Privacy Policy

Last updated: July 10, 2026 · This is a working draft pending review by legal counsel.

Who we are

FlowPrism (“we”, “us”) is a record-keeping tool for independent instructors. Contact: getflowprism@gmail.com.

Scope of data collection

We collect and store only what the product needs to work:

• Your account email and profile details you enter.
• Calendar events you upload or connect (titles, times, locations, descriptions), used solely to build your session records.
• Business records you create: students, studios, sessions, packages, credits, pricing, training entries, and expenses.
• Product analytics and error logs (page views, feature events, crash reports) used to fix bugs and improve the product — never to profile your students.

Your session and earnings records are self-reported by you and private to your account. We do not verify, monitor, sell, or share them, and we do not report them to the IRS or any other authority. We access an individual account's records only to provide support you request, to investigate abuse, or as required by law.

Cookies

We use cookies for one thing: keeping you signed in (authentication session). Analytics, where enabled, uses privacy-respecting product analytics tied to your account, not third-party advertising cookies. We do not run ads or ad trackers.

Prohibited data

FlowPrism is not designed to store medical or health information. Student note fields are for teaching preferences and session context (e.g. “prefers mornings, working on balance”) — do not enter medical diagnoses, health conditions, or other protected health information. You are responsible for the content you store.

No HIPAA business associate relationship

FlowPrism is not a healthcare provider tool, does not create a Business Associate relationship under HIPAA, and must not be used to store data that would require one.

Google Calendar data

If you connect Google Calendar, FlowPrism requests read-only access to your calendar list and events, used solely to let you review calendar events and convert the ones you choose into session records inside your account. We never write to, modify, or delete anything in your calendar, and we never sell calendar data or use it for advertising. We store the events you sync and an encrypted token that lets us read your calendar until you disconnect; disconnecting (Import page) or deleting your account revokes our access and deletes the token.

FlowPrism's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Where a synced event title can't be read by our rule-based parser, it may be processed by the AI fallback described below strictly to provide this user-facing feature — never to train AI models.

AI processing

When our rule-based parser can't read a calendar event, its title/description may be sent to Anthropic's Claude API to extract the session details. This data is processed under Anthropic's commercial terms and is not used to train their models.

Service providers

We use Supabase (database and authentication), Vercel (hosting), Stripe (payments — we never see your card number), Anthropic (AI parsing fallback), and analytics/error tools (PostHog, Sentry). Each receives only what it needs to perform its function. Data is hosted in the United States; by using FlowPrism from elsewhere you consent to processing in the US.

Security

All data is encrypted in transit (TLS) and at rest, isolated per account with row-level security, and payments are handled entirely by Stripe. No system is perfectly secure; if a breach affects your personal information, we will notify you as required by applicable law.

Data retention

We keep your data while your account exists. When you delete your account (Settings → Delete account), all of it is deleted immediately and irreversibly from the production database. Limited residual copies may persist briefly in encrypted backups and server logs, which expire on a rolling basis.

Children

FlowPrism is for adults (18+) and is not directed at children. Do not create an account for anyone under 18. Student roster entries are names you choose to record about your own clients; do not store more about minors than you need to run your teaching business.

Your rights — export and deletion

You can export your records to Excel at any time, and you can permanently delete your account and all associated data from Settings. You may also email us to exercise any privacy right, including access, correction, and deletion. California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we honor access/deletion requests without discrimination.

Not tax or legal advice

FlowPrism is a record-keeping tool, not a tax advisor or tax-filing software. Reports and exports are generated from data you entered, for your own use. You choose what appears in every export.

Changes

We'll update this page when the policy changes and note the date above. Material changes will be announced in the app or by email.