Privacy Policy

Makerflow stores your email address, whatever you type into the app, and enough about your subscription to know whether you have one.

• There is no analytics and no tracking of any kind.
• There are no advertising networks, and no third-party scripts on the app.
• The only cookie is the one that keeps you signed in.
• Nothing is sold, rented or shared for anyone else's marketing.
• Your projects, notes and hours are never read for training or product research.

Karim Mortabit, 66 Avenue des Champs-Élysées, 75008 Paris, France, is the data controller for the information described here. For anything in this document, including a request to see or delete your data, write to karim@creativeapps.studio.

Account details — your email address, and your name and profile picture if you sign in with Google. A password sign-up stores only a cryptographic hash, never the password itself. This is what identifies your account, and the legal basis is performing our contract with you.

What you put in the app — projects, tasks, entries, notes, planned and logged minutes, and the log of changes that powers undo and sync. This is the service, and the legal basis is the same contract.

Subscription details — a Stripe customer reference, a subscription reference, its status, the price and the renewal date. This is how the app knows you are on Pro. No card number, expiry or security code is ever stored by us or ever reaches our servers.

Operational logs — our hosts keep short-lived technical records such as IP addresses and error traces, which is how outages get diagnosed. The legal basis is our legitimate interest in keeping the service working and secure.

No behavioural analytics, no session recording, no heatmaps, no fingerprinting and no advertising identifiers. No third-party analytics or advertising script runs on this site or in the app.

The only cookie set is the session cookie that keeps you signed in. It is strictly necessary for the service to work, which is why there is no cookie banner asking you to accept anything — there is nothing optional to accept.

A small number of providers handle data on our behalf, each under a contract that limits them to doing so on our instructions:

• Convex — the backend and database that stores your account and everything in it. Data is held in the European Union.
• Vercel — hosting and delivery of the website and app.
• Stripe — payments, subscriptions and invoicing. Stripe receives your email address and acts as merchant of record; it is an independent controller for its own fraud-prevention and compliance duties.
• Google — only if you choose to sign in with Google, and only to confirm your identity.
• Resend — only to deliver a password-reset email, if you ask for one.

Where a provider processes data outside the European Economic Area, that transfer relies on the European Commission's standard contractual clauses or an adequacy decision.

Beyond these, information is disclosed only where the law requires it — and if a business is ever sold or transferred, you will be told before anything moves.

Your account and its contents are kept for as long as the account exists. Delete the account and they are erased within thirty days, apart from backups, which age out within a further ninety.

Invoices and payment records are kept for as long as tax and accounting law requires — generally between six and ten years depending on the country. That obligation outlives the account, and it is the one thing deletion cannot reach.

If you are in the EEA or the UK, the GDPR gives you the right to see the data held about you, correct it, delete it, restrict or object to its processing, and receive it in a portable form. Where processing rests on consent, you can withdraw it at any time.

Exercise any of these by writing to karim@creativeapps.studio. We will reply within thirty days, and we will not charge you or make the service worse for asking.

You can also export your logged hours yourself, as a CSV file, from the settings page.

If you think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first.

Traffic is encrypted in transit, data is encrypted at rest by our hosting providers, and passwords are stored only as hashes. Access to production data is limited to the one person who runs the service.

No system is perfectly secure. If a breach ever affects your data, you will be told without undue delay, along with what happened and what to do about it.

Makerflow is not intended for children under sixteen and we do not knowingly collect their data. If you believe a child has created an account, write to us and it will be removed.

If this policy changes in a way that affects you, the date at the top changes and we email the address on your account before it takes effect.