Legal

Privacy Policy

Last updated: June 5, 2026

FlowState handles some of the most sensitive data there is — your menstrual cycle, symptoms, and how your body responds to training. We treat it that way. Your data is encrypted, it is never sold, and it is never shared with third parties for advertising. Ever.

The short version: We collect only what we need to generate your workouts and learn your patterns. We never run ads, never broker your data, and you can export or permanently delete everything at any time.

1. Who we are

FlowState ("FlowState," "we," "us") provides a cycle-aware AI training app for iOS. This policy explains what we collect, why, how we protect it, and the rights you have over it. If you have questions, contact us at support@flowstate.co.

2. Information we collect

Information you provide

Account & profile: your name, date of birth, height, weight, training experience, and goals.
Cycle & health data: last period date, average cycle and bleeding length, contraception use, logged periods, daily symptoms, sleep, energy, readiness, and mood.
Training data: completed workouts, the exercises, sets, reps, and loads you log, and your post-session ratings.

Information collected automatically

App & device data: basic app interactions and diagnostic information needed to keep the app stable.
Wearable data (optional): if — and only if — you explicitly connect a wearable, we store the metrics you authorize for that integration.

3. How we use your information

To generate personalized, cycle-aware workouts and adapt them to your daily readiness.
To train a model of your individual cycle and performance patterns so recommendations improve over time.
To sync your data across your devices and back it up so you don't lose it.
To provide support and to keep the app secure and working correctly.

We do not use your health or cycle data for advertising or sell it to anyone.

4. We do not share or sell your data

No data is shared with third parties for advertising or sold to data brokers. Ever. We use a small number of infrastructure providers strictly to operate the service — for example, secure cloud hosting and payment processing through Apple for subscriptions. These providers act on our instructions and are not permitted to use your data for their own purposes. We may disclose information only where legally required.

5. How we protect your data

All cycle and symptom data is encrypted at rest (AES-256) and in transit (TLS 1.3).
Health data is kept in a dedicated, access-controlled store, separated from general profile data.
Access is limited to what is strictly necessary to operate the service.

6. Your rights and choices

You are always in control of your data:

Access & export: request a copy of your data (GDPR Art. 20).
Deletion: permanently delete your account and all associated data from inside the app, under Profile → Delete Account (GDPR Art. 17).
Correction: update your profile and cycle details at any time.
Consent: withdraw wearable or other optional consents whenever you choose.

Depending on where you live, these rights are provided under the GDPR (EU/EEA/UK), CCPA/CPRA (California), and LGPD (Brazil). California residents have the right not to receive discriminatory treatment for exercising their privacy rights — and since we never sell data, there is nothing to opt out of.

7. Data retention

We keep your data for as long as your account is active. When you delete your account, we delete your personal and health data, retaining only what we are legally required to keep (for example, basic transaction records).

8. Children

FlowState is intended for adults and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

9. Not a medical device

FlowState is a fitness and wellness product, not a medical device. It does not diagnose, treat, or prevent any condition. It does not provide medical advice. If anything about your cycle or health concerns you, please speak with a qualified healthcare provider.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you in the app.

11. Contact

Questions about your privacy or this policy? Email support@flowstate.co.