Privacy policy

What we collect

• Account details: your name, email address and, if you sign in with Google, the basic profile Google shares (name, email and picture). We never see a Google password.
• What you put in thisflow: workspaces, projects, tasks, comments, tags, attachments, filters and settings. When you share a project, the people in it see what their role allows.
• Email to thisflow: if you turn on your private address, the emails you send to it (sender, subject, text and attachments) to turn them into tasks.
• Connected services: if you connect Slack, your Slack workspace and user ids and an access token; if you add another calendar, its secret link. Tokens and links are stored encrypted.
• Billing details that a workspace owner enters: invoice emails, company name, address and VAT number.
• Technical data: the IP address and browser of each request, your signed-in sessions and devices, push notification subscriptions, and a record of each AI request (feature, model, size and time, never the text).

Why we use it

• To provide the service you signed up for (performance of a contract): signing you in, storing and syncing your tasks, sharing, notifications, reminders and the features you choose to use.
• To keep thisflow safe and working (legitimate interest): preventing abuse, rate limits, fixing errors, backups, and making sure our emails reach you.
• Optional features you turn on (consent): push notifications, connecting Slack or a calendar. You can turn them off at any time in Settings.
• When the law requires it (legal obligation): for example bookkeeping once paid plans open.

We do not sell personal data, we do not use it for advertising, and we do not use your content to train AI models.

AI features

When you use an AI feature (such as turning text into tasks or breaking a task into steps), the text you ask it to work on and the context it needs (for example your project and tag names) are sent to our AI provider, Anthropic, which returns a suggestion. Anthropic processes this data on our behalf and, under its commercial terms, does not use it to train its models. Speaking a task uses your browser's own speech recognition; thisflow does not receive the audio.

Where your data is stored

The thisflow database and attachments are stored on a server at UpCloud in Stockholm, Sweden. Backups are kept on the same server for 14 days.

We use a small number of service providers (processors) who handle data for us under a data processing agreement:

• UpCloud (Finland): the server and storage, in Sweden.
• Cloudflare: the network in front of thisflow.com and the app (secure connections, DNS and protection against attacks), and the hosting of the website thisflow.com. Traffic passes through Cloudflare's network.
• Amazon Web Services (Amazon SES): sending our emails from Stockholm and receiving email to thisflow in Ireland.
• Anthropic (United States): the AI features, only when you use them.
• Migadu (Switzerland): our own mailbox, when you write to us.
• Google and Slack: only if you choose to sign in with Google or connect Slack. Google also measures visits to thisflow.com, only if you accept analytics or marketing cookies.
• Your browser's push service (for example from Google, Apple or Mozilla): delivers push notifications if you turn them on. The content is encrypted.

When a provider handles data outside the EU/EEA, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Your account and content: for as long as you have an account.
• Tasks in the Trash and removed files: deleted for good 30 days after they were removed.
• A deleted workspace: can be restored for 30 days, then it is gone.
• Emails sent to thisflow: the message itself is deleted once its task is made, and after 7 days at the latest; a record of its message id is kept for 30 days to avoid duplicates; the task it created stays until you delete it.
• Backups: 14 days, after which deleted data is gone from them too.
• Server logs: a short rolling window, kept only to run and protect the service.
• Addresses that bounced or marked our email as spam: kept so we never email them again.

Deleting your account

You can delete your account yourself in Settings → Account. That deletes your personal workspace and every team workspace nobody else is in, with their projects, tasks, comments and files, and your sessions, connections and subscriptions. Work you added to workspaces shared with others stays there, shown as from a former member. Deleted data disappears from backups within 14 days.

Cookies and local storage

thisflow.com asks before it sets any cookie beyond the one that remembers your choice. With your consent, Google Tag Manager runs Google Analytics and, if you allow marketing, Google's ad measurement; until then they set no cookies. The details and how to change your choice are in the cookie policy. The app uses one essential cookie to keep you signed in, and stores your tasks and settings in your browser so it works offline and answers instantly; it has no analytics or advertising cookies.

Your rights

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to how we use it, and to take it with you. You can export your data and delete your account yourself in Settings; for anything else, email us at help@thisflow.com and we will answer within a month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) or the authority where you live.

Security

All traffic is encrypted. Access is checked by role on the server for every change, sign-in uses email links or Google so there are no passwords to leak, and tokens for sharing links and connected services are stored encrypted. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Children

thisflow is not made for children under 16, and we do not knowingly collect their data.

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.