What we hold,
and what we refuse to collect.

Docs Flowy is operated by Tulmira Ltd, company number 17497033, registered at 128 City Road, London EC1V 2NX. For the personal data described here, Tulmira Ltd is the controller within the meaning of the General Data Protection Regulation.

Write to [email protected] about anything in this policy, including a request to exercise your rights. Security reports go to [email protected]. We have not appointed a data protection officer, because we are not required to; if that changes, this section will name them.

Grouped by where it comes from. None of it is collected for advertising and none of it is sold.

Your account

Your email address, your full name, and the handle you claim once. The handle cannot be changed afterwards, because it is written beside your name on rows that outlive it. If you sign in with a password we hold an argon2 hash of it and never the password. If you connect a GitHub account we hold its numeric id, its login and the address of its avatar image. If you upload an image or choose one of our avatars, we store it with your account: an uploaded image is re-encoded at two small sizes, with any location data in the original discarded. Only you, the owners and administrators of your organization, and people who share a project with you can see it, and it is never shown on a public Handbook site. An uploaded image is deleted when your account is deactivated or deleted.

Sessions

A coarse label for the device — platform and browser family, with no version — an IP address truncated to a /24 or a /48, and a last-seen time rounded to five minutes. No city, no country, and no flag guessing whether a sign-in was unusual: one needs a geolocation database and the other needs a model of what is usual for you, and we build neither.

Organizations

An organization's name, who belongs to it, their roles, the teams they are in, and the invitations that have been sent. An invitation link is itself a credential, so only a SHA-256 of the invite token is stored — never the token, in the database or in a log line.

Repository content

The markdown and .mdx files inside the docs root of a repository you connect, fetched read-only over the GitHub and GitLab APIs. A repository is never cloned and nothing is ever written back to it. We store the raw markdown as the source of truth, a sanitized rendering of it as a cache, and each file's path and blob SHA so that a change can be noticed without fetching the file again.

What your team creates here

Review and implementation status set on a document, notes and their replies, read receipts, audit events, notifications, artifacts an agent filed, and the findings of the docs-health pass. This is work done in Docs Flowy rather than anything taken out of your repository.

Billing

Payments run through Stripe. No card number, expiry date or security code ever reaches us. We hold the Stripe customer, subscription and price identifiers, and the number of seats an organization held during a billing period.

Security and operations

The client address resolved for each request, which is what enforces an organization's IP allowlist; the audit trail; and application logs kept for diagnosis.

The rule is to hold the least durable form of a secret that still works.

GitHub installation tokens are minted on demand from the App's private key and held in memory for the hour they last. Nothing token-shaped from GitHub is written to the database.

A GitLab access token that you paste is encrypted under a key used for nothing else, so rotating the session secret — which is routine — does not touch it. A token carrying a write scope is refused at connect, by name, and so is a token with no expiry.

An API key exists in full exactly once, in the response that mints it. Only a SHA-256 of it is stored and there is no recovery path, because a recovery path would mean the key was kept somewhere.

The session cookie is encrypted rather than merely signed, since it can carry a GitHub token. Passwords are hashed with argon2 and are never stored in a form anybody can read.

Performance of a contract, Art. 6(1)(b). Everything needed to give you an account, read the repositories you connect, render documents to the people you authorize, and take payment for a paid plan.

Legitimate interests, Art. 6(1)(f). Keeping the service secure, maintaining an audit trail an organization can rely on, preventing abuse, and diagnosing faults. We weigh those against your interests, and the data we decided not to collect is part of how.

Consent, Art. 6(1)(a). The AI features, which stay off until somebody turns them on, and any optional email. Consent can be withdrawn at any time, and withdrawing it does not make what happened before it unlawful.

Legal obligation, Art. 6(1)(c). Tax and accounting records for payments, and answering a request we are legally required to answer.

AI features are off by default. An organization turns them on deliberately, through somebody holding the right to do so, and the change is written to that organization's audit trail with their name on it. Until then no document reaches any model.

When they are on, the text of the document in question and the question being asked are processed by a private language model that we run on our own infrastructure. Your content is not sent to a third-party model provider, and it is never used to train any model, ours or anybody else's.

There is no free-text question. Only a question the current summary itself offered may be asked, which is what stops a signed-in reader turning the feature into an open channel to a model at the organization's expense.

An empty document produces no call at all. Prompting a model not to invent is a request; not calling it is a guarantee.

An answer is cached against the blob SHA of the content it describes. Serving a cached answer makes no new call and spends no credit, and when the content changes the summary is marked as drifted rather than quietly served as though it still matched.

What is retained is the generated summary or answer, stored against the document and deleted when the document, the repository or the organization is deleted. Credit accounting records how many calls were made and never what was in them.

Generated output can be wrong. It is a starting point, and the person acting on it is responsible for checking it. An agent may state that feedback has been addressed; only a person can close it.

A document is held while its repository is connected. Disconnect the repository and what we fetched from it is removed, along with the rendered copy cached beside it.

The audit trail and notifications are each kept for 30, 90, 180 or 365 days depending on the plan. Moving to a plan with a shorter window hides older audit records at once, and they are deleted within a day. The notification window applies to unread ones too — a window that spares whatever you never opened is a window that can be aimed.

A session is held until it is revoked or expires. Deleting your account removes it and the data belonging to it. Deleting an organization removes it and every member's account, with the data belonging to them, because an account belongs to its organization.

Records we are required to keep for tax and accounting are kept for as long as the law requires and no longer.

The list is short by design and nobody is on it for advertising. We do not sell personal data, and neither this site nor the product carries third-party analytics or tracking cookies.

The language model runs on infrastructure we operate ourselves. It is not a sub-processor and no model provider receives your content.

[HOSTING PROVIDER]

Hosting and the managed database, in [HOSTING REGION]. Everything described above is stored there.

Stripe

Payments, invoicing and tax calculation. Your card details go to Stripe directly and we receive identifiers back.

[EMAIL PROVIDER]

Transactional mail only: invitations, address verification, password resets and notification mail. There is no marketing list to be on.

GitHub and GitLab

The sources we read from, under the access you grant. Your relationship with them is yours; we hold the credential you gave us and nothing besides.

Personal data is stored in [HOSTING REGION]. Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision where one exists and otherwise on the European Commission's standard contractual clauses under Art. 46, together with whatever additional measures that transfer needs.

Write to [email protected] for the basis relied on for a particular sub-processor, and for a copy of the clauses.

You have the right to ask for a copy of your personal data, to have it corrected, to have it erased, to restrict or object to how it is processed, and to receive it in a portable form. Where processing rests on consent, you can withdraw that consent at any time.

Some of this is faster in the product than by email: your profile is editable, your sessions can be revoked one at a time or all at once, and an account can be deleted from its own settings. Deletion is refused in one case only — where you are the last Owner of an organization other people belong to, which would leave that organization with nobody able to administer it. Hand it over or delete it first.

For anything else, write to [email protected]. We answer within one month of receiving the request, as Art. 12(3) requires, and we tell you within that month if a complex request needs longer.

You can also complain to a supervisory authority, in the country you live in, the country you work in, or the country where you think something went wrong. We would rather you told us first, but that is your right and not a step you owe us.

Three cookies, none of them for advertising and none of them shared with anybody.

There is no analytics cookie, no advertising cookie, and nothing that follows you to another site. That is also why you are not asked to dismiss a banner: a strictly necessary cookie and a preference you set yourself do not need consent.

The session cookie

Strictly necessary. Encrypted rather than merely signed, HttpOnly, and SameSite=Lax — which is also why the console never calls the API across origins. It is what keeps you signed in, and signing out removes it.

The language preference

Records which of the three languages the site is serving you, so it stays in that language. A preference, not a credential.

The appearance preference

Records the theme you chose, so a page does not open in the wrong one and then correct itself.

Access to a source repository is read-only, and it is revocable from GitHub or GitLab without asking us first.

Documents are sanitized on the server, against an allowlist, before they are stored — markdown permits raw HTML, and one code path that forgets to filter is one code path that serves an exploit. Credentials are encrypted. An organization can require that every request arrive from an address it named, sign every member out at once, and set how long a session may live.

Every change that matters is written to the audit trail inside the same transaction as the change itself, so a record cannot survive a change that was rolled back or go missing for one that landed.

If a personal data breach occurs, we notify the competent supervisory authority within 72 hours where Art. 33 requires it, and we tell the people affected directly where Art. 34 requires it. No security work is a guarantee, and we would rather write that than imply otherwise.

Docs Flowy is a tool for people at work and is not intended for anyone under 16. We do not knowingly create accounts for children. If you believe a child holds an account here, write to [email protected] and we will remove it.

When this policy changes we update the date at the top of the page. Where a change materially affects how personal data is processed, we tell account holders by email before it takes effect, and where a change needs your consent we ask for it rather than assume it.

This version takes effect on 2026-09-19 and replaces any earlier one.