ADHD Flow Privacy Policy

Effective and last updated: July 27, 2026

This policy covers the ADHD Flow web/mobile app and browser extension. It explains what stays on your device, what is sent when you use a connected feature, and the controls available to you. A French summary follows the complete English notice.

1. Controller and contact

The data controller is THE YOLO COMPANY, SAS (société par actions simplifiée), SIREN 845 315 191, registered office at 15 Rue Rose Pierre de Ronsard, 49110 Mauges-sur-Loire, France. For privacy questions or requests, email privacy@theyolocompany.com. You may also contact the French supervisory authority, the CNIL.

2. Local-first does not mean “nothing ever leaves your device”

The extension works locally by default. Priorities, tasks, notes, focus sessions, settings, progress, locally derived productivity statistics, and the list of sites you choose to allow or set aside are stored in the extension’s browser storage. The active tab address is evaluated locally for the site blocker and is not sent to us for analytics or advertising. Some non-sensitive preferences may use your browser vendor’s sync storage under that vendor’s policy.

The connected app requires an account. It writes supported data locally first so the app can continue during a temporary loss of connection, then synchronizes it with our account backend. An extension user may optionally connect the same account. Connected features described below send only the data needed to perform the action.

3. Data we process

• Account and authentication: email address, internal user ID, selected sign-in provider, authentication session, locale, plan and entitlement status.
• Content and productivity data: priorities, tasks, subtasks, notes, ideas, templates, day plans, settings, focus results, daily statistics and optional Garden progress that you choose to synchronize.
• Device and sync data: random device ID, platform, app version, last sync time, pending changes and deletion markers needed to resolve updates across devices.
• Optional integrations: private iCal feed address and read-only calendar events; AI prompt content and generated result; voice audio when you explicitly select cloud transcription; anonymous body-doubling presence; and weekly focus summary data when you opt in.
• Payments: Stripe customer/subscription identifiers, plan, status and transaction information needed to grant access and meet accounting obligations. ADHD Flow does not receive or store complete card details.
• Security and reliability: request rate-limit counters, security events and, only when production error reporting is enabled, a function name, error message and shortened stack trace. Our reporting code is designed not to attach notes, task titles, URLs, tokens, complete sync mutations or payment details.

We do not ask whether you have a medical diagnosis. The content you enter may nevertheless reveal health or other sensitive information, so avoid entering information you do not need for the productivity feature.

4. Why we process it and our legal bases

• To create your account, provide sync, preserve your settings, run focus features, export your data and manage your plan: performance of our contract.
• To provide cloud AI, cloud transcription, calendar import, body doubling or a weekly email only after you choose the feature: your consent, which you can withdraw in settings.
• To protect accounts, prevent abuse, investigate faults and keep the service reliable: our legitimate interests in security and service operation.
• To retain invoices and transaction records required by tax, accounting or consumer law: compliance with legal obligations.

AI suggestions support your own planning. They do not make legal or similarly significant decisions about you.

5. Optional AI and voice choices

AI is off until you select it. In the extension, compatible on-device AI stays on the device. If you add your own API key, relevant content is sent directly to the provider you choose: Anthropic, OpenAI, DeepSeek, Mistral AI or Google Gemini. The key is encrypted in local extension storage, is not synced with your ADHD Flow account and is not sent to us.

In the connected app, an AI request may be routed through our backend to the production provider enabled for that feature (Anthropic or Mistral AI). The request is used to return the requested result and is not used by us for advertising. Cloud Whisper transcription sends the selected recording to OpenAI. Browser speech recognition may be processed by your browser or operating-system vendor; consult that vendor’s settings and policy.

6. Processors and disclosures

We use processors only to provide the service:

• Supabase for authentication, database, synchronized storage and server functions.
• Vercel for website hosting and delivery.
• Stripe when payments are available.
• Resend when you opt into a weekly email and production email delivery is enabled.
• Sentry only when production error reporting is enabled.
• The AI provider described in section 5 only when you request that provider-backed feature: Anthropic, OpenAI, Mistral AI, Google, or DeepSeek.

Your browser vendor, app store and payment provider may separately process account, installation or transaction data under their own policies. We do not sell personal data, share it for cross-context behavioural advertising, show third-party ads or build a browsing profile.

7. International transfers

Some processors may handle data outside the European Economic Area. Where required, we rely on an adequacy decision, the EU–US Data Privacy Framework for a participating provider, or European Commission Standard Contractual Clauses and supplementary safeguards. A direct connection made with your own AI key is also governed by the provider agreement you chose.

8. Retention

• Local extension data: until you delete it, clear extension storage or uninstall. Browser-synced preferences can remain in your browser account until removed through that browser.
• Connected account content: until you delete the item or account. Sync deletion markers are retained for up to 90 days so an offline device cannot restore a deleted item.
• Calendar feed and weekly summaries: until you disconnect/opt out or delete the account. A summary already sent remains in your mailbox until you delete it.
• AI and transcription: ADHD Flow does not intentionally retain a separate copy after returning the result; any result you save follows the content rule above. Provider-side retention follows the provider policy and account/API settings.
• Technical error reports: no more than 30 days when enabled.
• Billing and legal records: for the statutory period that applies to the transaction. Stripe may retain records independently where law requires it.

Deletion removes data from active systems. Encrypted disaster-recovery backups may retain a protected copy until the relevant backup is overwritten; such copies are not used for ordinary processing.

9. Your choices and rights

You can correct content in the app, turn optional features off, export your data and delete your account from Settings. The same instructions and an email route are available at adhdflow.app/delete-account. You may ask for access, rectification, erasure, restriction, portability or objection by emailing privacy@theyolocompany.com. We may ask you to verify control of the account. Withdrawing consent does not affect earlier lawful processing.

10. Security

We use HTTPS, Row Level Security for connected account records, least-privilege server functions, rate limits, restricted extension permissions, a no-remote-code extension policy, encrypted local API-key storage and account-scoped deletion. No system is perfectly secure; contact us promptly if you believe your account or data is at risk.

11. Children

ADHD Flow is designed for adults and is not directed to children below the digital-consent age that applies where they live (15 in France). We do not knowingly create accounts for such children. Contact us if you believe a child has provided personal data.

12. Changes

We will update the date above when this policy changes. If a change materially affects how connected data is used, we will provide an in-product or email notice when appropriate and request fresh consent where law requires it.