Privacy Policy
Who we are
Piklo Flow is operated by USER_ACTION_REQUIRED ("we", "us"), USER_ACTION_REQUIRED, the data controller for the personal data described in this policy.
Contact us about privacy at privacy@pikloflow.com, or general support at support@pikloflow.com.
What we collect
Account data: your email address, display name, and (optionally) an avatar and preferred language, when you sign up.
Content you create: tasks, projects, notes, events, decisions, comments, attachments, time logs, and invoices — all scoped to the workspace(s) you're a member of.
Connections you set up: calendar and cloud-storage integrations (e.g. Google, Apple/iCloud, Microsoft), stored as OAuth tokens used only to sync on your behalf.
Billing data: if you subscribe, our payment processor (Stripe, Apple, or Google, depending on how you purchased) handles your card or payment details directly — we never see or store your full card number.
Technical data: device tokens for push notifications, and standard server logs (IP address, timestamps, request metadata) kept for security and reliability.
Why we process it (legal basis)
To provide the service you signed up for (contract) — account, workspace content, sync, and billing.
To keep the service secure and working correctly (legitimate interest) — logs, error monitoring, abuse prevention.
Where you've asked for it (consent) — optional integrations like calendar/cloud connections, which you can disconnect at any time.
Who we share it with
Supabase (database, authentication, and file storage), hosted in the EU (eu-central-1).
Stripe, Apple (App Store), and Google (Play Billing) — only for workspaces that subscribe, and only the data needed to process and verify payment.
Resend — for transactional email (e.g. invitations, notifications).
Calendar/cloud providers you explicitly connect (Google, Apple/iCloud, Microsoft, and similar) — only to sync the data you've asked to sync, using tokens you can revoke at any time from Settings.
We do not sell your personal data, and we do not share it with anyone else for their own marketing purposes.
Where your data lives
Our primary database and file storage are hosted in the EU (eu-central-1, via Supabase). Some processors above (e.g. Apple, Google, Stripe) may process data outside the EU as part of their own global infrastructure, under their respective data processing agreements and standard contractual clauses.
How long we keep it
We keep your account and workspace content for as long as your account is active.
If you delete your account, we remove your personal data and anything you solely own (see "Your rights" below) immediately; content you created inside a shared workspace that other members still use is anonymized rather than deleted outright, so their work isn't broken by your departure.
Billing records are kept as long as required by applicable tax and accounting law, independent of account deletion.
Your rights
Access & export: download a copy of your profile, preferences, and everything you've authored, at any time, from Settings → Data & account.
Deletion: delete your account and personal data at any time from the same screen, in the app or on the web — this is a real, immediate action, not a support request.
Correction: update your profile details directly in the app.
Depending on your jurisdiction, you may also have rights to restrict or object to processing, or to lodge a complaint with your local data protection authority. Contact us first at privacy@pikloflow.com and we'll do our best to resolve it directly.
Children
Piklo Flow is not directed at children, and we don't knowingly collect data from anyone under 16.
Changes to this policy
We'll update the "last updated" date above when this policy changes, and post material changes prominently in the app.