Privacy Policy

1. Who we are

FreeFlow runs FreeFlow and is responsible for the personal data described here. Contact us at support@freeflow.surf.

2. What we collect

• Account details: your name and email address. Your password is stored only as a one-way hash (scrypt), so we can't read it.
• API keys: we store a hash of each key plus its first and last few characters so you can tell them apart. We can't see your full keys.
• Usage records: for each model request, the model, the number of input and output tokens, the cost against your credit, the time, and which key made it. This is how your credit and dashboard work.
• Cookies: an essential cookie that keeps you signed in, and, if you arrived from a link with a campaign tag (like ?ref=youtube), a cookie that remembers that tag for 60 days so we know which posts and videos bring people to FreeFlow. It's saved with your account if you sign up. We don't use advertising cookies.
• Server logs: our hosting provider records technical details of requests, such as IP address, browser type and the page requested, for security and to fix problems.
• Messages you send us, such as support emails.

3. Your prompts and code

We don't store the content of your prompts, files or model responses. When the Harness makes a request, the conversation (including any file contents the agent read) passes through our server to the model you chose and back. We keep only the usage record described above.

To answer a request we send it to OpenRouter, which routes it to the model's provider (for example Anthropic, OpenAI or DeepSeek). They process it under their own privacy terms, which may include keeping it for a limited time for safety and abuse monitoring.

4. The Harness app

The Harness stores your settings, task history and API key on your own computer. The key is encrypted with your operating system's secure storage where available. Deleting the app's data removes them.

The sponsor card in the Harness is fetched from our server without your account details or any other identifier, and ads aren't chosen using your personal data. If you click an ad, the advertiser's site has its own privacy policy.

5. How we use your data

• To run your account, the Harness and the API, and to track your weekly credit.
• To keep the Service secure and prevent abuse, such as duplicate accounts or leaked keys.
• To answer your messages and tell you about important changes to the Service.
• To meet legal obligations.

6. Who we share it with

We don't sell your personal data. We share it only with providers that help run FreeFlow:

• our website host and database provider, which store the data described above;
• our email provider, which sends account emails like verification and password-reset links;
• OpenRouter and the model providers, which receive the requests you make in the Harness;
• authorities, when the law requires it;
• a buyer or successor, if FreeFlow is sold or merged, under this policy.

7. How long we keep it

We keep your account details, keys and usage records until you delete your account. Deleting it in Settings removes them straight away; copies in backups are removed within a limited period. Server logs are kept by our host for a short period set by them.

8. Your choices and rights

You can see and change your name, revoke keys, view your usage and delete your account from the dashboard. Depending on where you live (for example under the GDPR or California law), you may also have the right to access, correct, export or delete your data, or to object to some uses. Email support@freeflow.surf and we'll respond within the time the law requires.

If you're in the EU or UK, you can also complain to your local data protection authority.

9. Security

Passwords and API keys are stored as hashes, connections use HTTPS, and access to our systems is limited. No system is perfectly secure, so please use a strong, unique password and keep your keys private.

10. Children

FreeFlow isn't for children under 13. If you believe a child has created an account, contact us and we'll delete it.

11. International transfers

Our providers may process data in countries other than yours, including the United States. Where the law requires, we rely on safeguards such as standard contractual clauses.

12. Changes to this policy

If we change how we handle personal data, we'll update this page and its date, and give notice of significant changes on the website or by email.