Privacy

Privacy Policy

Effective October 26, 2026. This policy covers flowstatemcp.com, FlowState Relay (your address at fsmcp.com) and the accounts that run them. They are provided by DialectForge LLC, a Delaware company ("DialectForge", "we", "us"). It says what we collect, why, who helps us run the service, and what you can do about it. It describes what the service does today.

The short version

What matters most, in five lines.

Your projectsFlowState keeps your project memory in a SQLite file on your own computer. We don't have a copy. The relay passes your encrypted traffic through without opening it.
No sellingWe don't sell or rent your personal information, and we don't share it for advertising.
No AI trainingWe don't use your data, or anything that passes through the relay, to train AI models, ours or anyone else's.
Small footprintAn account is an email address, the sign-in methods you link, one host device and a 30-day connection log.
Free and openFlowState itself is open source under the MIT license. It stays free to run on your own computer, with no account.

FlowState on your computer

FlowState, the open-source server you install, runs on your computer and needs no account.

Your databaseYour project memory is one SQLite file on your computer. We can't see it, we don't receive it, and we can't recover or delete it for you.
No analyticsLocal FlowState sends us no usage data, analytics or crash reports.
What you turn onSome features talk to other services from your computer, only after you turn them on: an off-site backup to your own private GitHub repo, the relay, a certificate from Let's Encrypt for your relay address, and a daily check of public Certificate Transparency logs. Those services' own terms and policies apply.
Update checkOnce a day FlowState checks GitHub's public releases for a newer version. The request goes straight from your computer to GitHub, not to us, with no sign-in and no version number, so we don't see it, and GitHub's own privacy policy covers it. You can turn it off with flowstate update check off or FLOWSTATE_UPDATE_CHECK=0. Updates never install on their own: FlowState updates only when you run flowstate update.

What we collect

For the website and the relay. This is the complete list today.

Email addressThe address you sign in with: the one Google or GitHub gives us, or the one you type for an email code. We use it to sign you in and to contact you about your account.
Sign-in profileIf you sign in with Google or GitHub, Supabase (our sign-in provider) stores the profile details they send, usually your name, username, profile picture link and your account id with them. This website reads only which sign-in methods you have linked.
Sign-in recordsSupabase keeps when your account was made and when you last signed in, and for each active session the IP address and browser (user agent) it started from.
Account rowOne row per account: a random id, when it was made, your plan, and a deletion date if you delete it. No email or name.
Your deviceFor the device you enroll: its address (<handle>.fsmcp.com), its status (active, suspended, removed), when it was added, changed and last seen, the account it belongs to, and a hash of its device token, not the token itself. Enroll codes are kept only as hashes.
FlowState versionThe FlowState version your device reports when it connects (for example 2.4.0), kept with your device's record. We use it to show you on your account page whether your FlowState is up to date. It is deleted when the device is removed, revoked or unenrolled.
Connection logFor each connection through the relay: the device, the IP address of the app that connected, when, how long it lasted, and bytes in and out. You can see it on your account page.
Relay log filesThe same kind of facts, plus events such as your device connecting and disconnecting, with your computer's IP address. Never content, tokens, URLs or headers.
WaitlistIf the beta is full when you enroll: a hash of your enroll code, when you tried, and your place in line.
Hosted waitlistOptional: if you join the Hosted waitlist, we keep your email address (and your answer to "would you pay for it?", if you give one) in our Supabase database only to tell you when Hosted launches, remove it whenever you ask, and never sell or share it.
Web requestsLike every website, each request to flowstatemcp.com carries your IP address, browser and the page asked for. Cloudflare, which runs this website, processes them, and keeps request logs for a short time.
Page viewsCloudflare Web Analytics counts page views. It sets no cookies. We use it only to see which pages are read.

What we don't collect

Project dataYour memory, notes, code, prompts and anything else in FlowState are never sent to this website. The relay copies the encrypted bytes between the app and your computer without decrypting them (TLS passthrough), so it can't read them, and it doesn't store them.
ApprovalsThe phone approval and "Waiting for you" pages show their details from your own FlowState. This website signs a pass that lasts 5 minutes and names only your device and that link. It never sees what is waiting or being approved.
PasswordsThere are none to collect.
Payment detailsThere are no paid plans today.
Ad trackingNo ads, no advertising pixels, no third-party trackers.

How we use it

Run the serviceSign you in, show your account page, enroll your device and route connections to it.
Keep it safeRate limits per IP address and per account, protecting accounts, and looking into misuse.
Talk to youSign-in codes, and important notices about your account or the service, such as a change to this policy. No marketing email unless you ask for it.
Make it betterPage view counts, to see which pages help.
Follow the lawWhen the law requires it.

If you are in the EU, the UK or a similar place: we use your information to provide the service you signed up for (a contract), for our legitimate interests in keeping the service secure and working, to meet legal obligations, and with your consent where we ask for it.

Cookies

flowstatemcp.com sets only the cookies it needs to work. All are first-party, HttpOnly (page scripts can't read them), Secure (HTTPS only) and SameSite=Lax. There are no advertising or analytics cookies.

Session__Host-fs_session keeps you signed in. It is encrypted, and lasts up to 30 days or until you sign out.
Form token__Host-fs_csrf is a random token that proves a form came from this site. It ends when you close your browser.
Sign-in step__Host-fs_flow holds a Google or GitHub sign-in in progress, encrypted. It lasts 10 minutes and is used once.
Email step__Host-fs_otp holds an email code sign-in in progress, including your email address, encrypted. It lasts 15 minutes.
Your addressPages at <handle>.fsmcp.com are served by FlowState on your computer, not by us. FlowState sets its own short-lived cookies there (5 to 60 minutes) for approvals and the review list. They stay between your browser and your computer.

Who helps us

We use these providers to run the service. They handle data for us under their own terms and privacy policies.

SupabaseSign-in and the account database: your email address, sign-in profile, sessions and account row. Hosted in the United States (US East).
CloudflareRuns this website, counts page views, applies rate limits, and answers DNS for fsmcp.com. Relay traffic does not pass through Cloudflare.
ResendDelivers the sign-in code emails. It receives your email address and the email.
Google, GitHubOnly if you choose them to sign in. They tell Supabase who you are. Your account with them is covered by their own policies.
Relay hostingThe relay runs on a server we rent from a cloud hosting provider in the United States.
StripeNot used yet. When paid plans launch, Stripe will process payments, and we will never see your full card number. We will update this policy first.

We share personal information with others only when the law requires it (for example a valid court order), to protect people or the service from harm or abuse, or as part of a merger or sale of DialectForge, in which case this policy keeps applying to your information and we will tell you.

Public by design

Your addressYour computer gets its relay certificate from Let's Encrypt. Every certificate is published in public Certificate Transparency logs, so anyone can see that your address (<handle>.fsmcp.com) exists. The address is random and does not contain your name or email.

How long we keep it

AccountYour email, sign-in profile, account row and device: while you have an account.
Connection log30 days, then deleted automatically.
Relay log files30 days, then deleted automatically.
Enroll codesThe hash is deleted about a week after the code expires (codes expire after 15 minutes).
Provider logsCloudflare and Supabase keep their own short-term service logs on their own schedules.
BackupsOur providers (such as Supabase and our hosting provider) may keep routine backups for a limited time under their own policies, so deleted data can persist in those backups until they expire. We don't promise to keep backups of FlowStateMCP account or relay data. Your FlowState memory stays on your own computer, and backing it up is up to you.

Deleting your account

You can delete your account yourself: on your account page, under Delete account, type delete and confirm. If you can't sign in, email us from the address on the account.

RemovedYour relay device and its address (it stops working at once), your connection log, unused enroll codes, your waitlist place, and your Supabase sign-in record: email, sign-in profile and sessions.
Left behindYour account row, marked deleted, with no email or name in it. The relay's record of your retired address, no longer linked to you, so the address is never given to anyone else.
Rolls offRelay log files and provider logs are not edited; they are deleted on their normal schedules (30 days for the relay's).
Not touchedFlowState on your computer and its data. Run flowstate relay forget there to remove the device token and keys.

Your rights

You can ask us to do any of these. Email us; we will answer within 30 days, and may ask you to confirm the account is yours, for example by writing from its email address.

See itYour account page shows your email, sign-in methods, device and the last 30 days of connections. Ask us for a copy of everything else we hold about you.
Export itThere is no export button yet. Ask us and we will send your data in a common format (JSON).
Fix itAsk us to correct anything that is wrong.
Delete itFrom your account page, or by email.
Object or limitAsk us to stop or limit a use of your information.

Depending on where you live (for example the EU, the UK or California) you may have more rights, and you can complain to your local data protection authority. We will not treat you differently for using any of them.

Children

FlowStateMCP is not for children under 13, and we don't knowingly collect information from them. If the law where you live sets a higher age for agreeing to this on your own (up to 16 in parts of Europe), you need a parent or guardian's permission below that age. If we learn we have information from a child under 13, we will delete it. Tell us at support@flowstatemcp.com.

International users

DialectForge is in the United States, and our account database and the relay server are in the United States. Cloudflare answers requests from the location in its network nearest to you. If you use the service from outside the United States, your information is transferred to and processed in the United States and other countries, whose laws may differ from yours. Where the law requires it, we rely on our providers' data protection terms (such as the EU Standard Contractual Clauses) for these transfers.

Security

We protect accounts with encrypted session cookies, strict page rules, rate limits and short-lived codes, and the relay never holds the key to your traffic. No system is perfectly secure, and no outside firm has audited FlowState, the relay or this website. The details, including the limits, are on how FlowState is secured. Found a problem? Email support@flowstatemcp.com.

Hosted tier (planned)

Not available yet. Nothing in this policy describes it.

Planned: a Hosted tier that keeps your FlowState data on our servers, with backups, encryption at rest, export and erase.

To hear when it launches, join the Hosted waitlist (see What we collect).

Before it launches, we will update this policy to say what it stores, where, how it is encrypted, how backups work and how long they are kept, and how export and erase work. The same goes for the planned Map tier and for paid plans.