Privacy policy

This explains which personal data we process when you use this website, the documentation or the hosted Flowplan app, for what purpose and on what legal basis – and which rights you have.

1. Controller

2. Visiting the website and server logs

When you open this website, the documentation or the app, the server processes technically necessary data: IP address, date and time, the address requested, the amount of data transferred, referrer and browser identification. This serves to deliver the pages, keep them stable and fend off attacks (Art. 6 (1) (f) GDPR, legitimate interest in secure operation). Server logs are deleted after 14 days.

3. Cookies, tracking and embedded services

This website sets one cookie only: “flowplan-lang” stores the chosen language (German or English) for one year. It is required for the function you asked for (§ 25 (2) no. 2 TDDDG). There are no analytics or advertising cookies, no tracking and no profiles. Fonts, images and scripts are loaded from our own servers, not from third parties.

4. The Flowplan app

When you use the hosted app at app.flowplan.org, we process what your account and your work require (Art. 6 (1) (b) GDPR, contract):

• Account data: name, e-mail address, password (only as a secure hash), passkeys, and the provider's details when signing in via SSO.
• Content: pages, databases, comments, files and everything you and your team create.
• Usage data: sign-in times, sessions, an activity log for admins, and versions.
• A session cookie keeps you signed in; it is technically necessary.
• E-mails: confirmation links, invitations and – unless you turn them off – digests of notifications.
• Push notifications only if you turn them on for a device.

The data is stored on our servers and in our backups. If you have your account deleted, your personal data is deleted; contributions to shared workspaces remain without your name. Backups are overwritten within their retention period. We do not pass on data for advertising.

The documentation at docs.flowplan.org processes only the data described in sections 2 and 3.

5. Contact by e-mail

If you write to us, we process your message and address to reply (Art. 6 (1) (b) or (f) GDPR) and delete them once the request is settled and no retention obligation applies.

6. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20) – in the app also yourself via the export,
• object to processing based on legitimate interests (Art. 21),
• lodge a complaint with a data protection supervisory authority (Art. 77).

To do so, contact [email protected].

Last updated: 14 October 2026

Legal notice