Privacy Notice

This notice applies to the FLO.W Core website, accounts, purchases, redemptions, downloads, and device authorization.

Data we handle

• Account and contact data, including your email address, login sessions, and one-time verification codes; if you choose Google sign-in, this also includes the name, email address, and profile image provided by Google; if you upload an avatar, it also includes the image you select
• Purchase and entitlement data, including order identifiers, purchase channel, amount and currency, the plan snapshot at purchase, redemption records, and entitlement status
• Computer authorization data, including an irreversible digest of system device identifiers, the computer display name, and binding status
• Delivery and security data, including mail delivery status, administrative audit records, and necessary diagnostic records

When FLO.W Core performs a low-frequency entitlement check or you manually check for updates, it sends only the signed authorization credential and an irreversible digest of the current computer. We do not collect or upload the contents of your Obsidian notes, vault names, or local paths.

How we use data

We use this data to complete purchases and delivery, verify entitlements, manage computer quota, prevent duplicate ledger entries, handle refunds and support requests, and detect system problems. We do not sell your email address or other personal data.

If you choose Google sign-in, Google processes the sign-in request and provides the basic account information needed to authenticate you. Uploaded avatars are stored in a Cloudflare R2 bucket dedicated to FLO.W Core and displayed through a public URL. Do not use sensitive images as avatars. Payment, mail, sign-in, storage, and hosting providers process data only to the extent needed to provide their respective services, subject to their own agreements.

Retention

Orders, purchase snapshots, entitlements, redemptions, computer-authorization history, and audit evidence are permanent ledger records. We retain them to prove the purchase relationship, verify long-term entitlements, and reconcile the ledger. When a computer is unbound, its row remains in the ledger to preserve computer-quota history and rotation counts.

One-time codes, expired sessions, device pairing requests, sent-mail records, and diagnostic logs are removed under our internal retention schedule. Unsent mail is not deleted by expiry cleanup.

Custom avatars are retained while the account uses them. Replacing an avatar does not immediately delete the previous file; it remains until backend cleanup or a deletion request.

Your choices

You may contact support@21obsidian.com to request access to or correction of your account information, or to make another request available under applicable law. Ledger and audit evidence serves as purchase proof and prevents duplicate entries, so it is not removed through a general data deletion request.

Contact

For privacy questions, contact support@21obsidian.com.