Privacy Policy

We process only the data needed to run FlowSet:

• Account data — your email address and basic profile fields you choose to add. FlowSet uses passwordless email authentication (a one-time code or magic link sent to your inbox) — no password is created, stored or transmitted. FlowSet does not currently offer Google or Apple social sign-in.
• Wardrobe content — photos you upload, the AI-generated cutouts of those photos, the category and notes attached to each piece.
• Looks and reflections — outfits you save, journal entries, mood notes, and any reflections you write after wearing a look.
• Usage signals — which screens you open, when you generate a look, and product events that help us understand how FlowSet is used. Stored against your account so we can show you your own activity.
• Historical billing data — for accounts that previously held paid or complimentary access, we may retain historical status, period dates and an opaque Stripe customer ID for accounting purposes. FlowSet is free today and no new charges are taken. Card details were handled directly by Stripe and never reached our servers.
• Onboarding responses — answers to the short welcome questionnaire you're shown when you first sign in, including any optional free-text answer you choose to write. This questionnaire establishes a starting point, helps personalise your experience over time, and — in aggregated form — helps improve FlowSet through product insights. Responses are stored against your account and can be updated or deleted.
• Legal acceptance records — we record the versions of the Terms of Use and Privacy Policy you accepted and when, so we can prove valid consent and re-ask if a material update requires it.
• Progressive learning signals — FlowSet gradually learns from the information you choose to share, your wardrobe and the way you use the app, so that suggestions become more useful over time. As your wardrobe grows, you may occasionally be invited to answer additional short questionnaires that improve future suggestions and your overall experience (see section 7). Participation is always optional.
• Approximate location (optional) — if you grant location permission in your browser or device, FlowSet uses your approximate coordinates to display the local place name and current weather on the Today page (see section 9). Location is never used for advertising, and the app continues to work normally if you decline.
• Communication preferences — what kinds of emails you've opted into and unsubscribe state. Transactional emails (such as account notices and security alerts) are sent as needed. Marketing emails are only sent with your explicit consent and can be stopped at any time.

FlowSet is not intended specifically for children. Where applicable under local law, users who cannot independently provide valid consent should use FlowSet with the involvement or permission of a parent or legal guardian, who may also exercise data-protection rights on their behalf.

• Contract (Art. 6(1)(b)) — to provide the wardrobe, looks, Style Me, reflections, Circle and account features you ask for.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, debug errors, and improve the product through aggregated usage patterns. You can object at any time.
• Consent (Art. 6(1)(a)) — for optional marketing emails, for using your approximate location for weather (section 9), and for any additional questionnaire you choose to answer after onboarding. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — for tax, accounting and billing records we are required to keep.

We use a small number of carefully chosen providers to operate FlowSet. Each one only receives the data they need for their function, under a data processing agreement.

Some of our sub-processors are based outside the European Economic Area, primarily in the United States. Where data leaves the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses (SCCs) and, where available, by adequacy decisions such as the EU–US Data Privacy Framework.

Photos you upload are stored in your private space on our managed storage. They are scoped to your account by row-level security, so no other user can access them. When you view a photo inside FlowSet, it is served through a time-limited signed URL — there is no public link to your wardrobe.

When you ask FlowSet to style you, generate Insights or complete a look, we send the minimum input needed — typically a short text description of your wardrobe and your prompt — to an AI model via the Lovable AI Gateway. For features that need to look at a photo, the image (or a temporary reference to it) is shared with the vision model only for that single request.

We do not allow your photos, reflections or wardrobe content to be used to train any AI model.

FlowSet does not ask you to configure personalisation up front. Instead it learns gradually from the information you choose to share, the pieces you add to your wardrobe, and the way you use the app — so that suggestions become more relevant over time.

As you continue using FlowSet, you may occasionally be invited to answer additional short questionnaires — for example after your wardrobe has grown or you've used a particular feature for a while. These are part of FlowSet's progressive learning approach and are always optional; skipping them never removes access to any core feature.

FlowSet uses a minimal set of cookies and browser local storage to keep you signed in, remember your preferences, and store short-lived drafts (for example unsaved journal text). We do not use third-party advertising or cross-site tracking cookies.

We record product analytics events — such as which screens are opened or how often looks are generated — to understand how the product is used and improve it. These signals are stored against your account so we can show you your own activity, and may be reviewed in aggregated and anonymized form. They never include the content of your photos, notes or reflections.

If you grant location permission in your browser or on your device, FlowSet may use your device's approximate location to display the local place name and current temperature on the Today page. Coordinates are sent to a weather provider and to a reverse-geocoding provider only to produce that single reading, and are not stored against your account.

Location is entirely optional. If permission is denied or unavailable, the weather line is simply hidden and the rest of FlowSet continues to work normally. Your approximate location is never used for advertising.

FlowSet does not sell your personal data. We do not share it with third parties for their own marketing. Data is only shared with the sub-processors listed above, under contract, to operate FlowSet.

Anything you choose to share — for example a look posted to a Circle or exported as an image — becomes visible only to the people you explicitly share it with.

• While your account is active — wardrobe pieces, looks, reflections, journal entries and preferences are kept until you delete them or close the account.
• Account deletion — when you delete your account, your wardrobe photos are queued for immediate deletion from storage, and your wardrobe content, looks, reflections and personal profile data are removed from our database within 30 days. Backups containing residual copies are rotated out within 90 days.
• Historical billing records — invoice records from earlier paid or complimentary access are kept for up to 7 years as required by Swedish accounting law, even though FlowSet is offered as a free service today.
• Legal acceptance and consent records — the versions of the Terms and Privacy Policy you accepted, and any additional consents you gave (for example to marketing emails or to use of approximate location for weather), are kept for as long as your account exists and, in anonymised form, for evidentiary purposes after deletion.
• Email logs — delivery logs (whether an email was sent, opened or bounced) are kept for up to 12 months for diagnostic purposes.

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten") — most of this you can do yourself from inside the app, or by writing to us;
• restrict or object to certain kinds of processing;
• receive a copy of your data in a portable, machine-readable format;
• withdraw any consent you previously gave;
• lodge a complaint with IMY, Sweden's data protection authority, if you believe we have processed your data unlawfully.

To exercise any of these rights, email us at hello@everydayflow.life. We respond within 30 days.

You can delete your account yourself at any time from Account Settings. The process is immediate, irreversible, and removes your data as described in section 11. If you prefer, you can also request deletion by emailing hello@everydayflow.life from the address tied to your account.

All connections to FlowSet are encrypted in transit (TLS). Wardrobe content is stored on managed infrastructure with row-level security so each row can only be read by its owner. FlowSet uses passwordless email sign-in (one-time code or magic link), so no password is stored on our side. Any historical payment card data was handled exclusively by Stripe and never stored on our servers.

We may update this policy as FlowSet evolves. When we do, we will change the "Last updated" date at the top of the page. Material changes will be communicated by email or in-app notice before they take effect.