Privacy Policy

1. What we collect

We collect only what we need to run the Service:

• Account data: email address, name, password (stored only as a salted hash), and whether your email is verified.
• Purchase data: what you bought, when, the amount, discount codes used, and the processor's transaction id. Card numbers are entered directly into Authorize.net's secure form and never touch our servers.
• Usage data: which chapters you've watched and how far, live-event ticket and entitlement status, playback requests, and live-feed or replay state, so we can grant access, deliver signed playback and show progress.
• Community data: forum posts, comments, reviews, private messages and attachments you send, reactions, reports you file, and live-chat messages. A live-chat message is stored with your account and the event where you posted it.
• Instructor data (instructors only): profile, bio, photo, links, sales, and the id of your Stripe Express account. Identity and bank details for payouts are collected by Stripe, not by us.
• Technical data: IP address, browser/user-agent and timestamps for sessions (for security), and server logs retained briefly for debugging.

2. How we use it

• To provide the Service: accounts, purchases, streaming, your library, community features and messaging.
• To pay instructors their share of sales and to produce financial records.
• To send transactional email: receipts, magic-link sign-in, password resets, and notifications about messages you've received (you can mute conversations to stop these).
• To keep the Service secure, prevent fraud and abuse, and enforce our Terms, including reviewing reported content.
• To improve the Service using aggregate, de-identified usage statistics.
• We do not sell your personal information and we do not use it for third-party advertising.

3. Who we share it with

We share data only with providers that help us run the Service, each bound to use it only for that purpose:

• Authorize.net processes customer card charges, voids and refunds through its hosted payment form.
• Stripe processes instructor onboarding, Connect payouts and the ACH funding used for the separate payout rail.
• Mux provides video hosting, live streaming, signed playback delivery and live-event recordings. It processes playback requests and tokens, live-stream state, and the broadcast media needed to deliver video to entitled viewers.
• Vercel hosts the Service, and Vercel Blob stores message attachments and other uploaded files.
• Neon hosts our database.
• Resend delivers transactional email.
• When an instructor uses the browser broadcaster, our live relay's hosting infrastructure (currently Fly.io) temporarily processes the live media while forwarding it to Mux.
• Instructors see aggregate sales figures and the first name / display name of purchasers who review or comment on their content; they do not see your payment details.
• Other members see what you choose to make public (display name, posts, comments, reviews and live chat) and what you send them privately.
• Authorities or other parties when required by law, to enforce our Terms, or to protect the rights, safety or property of Flowstate, our users or the public.
• A successor, if Flowstate is acquired or merges, under the same commitments.

4. Camera, microphone and live broadcasting

The Flowstate Live Android app asks for camera and microphone permission so an instructor can broadcast. After permission is granted, the camera is used for an on-device preview. Camera and microphone media are transmitted only when the instructor taps GO LIVE, then sent by RTMPS directly to Mux until the instructor stops or leaves the broadcaster. Flowstate does not use those permissions for advertising or unrelated background collection.

The browser broadcaster also asks for camera and microphone permission and opens a local preview. When the instructor starts the broadcast, it sends short live media chunks over an encrypted WebSocket to the Flowstate relay. The relay transcodes and forwards those chunks to Mux as they arrive; it does not write or persist the broadcast media. Mux may record the broadcast for replay as described above.

5. Cookies

We use a small number of strictly necessary cookies: a session cookie that keeps you signed in, and cookies that remember your cart and discount code. We do not use advertising or cross-site tracking cookies.

6. Retention

Account and purchase records are kept while your account exists and for as long as needed afterwards for tax, accounting and dispute purposes (generally seven years for financial records). Community content may remain visible after account closure unless you delete it or ask us to. Live-chat messages are retained with the event and may remain visible to entitled replay viewers; deleted messages are hidden but may remain in backups for a limited period. Server logs are kept for a short period. Unsent messages are hidden immediately and purged on our normal schedule.

7. Your choices and rights

• Download a copy of your data, or delete your account, from the Account page. You can also correct your details there or ask us for anything else by email. Deleting your account removes your profile, sign-in details and linked TVs, and releases your display name from anything you posted; we keep the financial record of purchases and refunds for as long as tax and accounting law requires, because we are not permitted to delete it.
• Mute any conversation to stop message notification emails; transactional emails (receipts, security) can't be turned off while you have an account.
• Depending on where you live (for example California or the EU/UK) you may have additional rights to access, delete, correct, port or restrict processing of your data, and to complain to a regulator. Email us and we will honor them.
• We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete it.

8. Security

We use HTTPS everywhere, hashed passwords, database-backed sessions that can be revoked, signed video playback URLs, hosted card entry (PCI SAQ-A scope), and least-privilege access to production systems. No system is perfectly secure; if we learn of a breach affecting you we will notify you as required by law.

9. International users

We are based in the United States and process data there. By using the Service you understand your data will be transferred to and processed in the US.

10. Changes and contact

We'll post changes here with a new effective date and notify you of material changes. Privacy questions: legal@flowstateinstructionals.com.