Skip to content

Privacy Policy

Your privacy is important to us. Learn how we protect your data.

Last updated:

Information We Collect

Flow Builder is designed with privacy in mind. We collect minimal information to provide you with the best possible experience:

  • Local Storage: Your yoga flows and preferences are stored locally on your device, in your browser (web app) or on-device storage (iOS and Android apps). We do not have access to this data.
  • iCloud Data (iOS): If you subscribe to a plan that includes iCloud Sync, your flows and settings are synced via Apple's iCloud service. This data is stored in your personal iCloud account and is governed by Apple's Privacy Policy. We do not have access to your iCloud data.
  • Cloud Sync (Android and Web): On Android and in the web app, you may optionally sync your data via Google Drive or Dropbox. When enabled, your data is stored in your personal cloud account. On Android, this includes your flows, sequences, custom pose details (not photos), pose notes and practice session data (including heart rate samples), plus any achievements, breath presets and settings you choose to sync. In the web app, it includes the data types you choose to sync: flows, sequences, custom pose details (not photos), practice history, breath presets, achievements, pose notes and settings. We authenticate using OAuth 2.0 and only access app-specific storage. We do not access any other files in your cloud accounts. In the web app, sign-in tokens are kept in your browser's local storage. For Google Drive, the sign-in code and refresh token pass through a Flow Builder server function only so it can add the app's Google credentials and return the tokens to your browser; the function does not store or log them. Dropbox sign-in goes directly between your browser and Dropbox. When you connect Google Drive on Android, your Google account email is shown in the app's settings so you know which account is linked; it is not sent to us. To reconnect sync automatically on a new Android device, the app saves a restore sign-in with Android's credential manager that records which provider you linked; it contains no access token and gives no access to your files.
  • iCloud Sync (Web): On the web app, syncing with iCloud is optional. When you turn it on, the data types you choose to sync (your flows, sequences, custom pose details (not photos), practice history, breath presets, achievements, pose notes and settings) go only to your own private iCloud database through Apple's CloudKit, and are governed by Apple's Privacy Policy. Flow Builder (AJA Digital) can't read this data. For now, iCloud on the web syncs between your browsers and is not yet shared with the iPhone and Mac apps. To keep you signed in, Apple's CloudKit JS keeps its sign-in session in your browser, and to notice if you switch Apple Accounts the web app stores an opaque Apple user identifier there. It never receives your email address or name. You can disconnect at any time in Settings.
  • Health Data and Health Connect (Android): Connecting Android Health Connect is optional. The app only accesses Health Connect after you grant permission on Android's Health Connect screen, and it requests only the two permissions below:
    • Read heart rate: The app asks for this permission only when you tap Show heart rate on a past session's Heart Rate card (Insights > tap a session). It then reads the heart rate recorded in Health Connect (for example, by a paired watch) during that session's start and end time and shows its average, peak, low and timeline. That read is only displayed and is not saved, synced or sent anywhere. If you have already allowed heart rate access and Health Connect is turned on in the app's settings, the practice player also shows your live heart rate during a session (it never asks for the permission itself) and saves the heart rate samples it read (time and beats per minute) and the session's average, minimum and maximum heart rate with that practice session in your on-device history. The app reads heart rate only for a practice session's time window, never in the background (it does not request background or history access), and never writes heart rate to Health Connect.
    • Write exercise sessions: When you finish a yoga flow, meditation or breathwork session, the app writes an exercise session (start and end time, activity type, title, and your phone's make and model as the recording device) to Health Connect so your practice appears alongside your other activity. It does not read exercise sessions back.
    How we use and share it: Health Connect data is used only to provide these practice features. It is not sent to our servers, is not used for advertising, marketing or profiling, is not sold, is not transferred to data brokers or information resellers, is not used to determine credit-worthiness, insurance or lending eligibility, is not shared with third parties, and is not read by people unless you choose to send it to us yourself. If you turn on Cloud Sync, your practice sessions, including their saved heart rate samples, are copied to your own Google Drive or Dropbox app storage over an encrypted (HTTPS) connection; we cannot access that storage. Like the app's other on-device data, your saved sessions may also be included in Android's own device backup to your Google account if you have device backup turned on. Saved heart rate also leaves the device if you choose to export it yourself: a backup file you export includes your sessions' heart rate samples, and a statistics CSV export includes each session's average, maximum and minimum heart rate. Our use of information received from Health Connect adheres to the Google Play Health Connect permissions policy, including its Limited Use requirements.
    Your controls: You can revoke either permission at any time in Android Settings > Health Connect (or the Health Connect app); this stops all further access. Turning off Health Connect in the app's settings stops the app from writing sessions to Health Connect and stops the player's live heart rate and the automatic heart rate on past sessions; to stop it reading heart rate entirely (including when you tap Show heart rate), revoke the permission as described above. To delete heart rate samples the app has saved, use Clear All Statistics in the app's Insights screen; when Cloud Sync is on, the synced copy is updated the next time the app syncs. You can also delete the synced copy yourself from your Google Drive (in Drive's settings, under Manage apps, choose Delete hidden app data for the app) or your Dropbox Apps folder. Exercise sessions the app wrote to Health Connect can be deleted in the Health Connect app.
  • Apple Health (iOS): Connecting Apple Health is optional and needs your permission. If you allow it, the iOS app saves completed yoga flows to Apple Health as workouts and meditation sessions as mindful minutes. When you open a past session, it reads the heart rate Apple Health recorded during that session to show it in the session details; that heart rate is only displayed, and the app does not save or sync it. If you use the Apple Watch app, it runs a workout on your watch during practice so the watch can show your live heart rate and save the workout to Apple Health. Health data is not sent to our servers, is not used for advertising, and is not sold or shared with third parties.
  • Posture Tracking (Android): With your permission, the Android app uses your device's accelerometer and gravity sensors to provide real-time posture feedback during practice. Posture metrics (posture score, duration, and correction count) are stored locally on your device as part of your session history. Sensor data is processed entirely on-device and is never transmitted to our servers.
  • Subscription & Purchase Data: If you subscribe to a paid plan through the iOS app or Android app, your purchase is processed entirely by Apple (App Store) or Google (Google Play). We do not collect or store your payment information. The platform may share a transaction receipt with us to verify your subscription status.
  • Camera & Microphone: Premium features such as Pose to Flow and Voice to Flow require camera or microphone access. Camera frames are processed entirely on your device and are never uploaded. Voice commands are turned into text by your device's or browser's speech recognition service, on-device whenever it supports that; otherwise that service (for example, Apple's or Google's) may process the audio under its own privacy policy. Only the recognized words are used, on your device, to find poses, and Flow Builder never uploads audio to us. The Android app does not record or save audio. In the iOS and web apps, Voice to Flow can keep a recording of your session so you can export it, and the iOS app saves it with the flow only if you turn on that setting; these recordings stay on your device unless you export or share them.
  • Photos for Custom Poses (Android): If you add a photo to a custom pose (taken with the camera or picked from your photos), the image is stored only on your device (and in any backup file or pose pack you choose to export). It is not uploaded to us and is not included in Cloud Sync.
  • Bug Reports (iOS and Android): If you choose to send a bug report from the app, we receive what you type, an optional screenshot you attach, and basic diagnostics (app version, device model, operating system version, language setting and subscription tier). The report is delivered to our inbox through the FormSubmit.co email relay. If that fails, the app opens an email to us in your own email app instead. On Android, that email may also include technical details of the app's most recent crash (such as the stack trace, time and device model), which the app otherwise keeps only on your device. We use bug reports only to diagnose and fix problems and to reply to you.
  • Contact Information: When you contact us through our contact form or email, we collect your name and email address to respond to your inquiry.
  • Usage Analytics: We may collect anonymous usage statistics to improve our service, but this data cannot be linked back to you personally.
  • Facebook SDK (iOS): The iOS app includes the Meta (Facebook) SDK to support advertising attribution, install measurement, and app analytics. When you use the iOS app, the Facebook SDK may automatically collect and transmit the following information to Meta:
    • Device identifiers (such as the Identifier for Advertisers (IDFA), if you grant App Tracking Transparency permission, or an anonymized device identifier if you do not)
    • Device information (model, operating system version, language, time zone, country)
    • App events (such as app installs, app launches, in-app purchases, and subscription activity)
    • IP address (used by Meta for approximate location and fraud prevention)
    In compliance with Apple's App Tracking Transparency (ATT) framework, the iOS app will request your permission before enabling tracking. If you decline tracking, the IDFA is not shared and Meta receives only limited, non-personalized event data. Data collected by the Facebook SDK is governed by Meta's Privacy Policy and is used by Meta to measure ad performance, attribute installs, and provide aggregated analytics. We use this data solely to understand how users discover Flow Builder and to improve our marketing. You can opt out at any time by revoking the App Tracking Transparency permission in your device's Settings > Privacy & Security > Tracking.

How We Use Your Information

We use the information we collect for the following purposes:

  • To provide and maintain the Flow Builder service across web, iOS, and Android
  • To verify and manage your subscription status
  • To respond to your questions and provide customer support
  • To improve our service and develop new features
  • To communicate with you about updates or important notices

Data Storage and Security

Your privacy and security are our top priorities:

  • On-Device Storage: Your yoga flows, practice sessions, and health metrics are stored locally on your device, in browser storage (web) or app storage (iOS/Android). This data never leaves your device unless you enable cloud sync, explicitly export it, or (on Android) it is included in your device's own backup to your Google account.
  • iCloud Sync (iOS): When enabled, your data is synced through Apple's iCloud infrastructure using end-to-end encryption. We cannot read or access your synced data.
  • Cloud Sync (Android and Web): When enabled, your data (on Android, including practice sessions and health metrics) is synced to your personal Google Drive or Dropbox account. Data is transmitted securely over HTTPS and stored within your own cloud storage account.
  • iCloud Sync (Web): When enabled, your data is stored only in your own private iCloud database through Apple's CloudKit, over HTTPS. We cannot read or access it, and you can disconnect at any time.
  • No Account Required: You don't need to create an account or provide personal information to use Flow Builder.
  • Secure Communications: All communications with our servers use industry-standard encryption (HTTPS).
  • No Data Sales: We never sell, rent, or share your personal information with third parties for marketing purposes.

Subscriptions

Flow Builder offers auto-renewable subscriptions through the Apple App Store and Google Play Store:

  • Subscriptions are billed monthly or yearly, depending on the plan you choose, and renew automatically at the end of each billing period unless canceled at least 24 hours before the end of the current billing period.
  • Payment is charged to your Apple ID or Google account at confirmation of purchase.
  • You can manage or cancel your subscription at any time in your device's Settings > Subscriptions (iOS) or Google Play > Subscriptions (Android).
  • All payment processing is handled by Apple or Google. We do not collect, store, or have access to your payment details.
  • Subscription use is governed by Apple's Standard EULA (iOS) or Google Play Terms of Service (Android).

Cookies and Tracking

Flow Builder uses minimal tracking technologies:

  • Essential Cookies: The web app uses only essential cookies required for the website to function properly.
  • Web & Android: We do not use third-party advertising or tracking services on the web app or Android app.
  • iOS (Facebook SDK): The iOS app includes the Meta (Facebook) SDK for advertising attribution and install measurement. Tracking is governed by Apple's App Tracking Transparency framework — the app will ask for your permission before enabling tracking, and you can revoke it at any time in your device's Settings > Privacy & Security > Tracking. See the Facebook SDK section above for details on what data is collected.
  • Local Storage: We use browser local storage (web) and on-device storage (iOS/Android) to save your flows and preferences.

Third-Party Services

Flow Builder may integrate with the following third-party services:

  • Apple App Store: Subscription purchases and management on iOS are handled by Apple.
  • Google Play Store: Subscription purchases and management on Android are handled by Google.
  • Apple iCloud: Cloud sync for iOS subscribers, and optional iCloud sync on the web app, is provided through Apple's iCloud service (CloudKit). On the web, only your own private iCloud database is used.
  • Google Drive & Dropbox: Cloud sync on Android and in the web app is optionally provided through Google Drive or Dropbox. We use OAuth 2.0 authentication and only access app-specific storage within your account.
  • Android Health Connect: With your permission, the Android app reads heart rate data from and writes exercise sessions to Health Connect. Health Connect data access is governed by Google's Health Connect permissions policy.
  • Apple Music (MusicKit): If you connect Apple Music on iOS, we access your library metadata to sync music with your flows. We do not store or transmit your music data.
  • Meta (Facebook SDK) — iOS only: The iOS app integrates the Meta SDK for advertising attribution, install measurement, and aggregated analytics. Data shared with Meta is governed by Meta's Privacy Policy. Tracking requires your consent under Apple's App Tracking Transparency framework and can be revoked at any time in your device's Settings.
  • Email: Contact form submissions may use your device's default email client.
  • FormSubmit.co: Bug reports you send from the iOS or Android app are relayed to our inbox by FormSubmit.co, which processes them only to deliver the email.
  • WorldTimeAPI: On Android, if your plan does not include unlimited statistics, the app checks the current date with worldtimeapi.org to count monthly statistics views. The request contains no personal data; like any web request, it reveals your IP address to that service.

Your Rights and Choices

You have full control over your data:

  • Access: You can view all your stored flows directly in the application.
  • Export: You can export your flows and session data at any time. On Android, exported backup files and statistics CSVs include any heart rate saved with your sessions.
  • Delete: You can delete individual flows, session history, or clear all data from the app or browser.
  • Permissions: On iOS and Android, you can revoke camera, microphone, Health Connect, sensor, or other permissions at any time in your device's Settings.
  • Health Data Control: On Android, you can turn off Health Connect (which stops writing sessions and the player's live heart rate), and turn off posture tracking, at any time in the app's settings. To stop the app reading your heart rate entirely, revoke its Health Connect permissions in your device's Settings > Health Connect. On iOS, you can change what the app may read from or save to Apple Health in the Health app or in Settings > Health > Data Access & Devices.
  • Tracking Control (iOS): On iOS, you can grant or revoke App Tracking Transparency permission at any time in your device's Settings > Privacy & Security > Tracking. Revoking tracking limits the data shared with Meta via the Facebook SDK.
  • Subscriptions: You can manage or cancel subscriptions in Settings > Subscriptions (iOS) or Google Play > Subscriptions (Android).
  • Contact: You can contact us at daniel@flowbuilder.yoga for any privacy-related questions.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

  • Update the "Last updated" date at the top of this page
  • Notify users of significant changes through the application or website
  • Continue to protect your data according to the principles outlined in this policy

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: daniel@flowbuilder.yoga

Website: flowbuilder.yoga