Privacy policy

Account details. A username, an email address and a password. The email is used to confirm the account and to send order and account notices.

Order details. What you ordered, what it cost in credits, its position in the queue and its outcome. Plus the information required to fulfil the order and deliver it to the right place.

Payment records. The amount, the method used and the credits added. Card numbers and payment credentials are handled by the payment provider and never reach our servers.

Technical data. The address a request came from, used to rate-limit sign-in attempts and block abuse. No tracking pixels, no ad networks, no third-party analytics.

Everything is encrypted in transit and stored encrypted.

In transit. Every connection to FlowNitro uses TLS, including the connection we send email over.

At rest. The database is encrypted on disk, and the most sensitive fields are hashed or encrypted individually on top of that.

Passwords. Hashed with bcrypt. A hash cannot be reversed, so nobody here can read your password.

Verification links. We store a SHA-256 of each link rather than the link itself. Links work once and expire after 48 hours.

Sessions. Your session is a signed token in an httpOnly cookie, which scripts in your browser cannot read. It is never put in local storage.

Every account endpoint checks who is asking and returns only that account’s own records. Other users cannot see your data.

Internally, access is limited to the people who need it to run and support the service. We do not sell your data or share it for advertising.

We use a database host, a payment provider and an email provider to operate. Each receives only what its job requires and handles it on our instructions.

We disclose data to anyone else only where the law requires it.

An account that is never confirmed is deleted automatically 48 hours after sign-up, along with everything attached to it.

An active account’s data is kept while the account exists. Order and payment records are kept longer where accounting rules require it, then deleted.

Data held only to fill an order is deleted once the order is done.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and its data. Contact support and we will act on it.

Some records survive a deletion request where the law requires us to keep them, such as payment records. We will tell you what was kept and why.

One cookie, for your session, so you stay signed in. There are no advertising or tracking cookies.

Your theme preference is stored in your own browser and never sent to us.

If this policy changes, the date at the top changes with it. We will email you about any significant change to what we collect or how we use it.