FlowSagaFlowSaga privacy policy
- Your videos, prompts and AI keys stay on your own computer. They are not uploaded to us (unless you post your work to the gallery yourself).
- We never learn your Google password and never see your card number.
- We don’t sell your data, and we never give your email to any advertising platform.
- No marketing email unless you tick the box. The extension works only on Google Flow pages and doesn’t track the other sites you visit.
- If you don’t sign in, we never receive your account or email; we don’t store the IP address your connection comes from.
What stays on your computer
| Data | Where it is kept | What it is for |
|---|---|---|
| AI keys (Gemini / OpenAI / Anthropic) | Inside the extension on this computer, kept across restarts; other extensions and websites can’t read them | Calling the AI you chose for you; the key goes only to that provider, never through us |
| Batch history, categories, settings, save status | Inside the extension on this computer | Remembering your work |
| The videos and images you make | The folder you chose | They are your files |
| Activity log (up to 2,000 entries) | Inside the extension on this computer | The one-click health check and troubleshooting; never uploaded |
What our server keeps after you sign in
The FlowSaga server (api.flowsagastudio.app, hosted on Cloudflare) receives your data only after you sign in.
Before that, the extension only fetches announcements and feature switches when it starts and every 30 minutes after, plus the anonymous compatibility reports below; none of these carries any identity.
| Data | Why we need it |
|---|---|
| Google account ID and email | To recognise you and tie your membership to this account |
| Subscription status: plan, end date, and the customer and subscription IDs from our payment partner | To know whether you have paid and until when |
| Tour progress and whether you have the 20% discount | The discount is permanent, so we remember it for you |
| Your Google plan level and current credit balance | To suggest the plan that matches yours |
| Monthly usage totals (credits, videos, batches sent, time FlowSaga watched over your jobs) | To show your usage report |
| Gallery posts (title, prompt, model, aspect ratio, length, YouTube video ID) and the likes, ratings and reports you give | So the gallery can show them |
| Payment records: for each payment, the time, type (first subscription, renewal, upgrade, downgrade, refund), plan, period, amount, currency and order ID | To work out how long your membership lasts, keep the books and handle refunds. No card number, name or billing address; those stay with the payment partner |
| Problems you report: title, text, plus the version, interface language, plan, the error code of your latest batch and the screen, which the extension attaches | So we can find the cause without asking you to describe your setup. No videos, prompts or keys |
| What you agreed to: the time of each tick or untick, which box, and the version and language of the text you saw | To prove we followed your choice |
| Country at sign-up (two letters, such as TW) and interface language | To write to you in your language and apply the rules where you live. We don’t store your IP address |
| Seven activity milestones: signing up, first video, paying, a refund, reporting a problem, cancelling, coming back after a while | Recorded only if you tick the second box below; this is not full tracking |
Never sent to our server: the video files themselves (the gallery keeps only YouTube links and thumbnail URLs), your AI keys, your prompts (unless you post one), your activity log, your card details and your Google password.
Anonymous compatibility reports
When Flow starts using a model code FlowSaga doesn’t recognise yet, when a send is rejected because of a model code, or when the extension switches codes to fix itself, it anonymously reports a few technical details so we can support it quickly:
the report type, Flow’s model code (for example veo_3_1_fast_16x9_8s), whether the video is portrait or landscape, the extension version, and (for self-fixes) whether the fix worked.
It contains none of your account, email, sign-in state, prompts, videos, file names or IP address, and cannot be linked to anyone. Each computer reports the same kind of report for the same code at most once every 30 days, and no more than 20 reports a day. Because it holds no personal data, the two boxes below don’t affect it, and there is nothing of it to delete when you delete your account.
Two things you decide
The sign-in screen has two boxes. Neither is ticked by default, and they are separate, so you can tick just one. Leaving both unticked doesn’t affect any feature.
| The box | Ticked means | If not ticked |
|---|---|---|
| Get FlowSaga news and offers | We may send you product news and offers | You only get emails about your account: receipts, end-of-plan notices and replies to problems you reported |
| Use my usage to help improve the product | We record the seven milestones above to see overall trends | Nothing is recorded |
Change your mind any time. After signing in, untick the box in the same panel and it takes effect at once, with no need to write to us. Every marketing email also has an unsubscribe link.
Your rights and deleting your data
Email support@flowsagastudio.app to see what we hold about you, get a copy, correct anything wrong, or delete your whole account. You can also complain to the data protection authority where you live.
Data in the extension: removing the extension deletes all of it. Gallery posts: you can remove them from the gallery yourself. Deleting your whole account: write to us and we confirm by email when it is done. Here is what happens:
| Which data | What we do | Why |
|---|---|---|
| Account, membership, tour progress, usage, plan detection records, milestones, the problems you reported, gallery posts and your likes and ratings | Deleted entirely | All of it is your personal data |
| Payment records | The parts that identify you are removed; only amount and time remain | Accounting and tax law require transaction records to be kept (an exception allowed by GDPR Article 17(3)(b)) |
| Records of what you ticked | The parts that identify you (including the email at the time) are removed; the rest is kept | They prove we had your consent; without your identity they are no longer personal data |
The payment partner is the Merchant of Record and also keeps a copy of your payment records under tax law.
Services we use
- Google: sign-in and making videos in Flow
- Cloudflare: our server, database and website, and the email service that tells us about your reports
- Our payment partner: handles payment as the Merchant of Record and receives your email and order; we never see your card number. It is not live yet; once it is, this section will name it
- YouTube: gallery thumbnails and video checks; only the video ID is sent
- Google Gemini / OpenAI / Anthropic (optional): AI prompt writing and questions, connected directly with your own key, never through us. When you press “Let the AI look at this zone’s material”, the images you added and still frames taken from your videos are sent too, and you are asked first
After you report a problem
When you press “Report a problem” in the extension, your report is stored in our system and we are notified. We reply to the Google email you sign in to FlowSaga with, so you don’t need to leave an address or wait inside the extension.
“My reports” in the extension lists what you reported and when; replies always go to your email. You can add details to the same report.
Before you post to the gallery
The prompt of a post is public. The system blocks obvious personal data and keys (email addresses, phone numbers, sk-, AIza…),
but that is only a help, so please check it yourself. A post reported by 3 different accounts is hidden automatically.
If FlowSaga is acquired or sold
Your account data (Google email, account ID, plan and usage, payment records, the problems you reported) moves with the service, so your subscription and gallery history carry on. The legal basis is performing our contract with you and legitimate interests (GDPR Article 6(1)(b) and 6(1)(f); Taiwan Personal Data Protection Act Article 19(1)(2)).
| When | What we do | What you can do |
|---|---|---|
| Before the handover | Email you which company is taking over, the date, and whether the use of your data changes | Reply to object, or ask us to delete your account (we will) |
| On the handover date | As the Chrome Web Store rules require, get your explicit consent before transferring | If you don’t agree, your data is not transferred |
| After the handover | The new company must use your data under the same policy | If they want to change the purpose, they must tell you first |
California residents: under the CCPA/CPRA, a transfer in a merger is not a “sale” or “sharing” of your personal information, and under AB 1824 any “do not sell my data” request you made must still be honoured by the new company.