Privacy Policy

Who we are

Flowproof is a product of The Sky Floor, LLC, a Michigan limited liability company. In this policy, “Flowproof”, “we” and “us” mean that company.

Flowproof lets a coding agent test the emails an app sends. It hands out throwaway addresses at flowproof.dev, receives the mail sent to them, grades it, and then deletes the test users it created. We also run a free Email Flow Grader that anyone can use without an account.

For your own account details, we decide how they are used (we are the controller). [Lawyer to confirm: our role for the test data a customer points Flowproof at (controller or processor), and whether agency customers need a Data Processing Agreement before launch]

The short version

• We keep what we need to run tests, show you results, and bill you. We don’t sell data.
• Credentials you give us for cleanup are encrypted, and cleanup can only ever delete the test addresses a run created.
• Test emails are deleted first; reports are kept longer. How long depends on your plan.
• When AI review runs, the wording of your test emails (with links, codes and addresses removed) goes to Anthropic’s API, and a copy of each kind of email (with links, codes and addresses blanked) goes to Postmark’s spam filter for a spam score.
• We keep one anonymous result per finished run for published research. You can turn that off for your runs.
• No advertising or analytics cookies.

What we collect

Your account

Your email address, and a name if you give one. We use it to sign you in (by emailed link, no password), to contact you about your account, and to show you your data. We also keep your plan and when it ends. If you sign in with GitHub, we get your GitHub email address, name and avatar URL, and nothing from your repositories.

API keys and tokens

When you create an API key, we store only a fingerprint of it (a one-way hash) and a short prefix so you can tell keys apart. We can’t show a key again, and a leaked database copy would not reveal it. Test checkout tokens are stored the same way.

Credentials for cleanup

To delete test users, you can connect your own systems (“adapters”). Depending on the kind, you give us a database connection string, a Stripe restricted key, or a signing secret for a WordPress site, webhook or Supabase Edge Function. These are encrypted (AES-256-GCM) with a key only our cleanup service holds. The dashboard can’t read them, and they are kept out of logs and error messages. Removing a connection deletes them.

Test emails

Your agent gives your app addresses like project.session.name@flowproof.dev. Everything sent to those addresses reaches us: the full email, its headers and its links. Test emails often contain live sign-in, verification and reset links, so we treat them as sensitive and delete the bodies first (see How long we keep it). If your app sends test users made-up names or other details, those are in the emails too. Please don’t send real people’s personal data to test addresses.

Reports and run history

For each run we keep what your agent recorded (steps, outcomes), what arrived and when, the checks we ran, the grade, and a record of cleanup. We also keep the list of addresses each run created and every cleanup receipt; both are explained under How long we keep it.

Shared score cards

If you share a run’s score card, we keep a copy of the card as it was when you shared it, so its link keeps working after the run’s history is deleted. A shared score card stays up until you stop sharing it; it never contains test addresses, email contents, links or your project’s name. When you stop sharing, the link stops working and we delete the copy. The link also stops working if the project is archived. If you delete your account, the copy is deleted with it and the link stops working at once. [Lawyer to confirm: this wording]

Flow Watch

If you use Flow Watch, we store the recipe your agent recorded (the steps to replay on your site, with placeholders instead of real addresses or passwords) and the result of each scheduled run. For alerts, we store an email address you choose, or a Slack incoming-webhook URL, which we encrypt because it works like a password.

Email Flow Grader

• No account is needed. Each run gets one temporary address and a 10-minute window.
• The emails your app sends to that address are graded like any other run. Their bodies are deleted after a day.
• If you enter your app’s URL, we keep only its scheme, host and path, and show it on your score card.
• The score card keeps a redacted summary, with links, codes and addresses removed, so its share link keeps working for 12 months after the run, then the card and its link are removed.
• Your email address is optional. You give it only if you want to hear when Flowproof launches, and we never show it on any public page. We delete it after 6 months.
• To enforce a daily limit per visitor, we keep a keyed hash of your IP address (never the address itself) for 24 hours, then erase it. The “verify you’re human” check is Cloudflare Turnstile.

Billing

Payments go through Stripe. Stripe collects and holds your card and billing details; we never see or store your card number. We keep your Stripe customer id, what you bought and when, and the billing events Stripe sends us.

Logs

Our hosting providers (Cloudflare and Vercel) record requests, including IP addresses, as part of running the service. Our own logs record what happened (an event name, an error type), not request bodies, email addresses, keys or tokens. [Founder to confirm: how long Cloudflare and Vercel keep request logs on our plans]

Cookies

We use only the cookies needed to keep you signed in to the dashboard. We don’t use advertising or analytics cookies, and we don’t track you across other sites. Cloudflare Turnstile runs on the sign-up page and the Grader to tell people from bots.

How cleanup works

When a run ends, Flowproof deletes the test users it created from the systems you connected, and writes a receipt of what it did.

• It only ever acts on the exact list of addresses that run created. Never a pattern, a domain match or a wildcard. Real users of your app can’t be on that list, because only Flowproof creates those addresses. The list is checked by the database and again before any delete is sent, and a request that includes anything else is refused as a whole.
• Connections are off until you arm them, which needs a successful connection test and a preview of what would be deleted.
• Every cleanup leaves a receipt: what was sent, to where, and what came back. Receipts can’t be changed or deleted, even by us, so they stay trustworthy if there is ever a question about what was removed.

More detail is in Cleanup and Security.

AI review and the spam check

Reports can include a review of your emails’ wording: whether the next step is obvious, the button text is clear, the subject says what the email is for, and the emails sound like one company. That review is written by an AI model from Anthropic, through Anthropic’s API.

What we send, for up to 12 emails per run:

• the kind of email (for example, verification or password reset);
• the sender’s display name and the subject line;
• the first 1,500 characters of the visible text;
• the words on its buttons and links, but not where they point;
• your project’s name.

Before anything is sent, links are cut down to their host and path (the query string is dropped), and email addresses, one-time codes and anything that looks like a token or key are replaced with placeholders. Email headers, full links and your test addresses are never sent for the wording review.

The same switch covers the spam check. When a run finishes, up to 5 of its emails, one of each kind, go to Postmark’s free spam-check service, which runs the SpamAssassin spam filter and sends back a score. A spam filter reads the whole email, so the whole email is sent, headers included, with every link’s query string and secret-looking parts, any one-time code, and your test addresses blanked first. [Lawyer to confirm: Postmark’s terms for its free spam-check API (what it keeps of submitted mail, and for how long)]

When it runs: once per finished agent run, when your plan has AI reviews left (Free includes 3 in total; paid plans include more; the spam check does not count against them). Neither runs for Email Flow Grader runs, Flow Watch runs, or runs that expired without being ended. You can switch both off for any project, on the project’s page in the dashboard; nothing is sent to either for that project after that. [Lawyer to confirm: how to describe Anthropic’s retention and no-training terms for API data under our agreement with them]

Anonymous research

We keep one anonymous result from each finished test run and each Email Flow Grader run. We use these to publish research about how apps’ emails perform, such as “The State of Signup Emails”.

What a result contains

• the grade and score;
• for each email: its type (for example, verification or password reset), how long it took to arrive, and whether it passed SPF, DKIM and DMARC;
• which automated checks passed or failed;
• which email service sent the mail (for example, Postmark or Amazon SES), worked out from its headers;
• which types of email were expected and which arrived;
• the app type (SaaS, WooCommerce or general) and which Flowproof integrations the project uses (Supabase, WordPress, Stripe);
• counts of links, and how many passed their checks;
• the week it was recorded (never the exact date or time).

What it never contains

Email addresses, domains, names, subject lines, email wording, links, codes, IP addresses, or any account, project or run identifier. It is not linked to your account. Every text value in it comes from a fixed list of words we define, and the database refuses anything else.

How it is published

Only as totals and averages across many results, never row by row, and only when at least 20 results are behind every number we publish.

Your choice

• Your agent runs are included unless you turn it off. You can do that at any time under Your data on the Billing page. That stops future runs from being included.
• Results already recorded can’t be identified as yours, so we can’t find them to remove them.
• Email Flow Grader runs are always included; they are anonymous to begin with. Flow Watch runs are never included.

Legal basis

If you are in the EU or UK: we rely on our legitimate interest in publishing aggregate research about the email industry, using data that is anonymous at the moment it is stored. [Lawyer to confirm: that the stored result is anonymous, not merely pseudonymous, under GDPR. The one caveat: someone with full access to our database who also holds a customer’s stored report could match the two by their details (week, grade, timings) until that report is deleted on the plan’s schedule]

How we use it

• To run the service: create test addresses, receive and grade mail, build reports and clean up.
• To sign you in, keep your account secure, and stop abuse (for example, limits on the Grader).
• To bill you, through Stripe.
• To contact you about your account, a run or a Flow Watch alert you set up.
• To publish anonymous, aggregate research, as described above.
• If you gave your email on the Grader: to tell you when Flowproof launches. You can ask us to stop at any time.

We don’t sell personal data, and we don’t use it for advertising.

[Lawyer to confirm: the legal basis for each use (for example, contract for running the service and billing, legitimate interests for security and abuse prevention, consent for Grader launch emails)]

Emails about using Flowproof

Besides emails about your account and your runs, we send a few product tips: a nudge if your first test hasn’t run a few days after you sign up, and one question about Flowproof a week after your first graded run. At most one every two days, on weekdays. They’re on by default. Turn them off with the unsubscribe link in any of them (no sign-in needed) or under Emails on your Account page. Emails about your account and runs still arrive. [Lawyer to confirm: product tips on by default for account holders (legitimate interests / existing customer)]

Who else handles it

These companies process data for us to run Flowproof:

[Sign-in email provider: Supabase sends sign-in links today; name the email service here once custom SMTP is set up] [Data location: the region of our Supabase project and Cloudflare storage] [Lawyer to confirm: the transfer mechanism for data leaving the EU/UK (for example, Standard Contractual Clauses) and whether we need an EU or UK representative]

If you connect Slack for Flow Watch alerts, alerts are posted to the Slack channel you chose. We may also share data if the law requires it.

How long we keep it

Every run has two clocks, both starting when the run ends. Email bodies, links, headers and the stored email files go first, because they can hold live login links. Reports and run history go later.

• If a paid plan lapses, your data keeps its paid retention for a 14-day grace period, then Free’s applies. Upgrading extends the retention of anything not yet deleted.
• Email Flow Grader runs follow Free’s clocks. See the Grader section above for the rest.
• A shared score card stays up until you stop sharing it; it never contains test addresses, email contents, links or your project’s name. The clocks above don’t delete it. See Shared score cards.
• Kept permanently: cleanup receipts (so there is always a record of what was deleted), the list of addresses each run created, and project names. The last two are never reissued, so nobody else can ever receive mail meant for your old test users. If you delete your account, the address lists go with it; project names stay retired, which is enough to keep those addresses from ever being issued again.
• Anonymous research results are kept indefinitely; they aren’t linked to anyone.
• Your account details are kept while you have an account. Stripe keeps billing records as the law requires.

[Lawyer to confirm: that keeping receipts and address lists permanently is compatible with deletion requests, and what we tell someone who asks us to erase them]

Security

Flowproof holds access to customers’ production systems, so security is most of the design. In short: cleanup credentials and Slack URLs are encrypted, API keys are stored only as hashes, the dashboard can only read your own data, privileged keys never reach a browser, cleanup is limited to the addresses a run created, and receipts can’t be altered. We publish what is not fixed yet as well. Security has the details and how to report an issue.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

Your rights

Depending on where you live, you can ask us to show you the personal data we hold about you, correct it, delete it, give you a copy, or stop or limit how we use it. You can also object to uses based on our legitimate interests, and withdraw consent you gave. You won’t be treated differently for asking.

To ask, email flowproof@theskyfloor.com from the address on your account. We’ll reply within [Lawyer to confirm: response time, e.g. 30 days].

Deleting your account

You can delete your account yourself, under Account in the dashboard, or email us and we will. It deletes, at once and for good: your account details (email and name), projects, runs, test emails (the stored copies within about an hour), reports, the email map, Flow Watch, test hooks, cleanup connections and their encrypted credentials, API keys, connected apps, and shared score cards, whose links stop working. Then your sign-in is deleted and you’re signed out.

It waits until every test user Flowproof created has been cleaned up: not while a run is still open, a cleanup is still running, or a failed cleanup can still be retried. It also waits while a subscription is active; cancel it in Billing first (we don’t cancel it for you). A Flow Pass ends with the account, with no refund for the days left.

What is kept: cleanup receipts, unchanged, because they can’t be edited or deleted by anyone. They hold the project’s name, the addresses that were removed, where the cleanup request went, and an internal account ID that no longer leads to anything in our database. Project names stay retired so they are never reissued. Stripe keeps its records of your payments as the law requires (they carry the same internal ID), and we keep the IDs of the Stripe events we processed. Anonymous research results were never linked to you and stay. [Lawyer to confirm: that keeping receipts (with the internal account ID) and Stripe’s billing records after a deletion is compatible with erasure requests] [Founder to confirm: how long database backups and request logs keep deleted data]

You can turn off the anonymous research dataset yourself under Your data on the Billing page.

If you are in the EU or UK, you can also complain to your data protection authority. [Lawyer to confirm: whether we need state-specific sections (for example California) and the exact wording for “we don’t sell or share personal information”]

Children

Flowproof is a tool for businesses and developers. It is not meant for children, and we don’t knowingly collect data from them. If you think a child has given us personal data, email us and we will delete it. [Lawyer to confirm: the minimum age to use Flowproof (for example 16 or 18)]

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change matters, for example a new kind of data or a new company handling it, we’ll tell account holders by email at least 30 days before it takes effect.

Contact

The Sky Floor, LLC (Michigan)
10611 Maple Grove Rd, Charlevoix, MI 49720
Privacy questions: flowproof@theskyfloor.com
Security issues: see Security.