PRIVACY POLICY

Last updated February 23, 2026

This Privacy Notice for Dune Ventures LLC ("we," "us," or "our") describes how we collect, use, and protect your personal information when you use FlowState and related services (the "Services").

FlowState is a mobile app that transcribes handwritten notes and audio recordings and delivers them to your preferred note-taking platforms (Obsidian, Notion, Google Drive, OneNote, and others).

Questions or concerns? Contact us at privacy@seekflowstate.com.

1. WHAT WE COLLECT

We collect the following information when you use FlowState:

  • Account information. Your email address and name, provided via Google or Apple sign-in.
  • Uploaded content. Handwritten note images, PDFs, and audio recordings that you upload for transcription.
  • Transcriptions. The AI-generated text produced from your uploads.
  • Account settings and preferences. Your delivery destinations and preferences.
  • Connection credentials. Credentials for linked services (Google Drive, Notion, OneNote). These are stored encrypted; we never see them in plaintext.

We do not process sensitive personal information (e.g., racial or ethnic data, religious beliefs, health data).

2. HOW WE USE IT

We use your information to:

  • Transcribe your uploads using AI services (see AI Processing)
  • Deliver transcriptions to your connected note-taking apps
  • Manage your account, subscriptions, and credits
  • Send transactional emails (receipts, account notifications)
  • Monitor for errors and improve service reliability

We do not use your content for advertising, profiling, or any purpose beyond providing the service.

GOOGLE USER DATA (OAUTH)

What we access (scopes)

With your explicit consent during Google OAuth, FlowState requests only the minimum scopes necessary to deliver your content to Google Drive:

  • https://www.googleapis.com/auth/drive.file — create and access files that FlowState creates or that you explicitly select via the Google Picker.

We use the Google Picker API so you can explicitly choose the specific Drive folders or files to which FlowState will have access. We do not request restricted scopes for the Google Docs API.

How we use your Google data

We use these permissions only to: (a) let you pick a destination with Google Picker, (b) create/update the specific files you choose or that we create for you, and (c) show basic file metadata for routing. We do not read or index all files in your Drive.

Storage and retention

We store only the IDs/paths needed to deliver or update your chosen destination, plus minimal metadata (e.g., file ID). We do not store Google Drive file contents beyond what's necessary to complete delivery. We delete transient processing copies within 7 days and remove stored Google file IDs/metadata upon account deletion or your request. After you revoke Google access, any remaining Google-sourced content in our systems is deleted within 30 days.

Sharing

We do not sell Google user data. We share it only with subprocessors necessary to provide the Service (e.g., hosting, storage, logging), each bound by contract and data protection obligations.

Revoking access

You can disconnect FlowState at any time from your Google Account's third‑party access page: https://myaccount.google.com/permissions. After revocation, we stop accessing your Google data and delete remaining Google‑sourced content within 30 days.

Policy compliance

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If we later add any restricted scopes (e.g., Gmail), we will provide additional disclosures and, if required, complete applicable security assessments.

3. AI PROCESSING

FlowState uses third-party AI services to transcribe your uploads. Handwritten notes are processed by OpenAI, and audio recordings are processed by AssemblyAI. When you upload content:

  • Your uploaded file is sent to the appropriate AI provider for processing
  • The resulting transcription is stored in your account
  • Your data is not used for AI training. FlowState has opted out of allowing your data to be used for training with all AI providers
  • We do not sell your personal information to any third party

4. DATA RETENTION

  • Uploaded files and transcriptions: Retained while your account is active. Deleted when you delete your account.
  • Account information: Retained while your account is active. Deleted when you delete your account.
  • Connection credentials: Removed immediately when you disconnect a service or delete your account.

When you request account deletion, we will delete or anonymize your personal information from our active databases. Some information may be retained in encrypted backups for a limited period as required by law.

5. SECURITY

We use industry-standard security measures to protect your data. However, no system is 100% secure, and we cannot guarantee absolute security.

6. CHILDREN

FlowState is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@seekflowstate.com and we will promptly delete it.

7. YOUR RIGHTS

Regardless of where you live, you can:

  • Delete your account and all associated data by contacting us
  • Disconnect third-party services (Google Drive, Notion, OneNote, etc.) at any time from within the app
  • Request a copy of your personal data
  • Correct inaccuracies in your personal information

EU/UK residents (GDPR): You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. Our legal basis for processing is contract performance (providing the service you signed up for) and consent (for optional features like third-party integrations). You may lodge a complaint with your local data protection authority.

California residents (CCPA): You have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell your personal information.

Other US state privacy laws: Residents of states with comprehensive privacy laws (Colorado, Connecticut, Virginia, and others) have similar rights to access, correct, delete, and port their data. Contact us to exercise these rights.

To exercise any of these rights, email privacy@seekflowstate.com. We will respond within 30 days.

8. UPDATES TO THIS NOTICE

We may update this Privacy Notice from time to time. The updated version will be indicated by the "Last updated" date at the top. If we make material changes, we may notify you via email or a prominent notice in the app.

9. CONTACT US

If you have questions or concerns about this Privacy Notice, contact us at:

privacy@seekflowstate.com