FLOWTOP

Privacy Policy

Last updated: 21 October 2026 · Operated by Ihor Oliinyk

This policy explains how Flowtop handles account details, connected calendars, and the meeting content you choose to process.

Connected calendars

Connecting Google Calendar or Microsoft Outlook is optional. Each connection is independent of your Flowtop sign-in, so you can connect several work and personal accounts and view them together.

Flowtop requests your basic profile and read-only calendar access. It reads calendar names and colours, event titles, dates, times, descriptions, locations, meeting links, and the attendee and organiser details the provider supplies. Available profile photos may also be displayed. This integration does not create, edit, or delete calendar events, and does not request access to your mail.

Optional participant profiles

You can separately connect a Google Workspace directory, Google contacts, or Microsoft organization profiles to load real names and available photos for meeting invitees. This requires an additional read permission shown by the provider. Flowtop searches for the email addresses already present in your calendar invitations; it does not import your whole address book or directory. These profile results are cached with your encrypted calendar data. Photos may be unavailable because of provider or organization sharing settings.

Profile pictures are displayed in the app and are not included in its AI text requests. When you confirm a voice-to-participant match, AI requests can include that person’s name, identifier and recorded statements with their timestamps. The calendar invitation alone is not used to identify a speaker or verify attendance.

Why Flowtop uses calendar data

Calendar data is used to display your combined agenda, show meeting participants, open meeting links, and prepare a session with its scheduled time and relevant meeting context. An invitation does not prove who is speaking: speaker-to-participant matching requires your confirmation.

When you prepare or link a meeting and request AI assistance, its meeting details and participant information can be included in the context sent to your selected AI connection. Review your connection and meeting context before making a request. Local Ollama processing remains on your device; external AI processing follows the selected provider’s data practices.

Storage and calendar authorisation

Calendar account tokens and the synced calendar cache are stored in an encrypted file on your device using operating-system-backed encrypted storage. Saved session content and copied meeting details are part of your local workspace; they are not covered by that calendar-token encryption.

Google sign-in and refresh requests pass through the Flowtop service to exchange credentials with Google. That service processes the authorisation code or refresh token and returns the resulting tokens to the app. The calendar exchange does not intentionally store these payloads or log their contents. The desktop app reads calendar events directly from Google or Microsoft APIs. Network providers can process ordinary connection metadata such as IP addresses.

Meeting content and AI connections

Transcripts, notes, imported documents, and attached screen images are stored in your local workspace. Audio is captured when you start a session with the relevant source enabled. Local transcription runs on your computer. If you select cloud speech, audio is sent to that speech service, directly or through Flowtop’s managed gateway. AI requests send conversation text and enabled reference context to the connection you select; attached images are sent when included in a supported request.

Third-party AI and speech services have their own terms and retention settings. A local workspace does not make a request to an external provider local. Flowtop account sign-in alone does not upload your workspace or enable conversation sync.

Flowtop accounts

If you sign in to Flowtop, its account service stores profile details such as your name, email address, provider identity, and authentication records. The local authentication session is encrypted with operating-system-backed encrypted storage. Signing out keeps your local workspace and does not revoke separately connected calendar accounts.

Managed processing and payments

Flowtop managed AI uses OpenRouter and the selected model provider; managed speech uses Soniox. The gateway forwards the content needed for each request. It records account identifiers, model and usage amounts, confirmed provider costs, balance reservations and billing status, rather than intentionally logging conversation or audio payloads. This is separate from a provider's own retention practices.

Stripe handles card checkout and the customer billing portal; Flowtop stores customer, subscription, invoice and payment references and their status. Flowtop does not receive or store raw card details. For USDC payments, Flowtop records the invoice reference, receiving address, amount, public transaction hash and confirmation status. The Ethereum network is public: transaction addresses, amounts and references are visible on chain and are queried through an Ethereum RPC service. Flowtop never asks for your wallet seed phrase or private key.

Administrator access uses WebAuthn passkeys. The server stores public credential information and authentication counters, not your biometric data or passkey private key. Security, billing and administrative audit records are retained for service operation, reconciliation and applicable obligations; account deletion requests may not erase records that must be retained. Server backups are encrypted and access restricted.

Your controls and retention

In Calendar → Connect calendar, you can disconnect an account to remove its tokens and synced events from Flowtop’s calendar store. You can also revoke Flowtop from your Google or Microsoft account’s connected-app settings. Disconnecting a calendar does not remove meeting details already copied into a saved session, provider-side records, or your own backups.

Saved sessions stay in the workspace until removed. The Delete action moves them to Recently deleted, and local workspace recovery files may retain earlier content. To remove all local workspace data, quit Flowtop and remove its application data and any copies or backups you control. Contact Flowtop to request removal of server-side account records; we may need to verify your identity.

Google API data and Limited Use

Flowtop’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Flowtop uses this information to provide the calendar and meeting features described above, not for advertising, sale of personal data, or training general-purpose AI models. Transfers are limited to providing the features you use, security needs, or applicable legal requirements.

Website and contact

The Flowtop landing page does not include analytics, advertising trackers, remote fonts, or a contact form. Its product demo uses sample data and does not record audio. For privacy questions or account-data requests, contact [email protected]. Updates to this policy will appear on this page with a revised date.

Privacy · Terms · Contact Flowtop