Privacy Policy

Last updated: October 11, 2026

The short version

KeptInFlow is a local-first desktop app. Your notes, snips, and settings live on your computer. We run no accounts and no ad tracking. The website counts page views without cookies, and which ad or post a visit came from. The app counts which features get used, never what they were used on, and you can turn that off in Settings under Privacy. Your content leaves your machine when you ask an AI to do something with it, and where it goes then depends on which of the two paths below you are using. It also leaves when you turn on a feature that sends it somewhere you chose: your phone away from your Wi-Fi, a bill sent through your own Stripe account, a snip you share as a link, a web search, or a problem report you send us. Each is covered below, and the app keeps a sent log of every request it makes.

If you bring your own API key

Your key is stored in the Windows credential store and is read only by the app's native code. It is never sent to us. Prompts and attachments go directly from your machine to the provider you chose (OpenAI, Anthropic, Google, xAI, or OpenRouter), under that provider's privacy policy. They do not pass through any server we operate. A TypeSafe key works the same way: the short questions it answers go from your PC straight to TypeSafe.

If you use the included AI

This covers the AI actions you get without a key, during the trial and on the free plan, and the AI-included subscription. Here your request does pass through a proxy service we operate, using our API key rather than yours. It goes on to one of these:

• Google Gemini gets the prompt and any attached snip or file.
• Groq gets audio you dictate on the subscription, with Google Gemini as the backup.
• TypeSafe, through Vercel AI Gateway, gets the short yes-or-no and pick-one questions the app asks along the way during the trial and on the subscription: which form box a value belongs in, say, or which number on a message is a sign-in code. Each question carries the text it is about. For a sign-in code, every digit is hidden first, so the code itself never leaves your PC.

The proxy holds usage counters keyed to your email address or license key, so it can enforce your plan's limits. A monthly counter expires about a month after it is set. The trial's counter is kept, so a trial cannot be started over. We do not store or log the content of your requests or the AI's responses, and we do not use them to train anything. The AI provider handles the request under its own privacy policy.

Your phone

Nothing here happens until you pair a phone by scanning the code on the Phone page. The phone app is a web page served from keptinflow.com. The pairing details ride in the part of the link after the # sign, which the browser does not send to our server.

On your own Wi-Fi, the phone reaches the PC directly over your network. While it is connected that way, what you share and remote control (the trackpad and the screen view) do not pass through any server we operate. Some phone browsers, such as Samsung Internet, will not let a web page reach an address on your own network. For those, the PC keeps a connection open to the relay described below, and the phone uses it only to ask for approval and to set up a direct encrypted link over your Wi-Fi. That exchange is sealed end to end and carries none of your items. The PC accepts that link only when it runs on your own network, and refuses anything else sent through the relay while Work over the internet is off.

Work over the internet is off until you turn it on. When it is on, items travel through a relay we run on Cloudflare. They are sealed on the sending device with keys created on your PC, kept in the Windows credential store, and handed to your phone inside the pairing code. The relay cannot open them. It holds a message in memory only until the other side collects it, writes nothing to storage, and has request logging turned off. What it does see is an anonymous room id derived from those keys, the size and timing of each message, and your IP address, which it uses to limit how many requests one address can make. The same relay is used to set up a direct encrypted link between the phone and the PC, which carries the trackpad and screen view when you have turned on Remote control away from home. To form that link, a Cloudflare helper sees each device's internet address so they can find each other. It never sees the screen, keys or files. A new link does not ask it while Work over the internet is off.

The picture relay is a last resort for when your phone and PC cannot reach each other directly. It is off until we switch it on. When it is used, the encrypted picture and input pass through a relay run by Cloudflare, which cannot read them, because the link between your phone and your PC is encrypted end to end. To hand your PC short-lived relay settings, our server receives your license key (or your email address during the trial) and your network address. It keeps only counters: the seconds granted to you each month, a count of trial use per network address (the address itself is scrambled first), and when settings were last handed out. It also gives Cloudflare a scrambled tag that stands in for you, not your license key or email, so usage can be matched to a grant. The tag cannot be turned back into your key or email. No screen content, file, or keystroke reaches our server. Once an hour a job reads the bytes used per tag from Cloudflare to keep the cost in check and keeps only those totals. A monthly counter, tag total, or trial-use count expires about a month after it is set. A trial's relay time counter is kept, so a trial cannot be started over, and a tag's most recent relay login is kept only as long as the grant lasts.

Open on phone gives your phone a fixed link to that app's own site, such as Spotify or Slack. Your PC does not contact that site, and nothing from the window is sent.

Phone alerts are off until you allow notifications on the phone. Then the PC sends a short notice through the push service your phone's browser uses (for Chrome on Android, that is Google's). The notice is encrypted on your PC so only your phone can read it. It names the PC and shows a short preview of what you sent: the first line of text, a shortened link, a file name, or a small picture. It can also give your PC's new Wi-Fi address. The full item is never sent that way. Something copied from a password manager or an app on your never-save list shows no preview. The push service sees that a notice was delivered, and when, but cannot read it.

Stripe

If you add your own Stripe key and send a bill through Stripe, the app sends that bill to Stripe from your PC: its number, your client's name, email address and first address line, each line's amount and description, any discount and tax rate, the due date, and the payment details you put on your bills. When you open Bills, it asks Stripe whether bills already sent that way have been paid. Your Stripe key is kept in the Windows credential store and never reaches us, and the money goes from your client to you through Stripe, under Stripe's privacy policy. Without a Stripe key, nothing is sent to Stripe.

ChatGPT

If you connect KeptInFlow to ChatGPT, ChatGPT can read what the app saved on your PC when a question you ask it needs that. It goes through a relay we run, which keeps none of it. It is off until you connect it, and ChatGPT can never change anything. The details are on KeptInFlow in ChatGPT: Privacy.

Web search

When you pick the web search row in the command palette, the app opens your browser at the search site set in Settings (Google, unless you change it), with what you typed as the search. The app does not fetch the results itself. A web search you type inline, between << and >>, is an AI request: the AI provider runs the search, on whichever of the two paths above you are using.

Flow Step: when you choose Translate, Wikipedia or YouTube, your browser opens that site with the words you picked. Nothing is sent until you choose it.

Sharing a snip as a link

Share as link uploads the picture from your PC straight to a destination you set up yourself, such as an image host or your own storage. None is set up when you install, so nothing is uploaded until you add one. The upload does not pass through us, any key for it is kept in the Windows credential store, and the host handles the picture under its own privacy policy.

Downloads the app makes

The on-device models (for speech, speaker labels, Screen Memory search and the optional AI that runs on your PC) are not in the installer. When you choose one, the app downloads it, and the program that runs it, from public file hosts: GitHub, Hugging Face and the Python Package Index. The app also fetches two public lists: exchange rates, from open.er-api.com and Coinbase, when you convert a currency in the inline calculator, and a table of AI model prices, from GitHub, for its cost estimates. These are ordinary downloads. They carry nothing you wrote, captured or recorded.

The sent log

The app keeps a line for every request it makes, whether it left this PC or was answered by a model running on it: where it went, how big it was, and the kinds of detail that were masked on the way out. It never keeps the text. The log stays on your PC for 90 days, you can export it, and you can switch it off.

What the website counts

The website counts page views without cookies. When you arrive from a link we tagged for an ad or a post, your browser keeps the name of that campaign (such as "reddit/post/september") for 60 days, in its own storage on your computer. We then count, per campaign, how many visits, downloads and clicks on Buy it produced, and the campaign name goes along with your checkout so a purchase can be counted too.

Those are totals, nothing more. We keep no address, device id, or time with them, we do not tie them to your name or email, and we use no ad pixels or third-party trackers. Clearing this site's data in your browser removes the campaign name.

What the app counts

Once a day the app sends us a small tally so we can see which features get used and which sit idle. It contains: the names of the features that ran and how many times each ran that day, the app version, the Windows version, how many days since install, which plan the copy is on (such as trial, free, licensed or subscription), and a random install id that is not tied to you.

It never contains screen text, file names, window titles, client names, notes, prompts, transcripts, keys, or your email. There is nothing in it we could read back to learn what you worked on.

To turn it off: Settings, Privacy, the Send usage counts switch. Nothing else changes when it is off.

Problem reports

Nothing is sent until you press Send on the Report a problem screen. A report carries what you wrote, your email if you give one, the app and Windows versions, a few facts about the setup (such as how many screens you have and which features are on), and, unless you leave it out, the end of the app's log with personal details masked. You see that log text before it goes. We keep a report for up to about 13 months, to fix the problem and write back.

Purchases

Payments, invoices, and license keys are handled by Lemon Squeezy, our merchant of record, under their privacy policy. We receive the information needed to validate your license (such as your email address and license key status) and nothing else.

Software updates

The app checks a public release feed to offer updates. This is an ordinary HTTPS request and is not used to identify you.

Once per launch the app also asks our server for the oldest version still supported, so a build with a serious problem can be retired. If you have activated a license, that request includes your version number and a one-way fingerprint of your license key. A fingerprint is a hash: it cannot be turned back into your key, and it tells us only that a license was used, and when. We use it to see which licenses are active and which builds are still out there. During a trial the app has no license, so the request carries nothing about you at all. Nothing you write, capture, record, or copy is ever part of it.

Contact

Questions? Email support@keptinflow.com.