Transparency

Trust — what Flow does with your data

Versioned · Last updated: July 2026

Flow is local-first. Your journal, your reflections, your check-ins, and the conversations you have with the on-device Guide live on your machine, in an encrypted database, and stay there. What leaves your device is a short list of derived numbers — and only if you turn that on. The words you write never leave. This page says exactly what that means, and how to check it yourself.

What never leaves your device

These stay on your machine, full stop:

Your journal entries and written reflections — the actual text.
Your conversations with the on-device Guide — the full transcript.
Calendar detail — meeting titles, attendees, notes.
Raw health data — HRV samples, heart-rate readings, sleep stages, straight from Apple Health.
Your per-check-in emotion selections and the exact position you set on the mood grid.

On the Mac, all of this sits in a local, SQLCipher-encrypted database. It leaves only through the specific, listed flows below — nothing else reaches for it.

What leaves your device — and only if you opt in

Two kinds of thing, both narrow:

To make the app work at all.

If you use the cloud Coach, your message goes to our server to be answered. Signing in (optional) runs through Kinde. A check-in you record syncs as a mood entry. Push tokens register so reminders can arrive. That's the baseline, and it's covered by the privacy policy.

A weekly derived summary — off by default, on if you choose.

Once a week, if you've opted in, Flow sends a small set of derived, categorical values computed from what you told it during your check-ins: counts, averages, and ratios. Not the text. Not the raw signals. You report; Flow summarises what you reported. Flow does not watch how you work or infer your state on its own.

The summary is grouped into: things you told Flow about how the week went, how much you used the practices, a few optional health-derived averages (only if you've granted Apple Health access), and light context values. The full metric-by-metric registry, with exact field names and units, is published in our data-transparency document so an auditor can check it line by line.

What Flow never sends

To be explicit, the weekly summary never includes:

Your name, email, phone number, or any personal identifier.
Your journal entries, reflections, or any free-form writing.
Meeting titles, attendee names, or calendar detail.
Raw HRV samples, heart-rate readings, or sleep-stage data.
Your individual emotion selections (only weekly frequency counts).
The content of your Guide or Coach conversations (only how many messages, not what was said).
Your location, IP address, or device identifiers beyond keeping you signed in.
Anything from other apps on your device.

On the Mac

Guest by default. Flow works completely with no account. A random guest session identifies the installation, not you.
The Guide runs on your Mac and sends nothing. The Coach is the persona that runs in Ascenda's cloud; it sends only the payload you approve in the grant sheet, each time, before anything leaves.
Your licence key is treated as a credential. It's sent once over TLS when you press Redeem, then stored in the macOS Keychain — never logged, never in analytics, not even hashed. A licence key is not a sign-in: the token it returns can only read your entitlement (your plan and its expiry), and the server rejects it everywhere else. It can't reach your journal, chat, or sync.
If you link an account (optional — e.g. to back up your model), desktop analytics become identified from that point, which we disclose in the App Store listing. Your licence key and email are never analytics properties.

Your controls

Every share is opt-in, never opt-out.
You can revoke any consent at any time in Data & Privacy → Consent History; revoking stops that data from being included going forward.
You can ask us to delete data already sent.

Don't trust us — verify

The point of this page is that you don't have to take our word for it:

Read the code path.

The routine that builds the weekly summary computes only the declared metrics — review it and confirm.

Watch the wire.

Proxy the app's HTTPS traffic and diff the payloads against the published schema.

Independent attestation.

We publish a third-party confirmation that the app sends only what this document describes.

If you're a security researcher and want to verify any of this, get in touch at privacy@ascenda.one.

This page is versioned. If any of the above changes, it changes here first, as a dated entry in the changelog — not quietly.