestly unfounded or excessive.

We may need to confirm you control the account email before acting on a request, because handing someone else’s reading history to whoever asks for it would be the worse failure.

If you are in the United States

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, under the CCPA definitions or any other. There is nothing to opt out of, because the thing you would opt out of does not happen.

California residents may request to know what personal information we hold, to have it deleted, to have it corrected, and to receive it in a portable form. Exercising any of these will never get you worse service or a different price. Use the same contact route as everyone else; we do not operate a separate, slower channel for privacy requests.

Children’s privacy

FlowReader is not directed at children and we do not knowingly collect personal data from children under 13. Across the EEA the age of consent for information society services is set nationally between 13 and 16; we do not knowingly process the data of anyone under the age that applies where they live without parental consent.

A subscription is a contract, and the terms of service set the minimum age for entering one. If you believe a child has given us data, tell us and we will delete it.

Cookies and similar technologies

This website sets no cookies and uses no tracking technologies, so there is no cookie banner and nothing to configure. What it stores in your browser is described under “This website”: your language choice, and the preview password while the site is in closed preview. Both are strictly necessary for something you asked for and therefore need no consent under the ePrivacy rules or ekomloven.

The application stores data locally on your device as described further up this page, including the record of which anonymous usage counts it has already sent.

notes.flowreader.io, where notes shared online are published, sets a cookie only for a visitor who unlocks a note with its password, one per note. It keeps that note open for 30 days and holds nothing that identifies the visitor, so it is strictly necessary for what the visitor asked for and needs no consent. If a visitor picks light or dark, the choice is kept in that browser’s local storage under “flowreader-notes-viewer-mode” and never sent anywhere.

Changes to this policy

This policy may be updated. The date at the top always reflects the current version, and material changes are noted in the changelog. If a change affects how we process data you have already given us, we will tell you rather than rely on you re-reading this page.

Contact

For privacy questions or data requests: the contact form on this site, or contact@flowreader.io.