Privacy Policy

Last updated 4 September 2026

FlowState is built to know as little about you as possible. The application has no account, no analytics and no telemetry, and your projects never leave your Mac. This page says exactly what does exist, because a privacy policy that only makes promises is not much use.

What stays on your Mac

Everything you create in FlowState — projects, folder paths, shortcuts, websites, themes and preferences — is stored in files in your own Application Support folder. It is never uploaded, never synced, and never seen by anyone else. Deleting FlowState and that folder removes it completely.

What FlowState sends, and when

Update checks. FlowState asks flowstatemac.com whether a newer version exists. That request carries what any web request carries — your IP address and the version you are running — and nothing about you or your projects. It can be turned off in Settings.
With a subscription: FlowState contacts its own licensing service to renew your licence, roughly once a month. It sends the licence it already holds, and nothing else — no projects, no paths, no usage.
Nothing else, ever. There is no analytics request, no crash reporting service and no third-party network code in the application.

Opening a link or launching a workspace opens your own browser and applications. Those connections are between you and those sites, exactly as if you had opened them yourself.

The licensing service

When you subscribe, a small service run for FlowState stores the minimum needed to know that your subscription is live:

Your Paddle customer and subscription identifiers
The email address you used at checkout
Whether the subscription is active, and when that was last updated

It holds no card details, no address and no name — Paddle has those, and does not pass them on. The service runs on Cloudflare Workers. The records are kept while your subscription exists and removed when it has been over for 90 days.

The mailing list

The website has an optional field for an email address, so that a new release can be announced. It is nothing to do with the application: FlowState never asks for an address, never sends one anywhere, and works identically whether or not you have given one.

If you enter an address, three things are stored:

The address itself
The date you gave it
Which page it came from — one word, chosen by the site

That is the whole record. There is no name, no open tracking, no click tracking and no pixel in anything sent. The list is held on Cloudflare Workers KV on a service run for FlowState — not a marketing platform, and it is never sold, shared or given to anyone.

To be removed, email support@flowstatemac.com and say so. There is no unsubscribe link yet for the honest reason that nothing has been sent yet — the list exists before the sending does, because addresses are the half that cannot be collected retroactively. Any email that does go out will carry a way to leave from that day forward.

Payment

Payments are taken by Paddle.com Market Ltd, the merchant of record for FlowState. Your card details go to Paddle and never to Joshua Lafrentz — they are never seen by, or stored on, anything FlowState runs. Paddle's handling of your information is covered by its own Privacy Notice.

The website and downloads

This site has no analytics, no cookies and no trackers. It is hosted on GitHub Pages, and downloads come from GitHub Releases; both keep standard server logs, including IP addresses, under GitHub's privacy statement. The site loads fonts from Google Fonts, which sees the request for the font file. When you open `/buy`, the page loads Paddle.js directly from Paddle so it can show secure checkout; Paddle receives the normal request information and then handles anything you enter into checkout under its own Privacy Notice linked above.

Permissions FlowState asks for

Accessibility — to move and resize windows on your screen. It reads window positions to put them back afterwards. Nothing is recorded or sent, and declining it leaves everything else working.
Automation — asked for only if you have FlowState open a workspace link in a new Safari or Chrome window. It sends that browser a URL and nothing more.

Both can be withdrawn at any time in System Settings, and FlowState keeps running.

Your rights

FlowState is operated from New Zealand and follows the Privacy Act 2020. You may ask what information is held about you, ask for it to be corrected, or ask for it to be deleted — email support@flowstatemac.com and you will have an answer within 20 working days.

If you are not satisfied with the response, you may complain to the Office of the Privacy Commissioner. If you are in the EU or UK, you have equivalent rights under the GDPR, and Paddle acts as the controller for payment information.

Changes

This page is dated, and is revised whenever FlowState starts or stops sending anything. Material changes are announced by email to subscribers.

Contact

Joshua Lafrentz · support@flowstatemac.com