Privacy Policy

1. Data we collect

Account data: the email address and display name you enter. Your password is salted and hashed on your own device (SHA-256) — the plaintext password never leaves the device and we never receive it, because there is no ThoughtFlow server that holds accounts.

Your Content: the thoughts and entries you capture, stored in your browser's local storage so the app can structure them along the five directions you choose.

Payment data: processed by Flutterwave. We never see or store your full card number — Flutterwave handles it under its own privacy policy.

Usage data: basic, aggregated analytics (pages visited, features used) to improve the Service. No cross-site ad tracking.

AI features: when you use the Being, voice, or research features, the text you submit is sent to our AI provider to generate a response. The provider is instructed not to retain it or train on it.

2. How we use data

To operate the Service, run the structuring features you invoke, process payments, prevent abuse, and communicate with you about your account. We do not sell personal data. We do not use your Content to train AI models without your explicit consent.

3. Sharing

We share data only with: (a) service providers necessary to run the Service — hosting, payments via Flutterwave, analytics; (b) authorities when required by law; (c) a successor in a merger or acquisition, with notice to you.

4. Your rights

You can request a copy or correction of any personal data we hold by emailing support@adascannerpro.com. Because ThoughtFlow is local-first, your Content lives only in your browser: deleting your account in settings erases it immediately, and you can wipe everything at any time by clearing the app's browser storage. We hold no copy of your thoughts on our servers, so there is nothing of yours for us to delete server-side. Billing records are held by Flutterwave under their own policy.

5. Security

Traffic is encrypted in transit (HTTPS). On your device, your data is stored in the browser's local storage — it is not encrypted at rest by the app, so device-level protection (lock screen, full-disk encryption, keeping your browser updated) is what truly guards it. Your password is hashed on-device and only gates the app's sign-in screen; anyone with direct access to your browser's stored data could read it. Use a strong, unique password and tell us promptly if you suspect unauthorized access.

6. Children

The Service is not directed at children under 13. If we learn we hold a child's data, we delete it.

7. Changes

We will notify you of material changes to this policy before they take effect.

8. Contact

Privacy questions: support@adascannerpro.com.