Privacy Policy

Last updated: October 28, 2026

Contact: 1454021361@qq.com

Flowizard (the "App") is built on a local-first principle: content is stored on your device. When the App uses an iCloud library, content syncs through your iCloud account. This launch does not currently offer AI features. Data processing and records from older versions are described below.

1. Where your content lives

Everything you create — places, to-dos, notes, timer records, tags, items and photos — is stored on your device, protected by system data protection. iCloud and exports process the relevant content as described below; see section 5 for AI processing in older versions.

2. iCloud Sync (private CloudKit database)

• When system settings allow Flowizard to use iCloud and the App uses your current account's iCloud library, your data syncs to your own private iCloud database, accessible only with your Apple ID. The developer cannot read anything in it.
• The App shows sync status and a link to system Settings; it does not provide a separate sync switch. You can manage iCloud access and storage for Flowizard in system Settings. Deletions and whole-library replacements in a synced library may propagate to other devices using the same account. Export a backup of any content you want to keep before managing or deleting data.
• Health data is excluded from iCloud Sync (see Section 4).

3. Backups, export and photos

• Full-library export / import happens only when you choose it. Exported backup files may contain all of your data — please keep them safe. Once exported, the file is entirely under your control; we take no part in its transfer or storage.
• You can select photos using the system photo picker or choose to import photos taken during a timer record’s time range. Importing by time range requires photo-library permission; the App queries that range only among photos it is permitted to access and saves imported photos as record attachments. This version does not offer sending images to AI; see the legacy disclosures in section 5 for image processing in older versions.

4. Health data (HealthKit)

• Only after your explicit permission, the App reads (never writes) the health data types you specify, for your own statistics and reviews.
• Health data stays on the device, never enters iCloud sync, is never sent to any third party (including the AI assistant), and is never used for ads or any other purpose.
• You can revoke permission anytime in system Settings → Health; related features then stop working.

5. AI Features and Older Versions

• Launch availability: this version does not currently offer any AI features, including personal API keys and hosted AI. Purchasing Pro does not unlock AI. This version does not initiate AI service or model-directory requests.
• Legacy disclosure: personal DeepSeek keys: this applies only to older versions offering this capability and their records. In those versions, after you enter a DeepSeek API key, read the data-sharing notice and select the consent-and-save button, using AI sends your content, limited recent conversation context and relevant App data summaries needed to answer your request directly to DeepSeek. DeepSeek processes received content under its own privacy policy. API usage is billed to your DeepSeek account separately from Pro. When you actively add images and send a message, image-capable models may receive those images; the App first attempts to compress them. Models without image input do not receive the image itself. You can choose a DeepSeek model for each key. The App fetches a public model list from Flowizard servers without sending your personal API key, conversation content or App data summaries. The server uses its own DeepSeek credentials to obtain the directory; the list does not guarantee that your key can use every listed model. As with ordinary website requests, the server can see the connection IP address. Model capabilities are defined by the App and cannot be enabled remotely through the list. In older versions limited to direct DeepSeek connections, other saved connections are retained but hidden and unavailable; their endpoints and keys are not migrated. Your personal API key stays in this device's Keychain, is not uploaded to Flowizard servers and is excluded from content backups and iCloud sync.
• Some older versions also extracted text from images using on-device OCR and could include that text in AI requests, including when the model did not support the image itself. In older versions offering AI, failures never silently switch providers or billing paths, and old hosted requests are not automatically replayed to DeepSeek. Proposed changes require user confirmation and execute on the device. Those AI tools do not have access to HealthKit health data.
• Hiding AI entry points in this launch does not delete saved AI conversations, messages, attachments, API configurations or Keychain keys. Existing conversations, messages and attachments are local content that can sync through iCloud and appear in content backups. Hosted session credentials and temporary local request-recovery records from older versions are excluded from content backups and iCloud sync.
• Legacy disclosure: hosted AI in older versions: this disclosure applies only to older versions that support hosted AI and their records. Those versions may still access the hosted service; disabling the entry point in this launch does not mean the server has stopped operating or historical records have been deleted. In those versions, only after your explicit consent, the text you send, limited recent conversation context and relevant App data summaries needed to answer your request go through Flowizard servers to DeepSeek. The provider processes received content under its own privacy policy. Legacy hosted mode supports text only, does not upload images and does not require your own API key; the older App displays the available allowance and reset rules.
• Legacy disclosure: hosted identity and technical records: this applies only to hosted AI in the older versions described above. The service verifies Apple-signed store credentials and App Attest proofs. It stores a derived identity, device public keys, sessions, usage and cost records to enforce allowances and prevent replay or duplicate charging. It requires no phone or email registration and does not rely on phone numbers, email addresses or a client-supplied UUID for allowance identity. Network services process technical connection information such as IP addresses for security and troubleshooting, not advertising tracking.
• Legacy disclosure: custom connections in older versions: this applies only to older versions supporting these capabilities. Content goes directly to the service configured by the user. Image-capable models may receive images the user chooses to send; other image processing may send only text extracted using on-device OCR. Older versions may download public model settings from Flowizard without sending an API key or conversation content in configuration requests. These capabilities do not describe availability in this launch.

6. Purchases and subscriptions (Apple and RevenueCat)

Apple handles payments, billing and refunds for all in-app purchases (Pro monthly, Pro yearly and lifetime Pro). Flowizard does not receive your payment card number or payment authentication credentials.

• We use RevenueCat for purchase verification, membership entitlement sync and restoration, revenue statistics, and remote configuration of membership plans and their presentation. Apple sends purchase, renewal and refund notifications to this service; App versions that integrate RevenueCat also send necessary purchase and technical information.
• This includes a randomly generated anonymous App User ID, Apple purchase receipts and transaction or subscription information (such as product and transaction identifiers, prices, dates, renewal, refund and entitlement status), and basic device and App information (such as device type, operating system and App versions, and locale). We do not use your name, email or iCloud identity as this anonymous ID.
• We do not send notes, to-dos, photos or health data to RevenueCat, or use it for advertising tracking. RevenueCat processes the information needed for these services on our behalf. See the provider's privacy policy for more information.

7. Creator campaign (official website)

If you join the RED (Xiaohongshu) creator campaign and submit information via this website's campaign page, that page collects your post link, account handle and contact info, used only to verify entries and deliver rewards (via official Apple redemption codes). We do not collect ID numbers, real names or phone numbers beyond what verification requires. Campaign data is kept per the campaign rules and deleted after it ends; you can email me anytime to have it deleted.

8. System capabilities and permissions

• Notifications: for reminders such as timer completion, requested only when you enable the feature.
• Widgets and Live Activities: display your own timers and content on your devices; nothing is uploaded.
• App Group: lets the main app and widgets share necessary data locally on your device.

9. What we never do

• We do not use your notes, to-dos, photos or health data for purchase analytics. RevenueCat purchase and revenue statistics are described in section 6; separate processing by hosted AI in older versions is described in section 5.
• No ads, no cross-app / cross-site tracking, and no selling of data — ever.

10. Retention and deletion

• Local data: delete content in the app anytime; uninstalling removes the App sandbox but does not automatically delete iCloud content, server records or all Keychain items.
• iCloud data: deletions in the app sync over; you can also manage iCloud storage in system Settings.
• Purchase and entitlement records: RevenueCat retains records needed for purchase verification, entitlement restoration and revenue statistics. Uninstalling the App does not automatically delete these records. Contact us at the email below for information or to request deletion. Deleting records does not cancel an Apple subscription.
• Hosted AI content (older versions and their records only): inputs are temporarily retained during processing and cleared on terminal states. Results support recovery and are normally cleared 24 hours after completion or another terminal state. Identity, device-verification, allowance and cost records are retained separately for fraud prevention and accounting. Deleting content does not reset free allowances. In older versions that support hosted AI, withdrawing consent stops future sends, but cannot retract content already processed by a provider; cancel running tasks first. Disabling AI in this launch does not automatically delete these records.
• For help deleting server content or questions about retention and deletion of identity and cost records, contact 1454021361@qq.com.

11. Children's privacy

The App is not directed at children under 13, and we never knowingly collect personal information from children.

12. Changes to this policy

When features change, we update this policy and the date above; major changes will be announced inside the App.