Privacy Policy
Nothing But Flows · Last updated: June 12, 2026
This Privacy Policy explains how Kevin Vu (“we,” “us”), the sole operator of the Nothing But Flows app and website (the “Service”), collects, uses, and shares your information, and the choices you have. By using the Service you agree to this policy.
1. Who we are
Nothing But Flows is a tool for fitness instructors to build, schedule, and share class flows. The Service is operated by an individual developer. For any privacy question or request, contact us at [email protected].
2. Information we collect
We only collect what we need to run the Service:
Account & sign-in
- Your email address — or, if you use Apple’s “Hide My Email,” the private relay address Apple gives us.
- A password if you sign up with email. It is stored securely (hashed) by our authentication provider; we never see or store it in plain text.
- If you sign in with Google or Apple, the name and profile photo that provider shares with us.
Profile
- Your display name, an optional short bio, an avatar, and your account creation date.
Content you create
- Flows, moves, class schedules, studio names, studio memberships and roles, invite codes, and any notes you add.
Usage analytics
- We use PostHog to understand how the app is used. It records in-app events — for example creating, opening, or deleting a flow; adding a move; scheduling, starting, or marking a class as taught — associated with your account identifier and email, along with basic device/platform information.
Diagnostics & crash reports
- We use Sentry to detect and fix crashes. Crash and error reports may include your account identifier and email, device and operating-system information, and technical details about what went wrong.
Automatically collected
- Our service providers process standard technical data such as IP address, device identifiers, and timestamps to deliver and secure the Service.
We do not collect your location, contacts, health data, camera, or microphone. We do not show third-party ads.
3. How we use your information
- To provide the Service — create your account, authenticate you, and store and sync your flows and profile.
- To enable studios — let you create or join a studio and share flows with your team.
- To improve the app — understand which features are used (analytics) and fix crashes (diagnostics).
- To keep the Service secure and prevent abuse.
- To communicate with you about your account (e.g. password resets).
4. Legal bases (EU/UK users)
Where the GDPR applies, we rely on: performance of a contract (to provide the Service you signed up for), our legitimate interests (to secure and improve the app, balanced against your rights), your consent where required, and compliance with legal obligations.
5. How we share information
We do not sell your personal information and do not share it for advertising. We share data only with service providers that help us run the Service, under contracts that require them to protect it:
- Supabase — authentication and database hosting (stores your account and content).
- PostHog — product analytics.
- Sentry — crash and error reporting.
- Google and Apple — only if you choose to sign in with them.
- Expo (EAS) — app delivery and over-the-air updates.
We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a business transfer. If a studio member shares a flow to a studio, other members of that studio can see that flow and your display name and avatar — but never your email.
6. Sign in with Apple
If you use “Hide My Email,” we receive only a private relay address, not your real email. You can manage or disable this at any time in your Apple ID settings.
7. Data retention
We keep your information while your account is active. Deleted flows are soft-deleted and recoverable for a short period, then permanently removed; routine backups cycle out over time. When you delete your account (see below), we delete your personal data within a reasonable period, except where we must retain it to comply with the law.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data; to restrict or object to certain processing; and to withdraw consent. EU/UK (GDPR): you may also lodge a complaint with your local data protection authority. California (CCPA/CPRA): you have the right to know, delete, and correct your information, and to opt out of its “sale” or “sharing” — note we do not sell or share your information for those purposes — and we will not discriminate against you for exercising these rights.
To exercise any of these rights, email [email protected]. We may need to verify your identity first.
9. Deleting your account
You can delete your account and associated personal data from within the app, or by emailing[email protected]. Deleting your account removes your profile and personal content; some records may be retained briefly in backups before they cycle out.
10. Children
The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has provided us personal information, contact us and we will delete it.
11. Security
We use reputable providers and industry-standard measures (encryption in transit, access controls) to protect your data. No method of transmission or storage is 100% secure, but we work to safeguard your information.
12. International transfers
Our providers may process and store data in the United States and other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for such transfers.
13. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the “Last updated” date; significant changes may be communicated in the app.
14. Contact
Questions or requests: [email protected].