Privacy

What Flowboard stores

Effective September 14, 2026.

Flowboard Studio is a software brand operated from Garner, North Carolina. This notice explains what the Flowboard service collects, why it is used, when service providers receive it, and the choices available to you. It is not a promise of a certification or a substitute for terms agreed in writing.

Local diagrams

The starter diagram and edits made before publishing are stored in your browser's local storage. They are not sent to Flowboard's database.

Accounts

GitHub sign-in provides your GitHub user ID, login, display name, avatar URL, and verified primary email address. Flowboard stores this information to manage sign-in and diagram ownership. Standard sign-in does not request access to your repositories or organizations, and Flowboard does not retain the GitHub OAuth credential.

Repository integration is a separate enterprise administrator action. Its encrypted credential is bound to the consenting company workspace and is used only to list authorized repositories and refs and read source trees for diagram generation. Repository content is not written. Generated diagrams retain provenance (repository, ref, commit, and included source paths), while credentials are never included in diagrams, logs, or API responses. Administrators can revoke the connection from the company profile; disabling it also deletes the stored credential.

Published diagrams

When a signed-in user presses Publish, Flowboard stores the diagram and associates it with that account. Individual diagrams can be public, private, or shared with email addresses. An invited email address is stored with the diagram access policy so a recipient who signs in or signs up with the same email can view it. Company diagrams can additionally use company sharing and administrator policies.

API keys

Personal API keys are shown once. Flowboard stores a cryptographic hash of the key, its owner, creation time, and last-used time. Keep keys private.

Service operation

Normal server logs may contain request paths, timestamps, status codes, IP addresses, browser or device information, and network information needed to operate, troubleshoot, prevent abuse, and secure the service. Flowboard does not sell personal information or use diagram content for advertising.

Product activation measurement

Flowboard records a small set of product milestones: editor opening, demo start, meaningful edit, published diagram, sharing, collaborator visit, and return visit. Events contain a pseudonymous browser journey ID or internal account ID, account cohort, timestamp, and a self-traffic flag. They never contain diagram titles or content, repository content, email payloads, API keys, or access-policy values. Administrator reports show distinct-participant counts for events within the past 90 days. Older event records are removed when new events arrive; they may remain longer if no new events arrive. Platform administrator activity is excluded from reports by default.

Your choices

Product measurement respects your browser's Do Not Track setting. You can also disable it here for this browser. This clears local measurement identifiers without deleting your diagrams; it does not delete previously received events.

You can use the local editor without signing in. Delete local work through your browser's site-data controls. Signed-in users can delete their published diagrams from My diagrams.

Private support requests

When structured support intake is enabled, a signed-in request stores its category, subject, message, account ID, timestamps, triage state, assigned administrator and optional follow-up consent. Only the requester and authorized administrators can retrieve requests. Follow-up consent can be withdrawn on the support page; it does not authorize marketing. Check request status on the support page or email support directly. The browser keeps a request fingerprint and retry identifier in session storage, not the message body, to avoid duplicate submissions. Contact support for account deletion and retention requests.

Billing and canceled workspaces

Stripe processes Team payments, fraud checks, refunds, and the billing portal. Stripe may collect contact, billing, payment-method, transaction, device, and network information under its own privacy terms. Flowboard stores the billing identifiers, subscription status, purchased seats, transaction status, and billing-period dates needed to manage workspace access and accounting. Full payment-card details are entered through Stripe's hosted pages and are not stored by Flowboard.

After a Team subscription is canceled, authorized users have 90 days to read and export the workspace. You may request earlier deletion through support. Cleanup removes the canceled workspace's retained architecture; personal diagrams and other workspaces are unaffected. Billing records are retained separately for accounting. Backup copies expire separately, so deletion from the active service does not mean every backup copy disappears immediately.

How information is used and shared

Flowboard uses information to provide accounts and workspaces, save and share diagrams, operate subscriptions, answer support requests, measure basic activation, prevent abuse, secure and troubleshoot the service, comply with law, and enforce agreements. Information is disclosed only as needed to service providers supporting those purposes, to workspace members according to the sharing choices you make, during a business reorganization, or when legally required. Current core providers include GitHub for account sign-in and Stripe for billing. An identity provider or repository host receives data only when an organization administrator configures that integration.

Retention and deletion

Published content and account records are kept while the account or workspace is active and as needed to provide the service. Support records, security logs, audit history, billing records, and backup copies may be retained longer where reasonably needed for support, fraud prevention, security, accounting, dispute resolution, or legal obligations. Product activation events are intended for a 90-day reporting window as described above. Exact backup-expiration and statutory accounting periods can differ from active-service deletion. Flowboard will not claim that data has been erased from systems or providers it does not control.

Your privacy requests

You may ask to access, correct, export, or delete personal information associated with your account, or object to product measurement. Flowboard may need to verify your identity and authority over a workspace before acting. Some information may be retained where required for security, accounting, disputes, or law. If Flowboard cannot fulfill a request, the response will explain why. Authorized agents should identify the person they represent and provide proof of authority.

Children and international use

Flowboard is a business software service and is not directed to children under 13. Do not create an account for a child or submit children's personal information. Flowboard is operated from the United States; information submitted from another country will be processed in the United States and by the providers described above.

Changes to this notice

Material changes will be posted here with a new effective date. If a change materially affects active account data, Flowboard will provide an additional in-product or account notice when practical.

Security and procurement

Flowboard does not currently claim SOC 2, ISO certification, a guaranteed response time, dedicated tenancy, or guaranteed data residency. Contact us before relying on a security, procurement, retention, or hosting commitment that is not included in a written agreement.

Contact

Questions or privacy requests can be sent to support@flowboard.studio. Postal contact: Flowboard Studio, Garner, North Carolina 27529, United States.