Privacy Policy

1. About this policy

This policy explains what information NowFlow collects, how it's used and shared, and the choices you have. NowFlow is run by Will Mulliken ("we", "us"). It applies to NowFlow's website, apps and features (the "Service") and takes effect on November 6, 2026.

2. What we collect

Your account:

• Your name, email address and password. Passwords are stored only as a salted scrypt hash, so we can't read them.
• Sign-in sessions (stored only as hashes), when you last used NowFlow, when you agreed to these policies, and your place in the welcome tour.
• Codes we email you to confirm your address or sign you in. They're kept only as a hash, in memory, for 10 minutes.

Your study content:

• Tasks and their instructions, rubrics and due dates; materials and files you add; drafts, notes and study cards you write; your messages with NowFlow's assistant; your settings; and the results of features you use, such as rubric checks and summaries.

Services you connect, only if you connect them:

• Canvas: your calendar feed link, and a sign-in session for your school's Canvas that you create yourself in NowFlow. NowFlow uses them to read your courses, assignments, files, rubrics and quiz details, and to submit work when you tell it to.
• Google: access tokens for your Google account and its email address. With your permission, NowFlow can search and read files in your Drive to find ones related to your tasks, edit a Google Doc while you type in it in NowFlow, create files you ask for, and edit a Doc or Slides deck when you ask the assistant to (only a file that's open in NowFlow where you can see it).

Feedback you send: what you write, and, if you choose, a screenshot of your workspace and details of what was on screen, so we can understand the problem.

Technical information: the AI features you use and how much (for limits and costs), and the errors and basic request details our server needs to run and stay secure. Your IP address is used briefly to limit repeated sign-in attempts; it isn't saved to your account.

Voice: hold-to-talk uses your web browser's built-in speech recognition. The audio is handled by your browser and its provider (for example Google in Chrome, or Apple in Safari) under their policies. NowFlow receives only the text.

Lecture recordings: only if you press Record in lecture mode, after saying your instructor allows recording. What's said is written down on your own computer, by a speech model that runs in your browser (the sound isn't sent anywhere for that). The first time, your browser downloads the model's files from Hugging Face, which sees your IP address, and keeps them in its own storage on your computer (about 1.6 GB, removable by clearing NowFlow's site data). Until the model is ready, or if your browser can't run it, your browser's built-in speech recognition stands in, as with voice above. NowFlow keeps the sound with that lecture in your account so anything missed can be written down after class; you can delete it at any time from the lecture's Summary, and it goes when you delete the lecture or your account. The text is used to fill in your notes, find the lecture's terms and answer your questions about it.

3. How we use it

• To provide the Service: show and organize your work, run the features you use, and act in connected services when you ask.
• To keep NowFlow and its users secure: prevent abuse, limit repeated sign-in attempts, and investigate problems.
• To support you and answer your feedback, and to tell you about important changes to the Service.
• To understand and improve NowFlow, using your feedback and counts of how features are used.

We don't sell your personal information or share it for advertising. We don't show ads, build advertising profiles or track you across other websites. We don't use your content, or anything received from Google or Canvas, to train AI models.

4. AI processing

NowFlow's AI features are powered by Anthropic's Claude models. When you use one, NowFlow sends Anthropic the parts of your content that the feature needs: for example, an assignment's instructions and your draft for a rubric check, a passage you highlight for Explain, a reading's text for reading tools, what was said in a lecture to fill in your notes, or your question, related tasks and the files or quiz you ask about for the assistant.

Anthropic processes this as our service provider to produce the response. Under Anthropic's commercial terms, information sent through its API isn't used to train its models. Anthropic may keep it for a limited time under its own policies, for example to detect misuse.

5. Who else receives information

We share information only in these cases:

• Service providers that run NowFlow for us, under obligations to protect it: our hosting provider (DigitalOcean, where our servers are located in the United States), our AI provider (Anthropic), and our email provider (Brevo or Resend), which receives your email address to send you sign-in and confirmation codes.
• Services you connect, when you tell NowFlow to act there (for example, submitting to Canvas or saving to Google Drive).
• Lookups that some features make for you without saying who you are: search terms go to services such as YouTube (to find videos), Wikipedia and a dictionary service (for definitions), and Crossref, OpenAlex, Semantic Scholar and doi.org (to look up citations). When you add a link, our server fetches that page.
• Content shown inside NowFlow's windows (videos, calculators, music, web pages, files). Your browser loads it directly from that service, which receives your IP address and may set its own cookies under its own policy. NowFlow's YouTube windows use YouTube's privacy-enhanced mode.
• When the law requires it, such as a valid legal order, or when it's needed to protect the safety, rights or property of you, other people or us.
• If the Service is transferred to someone else (for example, in a merger or a sale), in which case they must honor this policy.
• With your consent, or at your direction.

6. Information from Google

NowFlow's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you use in NowFlow, such as finding your related files, showing and editing your Docs, and creating files you ask for.
• We transfer it to others only as needed to provide those features (for example, to our AI provider to answer a question about your notes), for security, to comply with the law, or as part of a transfer of the Service.
• We don't use it for advertising, we don't sell it, and we don't use it to develop, improve or train generalized AI or machine-learning models.
• No person reads it unless you ask us to (for example, for support), it's needed for security or to comply with the law, or it has been combined and made anonymous.

You can disconnect Google in NowFlow's settings, which deletes NowFlow's tokens and asks Google to revoke NowFlow's access. You can also remove NowFlow's access at any time from your Google Account's security settings.

7. Cookies and storage in your browser

NowFlow uses one essential cookie to keep you signed in (and, for the administrator only, one for the admin console). It also saves a few display preferences in your browser, such as which panels you've folded, and, if you record a lecture, the speech model's files in the browser's private storage. NowFlow doesn't use analytics, advertising or tracking cookies.

8. How long we keep it

• Your account and content are kept until you delete them or your account.
• Delete all your data (in Settings) and everything in your account is erased from our live systems right away. Delete your account and the account goes too, and you're signed out everywhere. A single task you remove is hidden and kept, so it doesn't come back the next time NowFlow reads Canvas; deleting all your data erases it.
• Disconnecting Canvas or Google deletes the session or tokens NowFlow held for it.
• We keep backups of the server, readable only by its administrator, to recover from mistakes and failures. Each backup is deleted automatically within 30 days, so anything you delete is gone from backups within 30 days too.
• Server logs are kept only as long as needed to run the Service and keep it secure.

9. How we protect it

All connections to NowFlow use HTTPS. Passwords are hashed. Canvas sessions, Google tokens and your calendar feed link are encrypted with AES-256-GCM. Each account's data is stored separately from every other account's, and the server accepts changes only from NowFlow's own pages. Access to the server is limited to the person who runs NowFlow.

No system is perfectly secure, and we can't guarantee that your information will never be accessed, lost or changed without permission. If a breach affects your personal information, we'll tell you as the law requires.

10. Your choices and rights

In NowFlow's settings you can see and change your information, disconnect services, delete everything in your account, or delete your account. You can also ask us for a copy of your information, to correct it, or to delete it, and we'll respond within 30 days.

Depending on where you live, you may have further rights:

• California residents: you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be treated differently for using these rights. We don't sell or share personal information as California law defines those terms, and we don't use sensitive personal information for anything beyond providing the Service.
• People in the European Economic Area, the United Kingdom and Switzerland: we use your information to provide the Service you asked for (performing our contract with you), for our legitimate interests in keeping it secure and improving it, and with your consent where we ask for it. You may access, correct, delete, restrict or object to our use of your information, receive a copy in a portable form, withdraw consent at any time, and complain to your local data protection authority.

To make a request, use the contact details below. We may need to confirm that the request comes from you before we act on it.

11. Children and students

NowFlow isn't meant for children under 13, and we don't knowingly collect personal information from them. If we learn that we have, we'll delete it. If you believe a child under 13 has given us information, please contact us.

Students use NowFlow for themselves. NowFlow isn't provided on behalf of any school, and we aren't acting as a school official. Your school's own records stay with your school.

12. Where your information is processed

NowFlow's servers are in the United States, and our service providers may process information in the United States and other countries. If you use NowFlow from outside the United States, your information will be transferred to and processed there, where data protection laws may differ from those where you live.

13. Changes to this policy

We'll post any changes here with a new effective date. If a change is significant, we'll tell you in NowFlow before it takes effect and ask you to agree to it.

14. Contact

Questions or requests about your privacy? Use Send feedback in NowFlow's settings (or in the box that opens when you click an empty part of the screen). It reaches us directly.