Privacy Policy

What this service does

AppFlowOS connects to your GitHub repositories, maps the user flows in your application, and runs tests against them. Doing that means holding a GitHub token on your behalf and storing screenshots of your own application.

Data we store

• Your account — email address, name, and the avatar URL GitHub supplies.
• A GitHub access token, so we can read the repositories you connect. It is stored against your account and used only for repositories you have linked. Disconnect the integration and the token is removed.
• Your repositories and flows — the repositories you connect, the flows and steps we derive from them, and the external systems those flows touch.
• Screenshots — captured while running your flows, kept as baselines and diffs so a visual change can be detected. These are pictures of your application, and will contain whatever your application renders, including any test data you use. Do not point AppFlowOS at a flow that displays real personal data you would not want stored.
• Test results and health history — what ran, when, and whether it passed.
• Teams, notifications and webhooks — membership, your notification preferences, and the endpoints you ask us to call.

Who else receives your data

• GitHub — you authenticate there, and we read the repositories you connect using the token you grant.
• Stripe — checkout and subscription handling for paid plans. Card details go to Stripe directly and are never stored here.

Product analytics run on our own analytics-os instance, not a third-party service. Events are sent from our server, so the analytics credentials are never exposed to your browser. We do not sell or rent your personal data.

Cookies

A session cookie keeps you signed in. It is strictly necessary and is not used for tracking or advertising. There is no third-party advertising or cross-site tracking on this service.

How long we keep it

Account, repository and flow records last while your account exists. Screenshots and test results are kept as history so changes can be compared over time; deleting a flow removes the screenshots taken for it. Delete your account and the associated records go with it.

Your rights

If you are in the EU or UK you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to privacy@blueforge.studio and we will respond within 30 days.