Privacy

The short version

Efflow stores what you put into it so it can show it back to you. It is a single-user app: nothing you write is visible to another account, and none of it is sold, rented or used for advertising.

What is stored

• Account — your name, email address, and either a password hash or the fact that you signed in with Google or Microsoft.
• Your content — events, tasks, notes, timers, calendars and the preferences that go with them.
• Connected calendars (optional) — if you connect Google, Outlook or iCloud, the access tokens for that connection and a read-only mirror of the events it returns — their titles and times only, never descriptions or guests. An Apple app-specific password is encrypted at rest.
• Billing — a Polar customer id and the status and dates of your subscription. Card numbers are never sent to or stored by Efflow; Polar handles the payment itself.
• The notify list (optional) — if you ask to be told when mobile or Track opens, your email address and which of the two you asked about. Nothing else: no account is created, and it is used for that one message only. Write to support@efflow.app and the entry is deleted.

Who it is shared with

• Polar — merchant of record: payments, subscription management, invoicing and sales tax. Polar is the seller of record for Pro, so it collects the billing details a purchase requires and is the data controller for them.
• Neon (database) and Vercel (hosting) — where the app and its data run, and where the cookieless measurement described under Cookies is collected.
• Resend — sends account emails such as verification and password resets.
• Google / Microsoft / Apple — only if you connect a calendar, and only for that connection. Creating a meeting sends the event and its guest list to that provider, which then emails the invitations.
• Anthropic — only if the optional day-plan polish runs. It sends the titles and times of the day's events and of the suggested blocks, never note bodies, event notes or guests.

Google user data

• What is requested — signing in with Google shares your name, email address and profile picture. Connecting Google Calendar additionally requests two scopes: calendar.readonly, to read your calendar list and events, and calendar.events, to create the events you ask Efflow to create.
• What is read and kept — from each calendar, its name and colour; from each event, its Google id, title, start, end and whether it is all-day. Nothing else is copied out of Google Calendar: descriptions, guest lists, locations, attachments and Meet links stay in Google and are never stored by Efflow.
• What it is used for — exactly two things: showing your Google events alongside everything else on your timeline and planner, and writing back the events you create in Efflow, including a Meet link and the invitations when you add guests. It is not used for anything else, it is never sold or rented, and it is never used for advertising or profiling.
• AI — Efflow has an optional day-plan feature. When you ask it for a plan, the titles and times of that day's events — which can include events synced from Google Calendar — and the titles and times of the blocks it is proposing are sent to Anthropic's Claude API, so it can drop suggestions that repeat something already on your day. Titles and times only: never descriptions, notes or guests. Anthropic processes them solely to return that response and does not use them to train its models. Nothing is sent unless you open the day-plan yourself.
• Limited Use — Efflow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is never used to develop, improve or train generalized or foundational machine-learning or artificial-intelligence models, and is never transferred to any third party except as described above and as needed to provide or improve these features, for security purposes, or where required by law.
• Withdrawing access — disconnect Google under Settings → Integrations, which deletes the mirrored events and imported calendars from Efflow, and revoke the grant itself at your Google account permissions page. Deleting your Efflow account removes the stored tokens along with everything else.

How your data is protected

• In transit — every connection to Efflow, and every call it makes to Google, Anthropic or any other service listed above, runs over HTTPS with TLS. The database connection requires TLS too.
• At rest — the database encrypts its contents at rest, as does its storage layer. An Apple app-specific password gets a second layer on top: AES-256-GCM, with a key held only in the server environment, so it is unreadable even to someone holding a copy of the database.
• Access tokens — OAuth access and refresh tokens for Google and Microsoft are stored server-side and are never sent to the browser, never exposed through the API, and used only for the calendar calls described above.
• Access control — every read and write is scoped to the id of the signed-in account, so no request can reach another account's data. Sessions are HttpOnly, Secure, SameSite cookies, and expire after 30 days.
• Minimisation and operations — only the fields listed above are stored in the first place. Credentials and API keys live in a managed secrets store rather than the codebase, and access to the production database and hosting account is limited to the operator of Efflow.

The calendar feed

The subscribe URL under Settings is a secret link: anyone holding it can read your event titles and times. Event notes are stripped from the feed. You can revoke or regenerate the link at any time, which immediately invalidates the old one.

Keeping and deleting

Your data is kept until you delete it. You can delete your account and everything in it from your Efflow account page — Deleting your account below has the steps, and exactly what is deleted and what is kept. To request a copy of your data, or deletion by hand, email support@efflow.app.

Deleting your account

You can delete the account you use in Efflow Plan — the mobile app from Efflow — and on the web at efflow.app, together with all of its data, at any time. You do not need the app: the steps below work in any browser, whether or not Efflow Plan is still installed, and uninstalling it on its own deletes nothing.

1. Go to accounts.efflow.app/account and sign in the same way you sign in to Efflow Plan.
2. In the Account section, next to Delete account, press Delete…, enter your password if your account has one, then press Email me the link.
3. Open the email and press the button on the page it links to. The link works on any device for one hour, and your account is deleted when you press that button, not before.

In the app, More → Account → Delete account opens the same page. The same screen also has Delete Efflow data, which removes only your Efflow Plan data and keeps the account. If you can no longer sign in, email support@efflow.app and ask for your account to be deleted by hand.

What is deleted

• Your Efflow account — your name, email address and password, the Google, Apple or Microsoft sign-ins linked to it, your signed-in sessions on every device, and any complimentary plan or code redeemed on it.
• Everything in Efflow Plan — your events, tasks, lists, notes and notebooks, habits and their check-ins, timers and their history, calendars and preferences. Your private calendar-feed link stops working.
• Connected calendars — the copies of your Google, Outlook or iCloud calendars and events, the access Efflow was given to them, and the encrypted Apple app-specific password.
• Your subscription — any live subscription is cancelled first, and your customer record at Polar, the payment provider, is anonymised. If the cancellation fails, nothing is deleted and you are asked to try again.
• Other Efflow apps — the same account signs you in to every Efflow app, so each one is told to erase what it holds about you as well.

Your account is deleted the moment you press the button. Efflow Plan and the other Efflow apps erase their copies within seconds — or, if that message goes astray, when their nightly check next runs. Deletion cannot be undone.

What is kept

• Payment records — Polar is the merchant of record for Pro, so it keeps the invoices and payment records that tax and accounting law require, for as long as that law requires. Efflow never holds your card details.
• A deletion record — your account's internal id and the time it was deleted, with no name, email address or content. It is kept permanently, so that every Efflow app can check it has erased its copy.
• Admin records — if we ever changed your account by hand, for example to grant a complimentary plan or to delete it at your request, the log of that action, which includes your email address, is kept as an audit trail with no time limit.
• Backups — deleted data can remain for up to six hours in the database provider's rolling recovery history, which is used only to restore the service after a failure.
• The notify list — if you asked to be told when an app launches, that address is kept apart from your account. Write to support@efflow.app and it is deleted.

Cookies

Efflow sets a session cookie so you stay signed in, plus three preference cookies for your theme, accent colour and language. Two measurements run through Vercel, both cookieless and both aggregated: loading speed on every page, and page views with the site that referred them on the public pages only — never inside the app, and never joined to your account. If you arrive from a link that names where it was shared, or from another site, Efflow keeps that in a cookie for 30 days and records it on your account when you sign up, so we know which places bring people here. Only the site's name and the link's tags are kept — no page you were on, no identifier, and nothing shared with anyone. There is no advertising cookie and no cross-site tracking.

Contact

Privacy questions or requests: support@efflow.app. See also the terms of service.