FLOWIndustries

Privacy Policy

Last updated October 5, 2026

This Privacy Policy explains what information Flow Industries ("Flow", "we", "us") collects when you use our services — including the Flow game (flow.game (opens in new tab)), Flow ID (id.flow.industries (opens in new tab)), this website, our documentation, and related applications (together, the "Services") — and how we use, share, and protect it.

We are privacy-minded by design: we collect only what we need to run the Services, we host our own analytics rather than handing your activity to third-party advertising networks, and we never sell your personal information.

1. Information we collect

We collect the following categories of information, most of it directly from you when you create an account or use the Services:

  • Account information. The username and display name you choose, your email address, an optional profile picture (avatar), and your newsletter preference.
  • Authentication data. You can sign in with a passkey (WebAuthn), a one-time code sent to your email, a Bluesky / AT Protocol account, or a Google account. For each passkey you register we store the public key, credential identifier, authenticator model identifier (AAGUID), sign counter, and device and transport metadata. We never see or store your passwords, biometrics, or any private key — those never leave your device.
  • Connected accounts. When you sign in with or connect a Google, GitHub, or Bluesky / AT Protocol account, we receive the account identifiers and, where needed, the access tokens described in section 3.
  • Wallet & blockchain identifiers. A blockchain wallet address is derived from your passkey's public key and stored with your account. We do not custody funds or private keys.
  • Technical, session & security data. When you sign in or make requests, we record session tokens, your IP address, your browser's user-agent string, an approximate location (country) derived from your IP address, and timestamps. We use this to keep you signed in, secure accounts, and enforce rate limits against abuse.
  • Usage analytics & diagnostics. We operate our own analytics and error-monitoring (self-hosted, not a third-party ad platform). This captures page views, performance and load timings, errors, approximate location (country), and a per-session identifier. On some of our web pages we also record anonymized session replays to diagnose usability issues; form inputs (including anything you type) are masked and not captured.
  • Gameplay data. During multiplayer sessions, your gameplay state (such as position and movement) and your Flow user identifier are exchanged with our game servers and other players in the same match so the game can function.
  • Communications. If you contact us (for example, by email), we keep your messages and contact details to respond.

2. How we use your information

  • To create and manage your account and keep you signed in.
  • To provide, operate, and improve the game and other Services.
  • To verify your email address and send transactional messages (such as one-time sign-in codes).
  • To protect the Services — detecting and preventing abuse, fraud, and security incidents, and enforcing rate limits.
  • To send you our newsletter, only if you have opted in. You can unsubscribe at any time.
  • To understand how the Services are used so we can fix bugs and make them better.
  • To sign you in with, or connect, the Google, GitHub, or Bluesky / AT Protocol accounts you choose, as described in section 3.
  • To comply with legal obligations.

3. Google, GitHub & Bluesky accounts

Flow ID lets you sign in with, or connect, accounts you already have with other providers. This section explains exactly what we receive from each one, how we use and store it, and how to remove it.

Google user data

When you choose “Continue with Google”, Google shares with Flow ID your Google account ID, your name, and your email address together with whether Google has verified it. Flow ID requests only Google's basic sign-in permissions (openid, email, and profile). It cannot access your Gmail, Google Drive, contacts, calendar, or any other Google data.

  • How we use it. Only to sign you in; to create your Flow account the first time you sign in with Google (your name becomes your display name and suggests your username, and a verified email becomes your account email if no other Flow account uses it); and to show which Google account is connected on your account page. We never link your Google account to an existing Flow account because an email address matches.
  • How we store it. We store your Google account ID linked to your Flow account, and your name and email as part of your Flow account. We do not keep Google access or refresh tokens after sign-in completes.
  • How we share it. We do not sell Google user data, use it for advertising, or transfer it to third parties, except to the infrastructure providers listed in section 6 that host the Services, or when required by law. We do not use Google user data to develop, improve, or train artificial intelligence or machine learning models.
  • Human access. Our team does not read your Google user data except with your permission, to investigate security incidents or abuse, or to comply with the law.
  • Retention & deletion. We keep the link to your Google account while Google sign-in is connected to your Flow account. You can disconnect Google from the Login section of your Flow ID account page (opens in new tab) (if you have another way to sign in), which deletes the stored Google account ID; deleting your Flow account also deletes your name and email. You can also remove Flow ID's access at any time in your Google Account settings (opens in new tab), or ask us to delete your data at [email protected].

Flow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (opens in new tab), including the Limited Use requirements.

GitHub

If you connect GitHub from your Flow ID account page, GitHub shares your GitHub user ID and username and issues Flow ID an access token limited to the permissions you approve. Flow ID first asks only for basic profile access (read:user) and asks you again before a feature needs more, such as access to your repositories. Your account page lists every permission you have granted.

  • How we use it. The token is used only to carry out the GitHub actions that you, or a Flow app acting at your request, ask for — such as reading your repositories, issues, and pull requests, or creating and updating issues, comments, and files — within the permissions you granted.
  • How we store it. The token is encrypted at rest on Flow ID's servers. It is never sent to your browser or to Flow apps, and it is never written to logs.
  • Deletion. Disconnecting GitHub, or deleting your Flow account, revokes the token at GitHub and deletes it. You can also revoke access at any time in your GitHub application settings (opens in new tab).

Bluesky & AT Protocol

If you sign in with, or connect, a Bluesky or other AT Protocol account, we store its decentralized identifier (DID) and handle, and the OAuth tokens your provider issues, encrypted at rest. We use them to sign you in and, only when you approve it, to read and write Flow data such as notes in your AT Protocol repository. Disconnecting the account or deleting your Flow account deletes the stored tokens.

5. Cookies & similar technologies

We use a small number of strictly necessary cookies to keep you signed in and to secure the authentication flow. These are essential to provide the Services and cannot be turned off without breaking sign-in. We do not use advertising or cross-site tracking cookies. Our session cookies are set as secure and (in production) partitioned.

6. How we share information

We do not sell your personal information and we do not share it with advertising networks. We share information only with the service providers that help us run the Services, and only as needed:

  • Cloudflare — content delivery, DNS, TLS, DDoS protection, and object storage for avatars. Cloudflare processes request metadata including IP addresses.
  • Resend — delivery of transactional and newsletter email; receives your email address and message contents.
  • Google, GitHub, and Bluesky / AT Protocol servers — only when you choose to sign in with or connect those accounts, to complete sign-in and the actions you request (see section 3).
  • Blockchain networks — when you perform on-chain actions, the relevant data is broadcast to public blockchain infrastructure (see below).
  • Legal & safety — we may disclose information if required by law, or to protect the rights, safety, and security of our users, the public, or Flow.

Our analytics, logs, and error monitoring are self-hosted on our own infrastructure and are not shared with third-party analytics vendors.

7. Blockchain & wallet information

Your wallet address and any transactions you make on a public blockchain are, by the nature of the technology, public, permanent, and outside our control. Anyone can view on-chain activity associated with your wallet address. We cannot edit, delete, or reverse data once it is recorded on a public blockchain.

8. Data retention

We keep account information for as long as your account is active. Temporary guest accounts that are never upgraded are periodically deleted. Operational logs, analytics, and diagnostic data are retained for a short window (currently about 14 days) and then deleted or aggregated. Sessions expire automatically. Tokens for connected accounts are deleted when you disconnect that account or delete your Flow account. When you ask us to delete your account, we delete or anonymize your personal information except where we must keep it to meet a legal obligation.

9. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. If you are in California, we do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and you may exercise your rights without discrimination.

To exercise any of these rights, email [email protected]. We may need to verify your identity before acting on a request. You can also unsubscribe from the newsletter at any time using the link in any newsletter email.

10. Security

Flow ID has no passwords to steal or reuse: you sign in with a passkey, a one-time email code, or an account you already use (Bluesky / AT Protocol or Google). Tokens for connected accounts are encrypted at rest. Traffic is encrypted in transit, and identity-bearing telemetry is kept on our own infrastructure rather than the public edge. No system is perfectly secure, but we work to protect your information using reasonable technical and organizational measures.

11. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us personal information, contact [email protected] and we will delete it.

12. International users

Flow is operated as a global service, and your information may be processed in countries other than your own, including by the service providers listed above. By using the Services, you understand that your information may be transferred to and processed in such locations.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and for material changes we will provide additional notice where appropriate. Your continued use of the Services after an update means you accept the revised policy.

14. Contact us

For any privacy questions or requests, contact us at [email protected]. See also our Terms of Service.