Privacy Policy

We collect the following limited information when you use GenFlow:

• Account information: Email address used to create your account.
• Google account information: If you sign in with Google, we receive your email address and basic profile information (name, profile picture URL) via Google OAuth. This is used solely to identify your account and is stored minimally on our servers.
• Usage data: Daily generation counts to enforce plan limits.
• Payment information: Processed entirely by Dodo Payments. We do not store credit card numbers or payment details.
• Search keywords (anonymous): When the news search feature returns no results, the keyword and language may be anonymously logged to improve search quality. No account or device identifiers are stored with this data.

• To authenticate your account and maintain your session.
• To enforce daily usage limits based on your subscription plan.
• To process subscription payments through Dodo Payments.
• To send transactional emails (e.g., password reset).

GenFlow is a browser extension that automates actions on supported AI platforms. Here is exactly what it does and does not do:

• Page automation: Only when you explicitly start a batch job, the extension uses your existing logged-in session to enter your prompts and click the generate button on supported platforms (Google Flow / labs.google, Gemini, Kling AI, Grok Imagine / X, Seedance / Dreamina/Jimeng, ChatGPT, Meta AI). It reads the page's DOM (e.g., button state, generation progress) to do this, but does not collect, store, or transmit any personal data or account information from those pages.
• Downloads: When you request it, the extension automatically saves completed images or videos to your local disk. These files are never uploaded to GenFlow's servers.
• Tabs & windows: The extension checks whether your active tab is a supported platform and opens, closes, or focuses tabs and popup windows as needed to run batch jobs and to complete Google sign-in. It does not read the content of unrelated tabs.
• Sign-in (identity): When you choose to sign in with Google, the extension uses Chrome's identity flow to open the Google sign-in window. It does not access your Chrome browser identity or any other Google account data beyond the sign-in itself.
• Background scheduling (alarms): The extension periodically checks whether your session is still valid and refreshes it in the background so you stay logged in. This does not run any page automation on its own.
• Local settings storage: Your UI preferences (preferred model, aspect ratio, language) are stored locally on your device using Chrome's storage API and are never sent to GenFlow's servers. Prompt text may also be temporarily stored locally to support autocomplete and reuse in the input field; this text is not transmitted to our servers.

• We do not collect or store the content of your prompts.
• We do not collect or store generated images or videos.
• We do not sell your data to third parties.
• We do not use your data for advertising.

Your account data is stored securely on Supabase (PostgreSQL), hosted on AWS infrastructure. Payment and billing data is managed by Dodo Payments under their own privacy policy.

The Extension stores your session token in Chrome's local storage to keep you logged in. No tracking cookies are used.

If you sign in with Google, the temporary Google OAuth access token is sent once to our server to verify your identity and is never stored — it is discarded immediately after verification. Our server then issues its own session token, which is what the Extension stores locally (as noted above). This session token is retained only until you sign out — we do not keep it for any fixed period beyond that — is used solely to keep you logged in, and is never shared with or transmitted to any third party.

• Supabase: Authentication and database — Privacy Policy
• Dodo Payments: Payment processing — Privacy Policy

You have the right to access, correct, or delete your personal data. We retain your account data for as long as your account is active.

To prevent abuse of our free trial, your email address is retained for up to 1 year after account deletion solely for eligibility verification. No other personal data is kept.

To exercise these rights or request account deletion, contact us at support@genflow.work.

We keep different types of data for different lengths of time, only as long as necessary for the purpose it was collected for:

• Account information (email): Retained while your account is active; up to 1 year after account deletion solely for free-trial abuse prevention, then deleted.
• Google account information: Retained while your account is active, for the same period as your account information above.
• Session token (incl. Google sign-in): Retained only until you sign out. The temporary Google OAuth access token itself is never stored — it is discarded immediately after one-time verification.
• Usage data (daily generation counts): Retained while your account is active, to enforce plan limits.
• Payment information: Not stored by us — managed entirely by Dodo Payments under their own retention policy.
• Anonymous search keywords: Retained without any account or device identifier; not linked back to you.

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or in-app notice.