Privacy
How Clariflow handles your account and content. Last updated 12 October 2026.
Who we are
Clariflow is a personal prioritization app at clariflow.net, offered by JDBuilds. Contact: support@clariflow.net.
What we collect
- Launch list — your email address when you ask to receive Google Play launch news and the founding-member Premium offer.
- Account — email address, and optional username, companion avatar, and short onboarding preferences (what you said would help most). Sign-in may use Google OAuth or a magic email link.
- Your content — tasks, goals, ideas, routines, calendar blocks, check-ins (including mood and energy), affirmations, Reset vision-board images you upload, and Chloe chat messages.
- Usage on your device — appearance preferences (background scene is stored on your account when signed in; stars and affirmation visibility stay on this device) stored in your browser’s local storage. These stay on the device unless you clear site data.
- Technical — standard server and auth logs needed to run the service (for example session cookies after you sign in).
How we use it
We use your data to provide Clariflow: ranking today’s Top pick, syncing your list across devices when you are signed in, showing Progress and calendar, running Reset tools, and powering Chloe when you use it. If you join the launch list, we use that email only for Clariflow launch and founding-offer updates. We do not sell your personal data. We do not use your content for advertising.
Chloe (AI)
If you use Chloe, relevant context from your Clariflow account (for example open tasks, energy, and recent check-ins) and your messages are sent to our AI provider (Anthropic) so the coach can reply and act with tools. Do not put secrets in chat that you would not trust a cloud AI service to process.
Google API User Data & Limited Use Disclosure
Clariflow provides optional integrations with Google services, including Google Calendar (read-only agenda display) and Google Drive (personal backup storage). When you connect your Google account, Clariflow requests access only to the minimum scopes necessary to provide these specific user-facing features:
- Google Calendar (https://www.googleapis.com/auth/calendar.events.readonly): Accessed strictly in read-only mode to display your upcoming calendar events alongside your daily tasks in your personal Clariflow agenda. Clariflow never creates, alters, or deletes your Google Calendar events.
- Google Drive (https://www.googleapis.com/auth/drive.file): Used solely to create, view, and update backup files created directly by Clariflow at your explicit direction. Clariflow never reads, views, or modifies any other files in your Google Drive.
Data Sharing, Transfer, and Disclosure
We do not sell, rent, share, transfer, or disclose Google user data to any third parties. Specifically:
- Google user data (including calendar event details, email address, and drive backups) is never shared with third-party advertisers, data brokers, or information resellers.
- Google user data is never used to serve targeted advertisements or personalized marketing campaigns.
- Google user data is never used for training generalized machine learning or artificial intelligence models (including our Chloe assistant).
- Google user data is processed solely to provide the user-requested calendar sync and backup features, and is never disclosed to external parties unless strictly required by applicable law.
Data Protection and Security Mechanisms
Clariflow implements rigorous technical and administrative security measures to safeguard Google user data:
- Encryption in Transit: All data transmitted between your device, Clariflow servers, and Google APIs is encrypted using modern Transport Layer Security (TLS 1.2 and TLS 1.3 / HTTPS).
- Encryption at Rest: OAuth access tokens and refresh tokens are encrypted at rest using industry-standard AES-256 encryption within our Supabase database.
- Row-Level Access Controls: Database tables are strictly governed by PostgreSQL Row-Level Security (RLS) policies, ensuring that each authenticated user can only access their own synchronized data and credentials.
- Revocation & Deletion: You can disconnect your Google account and delete stored tokens at any time in Clariflow Settings under Calendar or Storage. You can also revoke Clariflow's access at any time via Google Account Permissions. Disconnecting or deleting your account immediately and permanently purges all associated Google OAuth tokens from our servers.
Google Limited Use Compliance Statement
Clariflow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Where it lives
- Hosting — the website runs on Vercel.
- Database & auth — Supabase stores your account and content with row-level security so each signed-in user only sees their own rows.
- Email — transactional mail (for example magic links) may be sent through our email provider. Support mail goes to support@clariflow.net.
Retention & deletion
We keep your account and content while your account is active. You can edit or delete individual items inside the app. Launch-list emails are kept until you unsubscribe or the list is no longer needed. To leave the launch list, or to delete your account and associated data, email support@clariflow.net from the address on the account. We will process the request within a reasonable time.
Children
Clariflow is not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect their data.
Changes
We may update this page as the product changes. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.
Contact
Questions about privacy: support@clariflow.net.