What we collect
Device identity
When you first connect to cloud features, Flowment creates a random installation credential and records a random device identifier, app version, build number, and system version. We use them to restore the same installation’s cloud identity, find your cards and shared moments, and count active devices in aggregate without double-counting the same device. When the app returns to the foreground, we may also read the number and size distribution of currently configured Flowment widgets to measure aggregate widget adoption and observed add/remove trends; we do not upload which card a widget selects or the card content. These identifiers are not used for third-party advertising or cross-app tracking.
Personal card backup
When your account has personal-card sync access and network sync is enabled, we keep personal-card backups on our servers. Without sync access, or when network sync is off, personal cards stay only on this device. If you delete a synced card, we remove its cloud backup and keep a local deletion marker so it is not pulled down again.
Personal photos
Photos selected with the system photo picker are processed and stored on this device for card previews and offline widgets. Flowment does not upload these photos or crop settings, and does not use iCloud or CloudKit to transfer them. Another device uses the template background until you choose a photo there.
Personal check-ins
Check-in names, rule time zones, round settings and daily completion or undo records are stored on your device. With Network Sync enabled and eligible personal cloud access, Flowment syncs these records to your own Flowment account using our existing Cloudflare service. This does not use iCloud or CloudKit. Losing cloud access keeps your local records; explicit deletion of your cloud check-in data remains available without payment. Exporting personal data includes local check-ins and preserved conflict records under the existing Lifetime entitlement. Photos, crop settings, account credentials and sync tokens are excluded.
Shared moments
When you create or join a shared moment, we save the text, dates, optional nickname, and current state so both people see the latest card. Each moment has at most two people, and invite links expire after 48 hours.
Signals and notifications
When you send Miss you or Hug, we save the sender, time, and short-lived display state. Shared-content edits and these interactions also create shared-history events containing the event type, time, which side acted, and only the date or changed-field summary needed for the timeline. It is not a public chat and is not used for advertising profiles. When you use cloud features, we may store an Apple push device token for silent shared updates and widget refreshes; this synchronization may continue even if visible notifications are off. We also store your app language, system alert authorization status, choices and consent times for version-update and product-news notices, and notification send status and error records. We send new-version, new-Theme, or offer alerts through Apple only after you opt in to the relevant category in the app and allow system notifications. We may use app version and Lifetime access to select applicable notices. These new-Theme and offer notices promote our own products and remain opt-in. Push messages do not contain card text.
Reports and blocking
Shared cards include report and blocking controls. A report records the shared moment, reason, a snapshot of the card text at submission, and time so we can review objectionable content. Block and end sharing stops further interactions immediately and hides both locations and the other person’s profile details. Personal cards are not shown to other users.
Cooling off and ending
When one person ends a shared moment, we keep the information needed to run its cooling-off period. Restoring it needs both people to agree. After it ends, you may keep a personal memorial card or let it go.
Restore with Apple
If you choose to link Apple, we only keep the private account identifier Apple provides so you can restore shared moments and cloud personal-card backups after changing phones. We do not request your Apple email or name, never receive your Apple password, and never use the identifier for advertising.
Memory archives
If you own Lifetime and choose to save a memory archive from a shared moment, we keep a personal card snapshot and the related shared history so you can view it later. You can delete an individual archive, and account deletion removes your archives.
Purchases and product analytics
Digital purchases are processed by Apple StoreKit. To verify Theme and Lifetime access, restore purchases, and handle refunds, we receive and keep Apple-verified product IDs, transaction identifiers, environment, dates, and revocation status; we do not receive card numbers or full payment details. We also record first-party product events such as paywall views, Theme previews, purchase starts, Theme imports, and limit triggers to understand feature use and purchase funnels. These events do not include card text.
Location-related display and analytics
Shared-card cities and distances use a city you choose or a rough network-based estimate; shared locations do not use device coordinates obtained for weather. We may keep a city and approximate location to show rough distance. For foreground activity from cloud-connected devices, we may also keep the country/region code and city provided by Cloudflare from the network request to measure aggregate active-device distribution by country and city. These analytics do not store latitude/longitude or a travel history.
Weather and device location
Weather is off by default. Flowment obtains device location only after you enable weather, allow network access, and grant location permission; approximate location is sufficient. Device coordinates are processed temporarily on the device and rounded to two decimal places before being sent to Apple for weather and city-name lookup. Device coordinates and resolved city names used for weather are not uploaded to Flowment servers, written to shared locations, or shared with the other person. Weather results and rounded coordinates are cached locally for the app and widgets. Results older than two hours are not displayed, and expired cache entries are removed on a subsequent read. Resolved city names are kept temporarily in memory only. We do not request Always location permission or record a travel history. The system may query weather when widgets refresh.
This website
The site and invite pages may use browser storage for language preference. We use Google Analytics (the same measurement ID as suimuspace.com) to understand traffic and page use. We do not build advertising profiles or run third-party ad trackers on the website.
What we do not collect
The current version does not read contacts or microphones and does not use advertising identifiers. Weather uses device location only after you enable it and grant permission, as explained above. When making a share poster, you can explicitly choose one background image through the system photo picker. Flowment does not request broad photo-library access; the selected image is used locally to render the poster and is not uploaded to Flowment servers. Flowment has no public search, stranger social network, or third-party ads.
How data is used
We use this information only to query and display weather you enable, save and display cards, sync shared content between two people, deliver interactions and notifications you choose, check for new versions, restore accounts and purchase access, enforce card and Theme entitlements, measure product use and purchase funnels, aggregate active-device and country/city distribution, and fix service problems. We do not sell personal information or build advertising profiles from card or shared content.
Retention and deletion
Choose Delete account under Settings → Account and confirm. We remove the cloud identity, personal-card backups, personal memory archives, notification devices and associated delivery records, installation recovery mapping, active-device, widget, and product-interaction analytics linked to the identity, the Apple link, and the member identity, nickname, and coarse location from shared relationships. Shared moments you participate in are removed from the server together with their shared cards, history, interactions, invites, shared statistics, and server-side memory archives created from those moments. Purely local copies already present on the other member’s device are outside the server’s control. To reconcile later Apple refund notifications and legitimate purchase restoration, we retain a pseudonymous StoreKit transaction record with the Flowment identity link removed; we never retain card-payment details. Personal cards on this phone remain and the app switches to local-only mode.
Your choices
Turn off Settings → Network Sync to keep Flowment local-only and stop new weather and city lookups; weather needs network access. You can also turn off Settings → Weather or revoke Flowment’s location permission in system settings. When the app detects that weather is disabled or location permission is revoked, it clears its local weather cache and requests a widget update; already displayed widgets may change only after the system refreshes them. Under Settings → Notifications, turn version-update and new-Theme or offer notices on or off separately; you can also disable visible alerts in system settings. Manual update checks do not require push consent. Sign in with Apple remains optional, and Settings → Account → Delete account removes your cloud identity and associated data. Website analytics can also be limited with browser or system privacy controls.
Third-party services
We use Cloudflare for the website, data storage, and online service; Apple for WeatherKit weather, city-name lookup through MapKit or Core Location, StoreKit purchases, Sign in with Apple, and notifications; and Google Analytics only for website traffic. Apple’s relevant privacy notices apply to data handled by its services. The Flowment iOS app does not integrate third-party advertising or third-party behavioral analytics SDKs. We give each provider only the minimum information needed for that function.
Children’s privacy
Flowment is not directed to children under 13. If you believe a minor has provided personal information, contact us and we will act promptly.
Policy updates
If the way we handle information changes materially, we will explain it clearly in the app or on this page. For product guidance, see Help. Help。