Privacy Policy

Last updated: September 11, 2026

FlowTrack™ ("we", "our", "the app") is a desktop time-tracking application built by Harshit Sharma. This policy explains what data we collect, how we use it, and your rights.

1. Data we collect

Account data: When you register, we collect your email address, display name, and a hashed password. We never store your password in plain text.

Time-tracking data: Task sessions (description, start/end time, ticket numbers, notes) that you create. This is the core data you use the app for.

Settings: Your preferences (timezone, work hours, AI provider configuration, Jira connection).

Feedback: If you submit feedback through the app, we store your message, subject, and optional app version / OS info.

We do not collect:

• Browsing history or web activity
• Keystrokes or screen content
• Location data
• Contacts, files, or personal documents
• Analytics or telemetry beyond what you explicitly log

2. How we use your data

• To provide the time-tracking service (storing and displaying your sessions)
• To authenticate your account (JWT tokens)
• To send transactional emails (verification, password reset, feedback replies)
• To connect to Jira (if you enable the integration — OAuth tokens are encrypted at rest with AES-256-GCM)
• To generate AI summaries (if configured — your session data is sent to your chosen AI provider)

3. Desktop app features

FlowTrack's desktop app includes optional features that run locally on your computer:

• Meeting detection: For Microsoft Teams, if you enable Teams' own "third-party app API access" setting, FlowTrack connects to a local API Teams exposes on your machine to read meeting state directly. For Zoom, Google Meet, Webex, and Slack Huddle (and Teams as a fallback), FlowTrack checks running process names and window titles instead. No audio is recorded, and no video or call content is accessed, in either case — detection happens entirely on your device.
• Idle monitoring: Uses Windows APIs to detect when you're away. No data is sent externally — it only triggers a local prompt.
• Activity tracking: Reads the foreground window's title (to identify which application you're using) for nudge purposes. This data is held in memory only, is used solely to display an app-name summary in the "no timer running" prompt, is never written to disk, and is never sent to our servers.

4. Data storage & security

• The FlowTrack backend application runs on Railway (cloud infrastructure)
• Your data is stored in a PostgreSQL database hosted separately on Neon (serverless Postgres), in the ap-southeast-1 (Singapore) region
• All API communication uses HTTPS
• Passwords are hashed with BCrypt (strength 12)
• Jira tokens and AI API keys are encrypted at rest using AES-256-GCM
• JWT access tokens expire after 60 minutes; refresh tokens after 30 days

5. Third-party services

The following providers process data on our behalf as part of running FlowTrack:

• Railway: Hosts the backend application (compute).
• Neon: Hosts the PostgreSQL database that stores your account and time-tracking data (ap-southeast-1 / Singapore).
• Resend: Email delivery (verification, password reset, feedback notifications).

The following only apply if you choose to enable them:

• Jira (Atlassian): Only if you connect your Jira account via OAuth — used to pull tickets and push worklogs.
• AI providers — network API: If you configure OpenAI, Anthropic (Claude API), or Google (Gemini API), your session descriptions are sent over the network to that provider to generate summaries, subject to that provider's own privacy policy.
• AI providers — local CLI tools: If you configure Claude Code CLI, Gemini CLI, or Antigravity, FlowTrack instead runs that tool as a local subprocess on your machine and passes it the prompt directly — no network call is made by FlowTrack itself in this case. Any further data handling is governed by the CLI tool you've separately installed and authenticated, not by FlowTrack.
• Ollama: Runs as a model you host yourself (typically on your own machine or network) — your session descriptions are sent to whichever Ollama endpoint you've configured, which you control.

We do not sell, rent, or share your data with any third party for advertising or marketing purposes.

6. Your rights

• You can export your data at any time via the CSV export feature in Analytics
• You can delete individual sessions from within the app
• You can delete your entire account from Settings → Profile (password-confirmed), or by contacting us. All associated data is permanently removed within 30 days.

7. Data retention

Your data is retained as long as your account is active. If you delete your account, all associated data is permanently removed within 30 days.

8. Children's privacy

FlowTrack is not intended for users under 13. We do not knowingly collect data from children.

9. Changes to this policy

We may update this policy occasionally. Changes will be posted on this page with an updated date. Continued use of the app after changes constitutes acceptance.

10. Contact

For privacy questions or data requests, email harshit9466@gmail.com.