Privacy.
How Reflow collects, uses, and protects your data.
1. Who we are
Reflow is built by 288 Labs, LLC. Contact: privacy@288labs.com.
2. What we collect
Account
- Email address and name — via Sign in with Apple, provided by Apple only on your first sign-in (you may choose to hide your email).
- Account identifier
Product data
- Tasks, projects, and notes you create
- Chat messages with the AI coach
- Preferences (work-style profile, tone, schedule, working hours, notification choice)
Reflow does not record or process voice or audio. We do not access your microphone, contacts, photos, or location.
Device + telemetry
- App version, OS version, device model
- Crash reports
- Anonymous usage events
Subscriptions
- Subscription status via RevenueCat (no card numbers — Apple handles)
Advertising identifiers
- Your device's advertising identifier (IDFA) — only if you allow tracking when iOS asks. If you decline, or never answer, we do not collect it.
- App install and a small set of milestone events (finished setup, viewed the subscription screen, completed a focus session, started a trial or subscription, and the subscription amount).
These are used only to measure advertising — see Advertising and measurement below. They never include your tasks, projects, notes, chat messages with the coach, work-style profile, name, or email.
3. How we use your data
- Run the product (sync, AI responses, notifications)
- Improve the product (anonymized analytics)
- Send transactional emails (only if you have an account)
- Measure our own advertising (see below)
We do not sell your data. Reflow contains no ads — we never show third-party advertising inside the app. We do not use your content to train third-party AI models.
4. Advertising and measurement
We run ads for Reflow on Meta's platforms (Facebook and Instagram). So that we can tell which of our ads actually bring people to the app, Reflow includes the Meta SDK, which reports your app install and the milestone events listed above to Meta Platforms, Inc.
Your advertising identifier (IDFA) is shared with Meta only if you grant permission when iOS shows the App Tracking Transparency prompt. If you decline, Apple's SKAdNetwork gives us a coarse, non-identifying count of installs and conversions instead — which is fine by us. You can change your answer at any time in Settings → Privacy & Security → Tracking on your device.
Because this data is shared with Meta for advertising measurement, it is classified by Apple as data used to track you, and is declared that way on our App Store privacy label. It is limited to the identifier and event names described above — never your tasks, notes, or conversations with the coach.
5. Sub-processors
- Third-party AI providers — the AI coach (Otto) is powered by one or more third-party AI services. These currently may include Anthropic (Claude) and OpenAI; the active provider may change over time and the current list is maintained on this page. When you chat or plan, we send the messages you write and your related task details to the active provider to generate a response; we do not send your email or name. We ask for your consent inside the app before any data is sent to a third-party AI provider. We send this data only to generate responses for you, and each provider processes it under its own API privacy and security terms.
- Supabase — authentication + database storage. Region: US West (us-west-1).
- RevenueCat — subscription state (no card numbers).
- PostHog — product analytics. Region: US. Events are anonymized; no message content, task titles, names, or emails are sent.
- Meta Platforms, Inc. — advertising attribution and measurement for the ads we run for Reflow. Receives your app install, the milestone events listed in section 2, and — only with your App Tracking Transparency consent — your device's advertising identifier. Never receives your tasks, notes, chat messages, name, or email.
- Apple — App Store, in-app purchases, Sign in with Apple, and SKAdNetwork (privacy-preserving ad attribution used when you decline tracking).
6. Retention
- Account data, tasks, and chat history — stored until you delete your account, after which it is removed from our database.
- Analytics events — retained up to 12 months, then aggregated.
- Voice recordings — none; we do not collect audio.
7. Your rights
You can permanently delete your account and all associated data from within the app: Settings → Delete account. You can also request access, correction, or export by emailing privacy@288labs.com; we action requests within 30 days.
EU / UK / EEA residents have rights under GDPR; California residents have rights under CCPA. We honor both globally.
8. Children
Reflow is not directed at children under 13 (16 in some EU jurisdictions).
9. Security
All data is encrypted in transit (TLS) and at rest. Access inside 288 Labs is restricted to a small number of authorized people.
10. Changes
Material changes get a new date above; significant changes also announced in-app or by email.