Privacy Policy

The short version

The content you create lives on your device, not on our servers - because we do not run servers that hold your data. We have no user accounts, we never sell your data, and we do not run ads or track you across other apps.

Most Flowstate apps are offline-first: everything you have already saved works with no connection. Some reach the network for one specific purpose, like searching Apple Maps for a place to add in Worldly, and a few, like HogWatch, are clients for a service you already use and connect to it directly with your own credentials. Either way, nothing routes through us.

ShipLocal, our Mac app, is the same shape with more moving parts: it talks to App Store Connect and to the AI provider whose key you supply, both with your own credentials, and there is no Flowstate server in the middle. Because it handles your developer account and your listing copy, it gets a section of its own below.

Who we are

Flowstate Industries LLC is a one-person studio based in the United States. If you have any questions about your privacy, you can reach us at support@flowstateindustries.com.

What we store, and where

The information you create in our apps is stored locally on your device using Apple's on-device storage. It is not uploaded to us, and we do not run servers that hold it.

Some apps connect to a third-party service that you configure with your own credentials, such as an API key. Those credentials are stored in the Keychain on your device, on iOS or on macOS, and we never receive them or the data they return. In ShipLocal those Keychain items can also sync through iCloud Keychain, which is set out in its own section below.

Where an app blocks other apps, as Rizen does after you wake up, it is built on Apple's Screen Time framework. You choose which apps to block in Apple's own picker, and the app receives only anonymous tokens standing in for them. It cannot see which apps you open, how long you use them, or anything inside them.

Photos and other content you add stay in each app's local storage on your device. Where an app does reach the network for your content, it is to look a place up with Apple Maps - either searching for what you typed, or resolving the name of a place you picked. Apple handles those lookups under its own terms, and nothing about them reaches us.

Because this data lives on your device, it is included in your own device backup, so a new phone restores it. That backup belongs to you and, if you use iCloud Backup, to your iCloud account. We never receive it and cannot read it.

Anonymous analytics

To understand which features are used and to fix problems, some of our apps collect anonymous, privacy-preserving product analytics through PostHog. These analytics:

• Are tied only to a random, per-install identifier - never your name, email, or an account.
• Carry almost nothing you write. Notes and photos are reduced to a simple presence flag, or left out entirely, and the money you enter is reported only as a range, such as $100-200, never as an exact figure. The narrow exceptions are named below.
• Are never used to track you across other apps or websites, and involve no advertising identifier.

Three narrow exceptions are worth naming plainly. A short label you choose from or type to categorize your own entries, such as a job title like Server or Bartender, can be included so we know which parts of an app get used. In Worldly, the country a visit is in is included, so we can see which parts of the world the app is used for; your coordinates, notes, photos, search text, and any state or city name are not. And for purchases, some apps record the price, currency, product, Apple transaction identifier, the proceeds a purchase produces, and a running lifetime revenue total exactly, because those figures come from the App Store rather than from you; other apps record which plan you chose and no amount at all.

The analytics library also records the ordinary technical context that comes with any app event: which screen was opened, app launches and backgrounding, your device model, iOS version, app version, locale, and time zone. And as with any request to any internet service, PostHog's servers see your device's IP address at the moment an event arrives. None of it is joined to a name or an account, because there is no account to join it to.

Several of our apps collect no analytics whatsoever. ShipLocal has never contained an analytics SDK of any kind, Summit has never contained one either, and Clocked had its one removed outright in a 2026 update - not disabled, deleted, along with every line of code that called it. None of the three has an analytics switch in Settings, because none of them has anything to switch off. Where an app does still collect analytics there is currently no in-app toggle either, and what is collected is described here on this page, which every app links to from its own Settings. If that matters to you, say so and it will move up the list.

ShipLocal

ShipLocal is our Mac app for translating an App Store listing into the 50 App Store languages. It handles your developer account and your own copy, so it is worth setting out on its own. The headline is unusually clean: we run no server for it at all. There is no backend, no account, no sign-up, no login, and no user identifier. There is no analytics, no telemetry, no crash reporting, and no advertising SDK - not reduced, not anonymised, none at all. We receive no data about you or your apps. The app is sandboxed with outgoing network access only, and it never logs a key, a token, or the copy it is working on.

Three things leave your Mac, each because you asked for them to:

• Your App Store Connect credentials, signed on your Mac into a token, and the listing copy being read or written. Those go to Apple, which is the whole point of the app.
• The listing text you choose to translate, along with your provider key, to whichever AI provider you picked - Anthropic or OpenAI. Translating the copy requires sending the copy, and nothing is sent until you start a run, having seen the estimated cost first.
• App and bundle identifiers, to Apple's public iTunes lookup endpoint, so the app can show your real App Store artwork and developer name.

Purchases go to Apple, as they do everywhere else. Nothing goes to us.

The AI provider sees your listing copy, because translating it requires that. It never sees your App Store Connect key. What that provider does with the text is governed by its own policy rather than this one, and we will not make a promise on its behalf - see Anthropic's privacy policy and OpenAI's privacy policy. The two jobs that do not translate - carrying a released version's copy forward, and setting your marketing, support and privacy URLs - contact no AI provider at all. One detail is worth naming because it looks like privacy and is really fidelity: URLs inside your copy are swapped for placeholder sentinels before the prompt is built and restored afterwards, so a model cannot quietly rewrite them.

Five things are stored in your Mac's Keychain: your App Store Connect Key ID and Issuer ID, the contents of your .p8 private key, and your Anthropic and OpenAI keys. If you have iCloud Keychain turned on, those five sync through it. That is Apple's own end-to-end encrypted sync, so they can reach your other Macs and neither we nor Apple can read them - but it is the one way they leave the machine, and it deserves saying plainly rather than hiding behind "your keys never leave your Mac". The .p8 file itself is never kept. Only its contents are imported, so the app holds no file reference and needs no ongoing access to your disk.

Everything else stays on the Mac. A local database inside the app's own container holds the history of every run: which app and version, which job, which languages and fields, which model, the status, token counts, cost, timestamps, any edits you made to the source copy, and the translated copy itself. It is not synced, we hold no copy of it, and nothing in it is backed up by us. Preferences hold your chosen model, how many languages run at once, and display settings - no secret is ever written there.

Deleting any of it is immediate, and all of it is local:

• Settings → Credentials → Disconnect removes all five Keychain items and clears the session. Because those items are synchronizable, that removes them from iCloud Keychain too.
• History → Delete removes one run and its per-language results. Disconnect clears the session but does not delete history; history goes per record, or by deleting the app.
• Deleting the app removes its container, and with it the whole run history and every preference.
• A subscription is Apple's to cancel, in System Settings or at apps.apple.com/account/subscriptions. We cannot cancel or refund one on your behalf.

For the App Store's privacy label, the answer for ShipLocal is the short one: data collected by the developer, none. No tracking, nothing linked to your identity, and no third-party SDKs in the app.

Payments

Purchases and subscriptions are processed by Apple through the App Store. We never see or store your payment details. Apple's privacy policy governs that transaction.

Who else is involved

We keep third parties to a minimum:

• Apple - the App Store handles payments, and some apps use Apple Maps for place search and your own iCloud where you choose to use it.
• PostHog - receives the anonymous product analytics described above, for the apps that use them. In HogWatch, PostHog is also the service your own API key connects to; that is your data moving between your phone and your own PostHog account, and it never passes through us.
• Anthropic and OpenAI - in ShipLocal only, and only with a key you supply. The provider you choose receives the listing copy you asked it to translate, under its own terms. No other app of ours contacts either of them.

For completeness: PostHog's iOS library also links a crash-reporting component, PLCrashReporter. Crash capture is off by default in that library and none of our apps switch it on, so no crash data is collected or sent. Some apps bundle openly licensed datasets: map boundary data from geoBoundaries, used under CC BY 4.0, and GeoNames peak data. Those ship inside the app and are never contacted while you use it.

We do not share your information with anyone else, and we do not sell data to anybody.

Your control over your data

Because your content lives on your device, deleting an app removes its data from that device. There is no account to close and we hold no copy, so there is nothing for us to delete on our end. If you made a device backup before deleting, that backup still holds the data until you delete or replace it; that backup is Apple's and we have no access to it.

One exception is worth naming, and it contains nothing about you. In Checkout, a single marker recording that a one-time introductory offer was already shown to you stays in your device's Keychain after the app is deleted, so the offer is not repeated, and because the Keychain can sync through iCloud it may be present on your other devices. It holds no earnings, no content, and no identifier, and nothing in it reaches us.

ShipLocal has deletion paths of its own - Disconnect for the five Keychain items, Delete for a run's history, and deleting the app for everything at once. They are set out in its section above.

One honest caveat about the anonymous analytics described above: events already sent are held by PostHog, tied only to that random per-install identifier, which disappears the moment you delete the app. Deleting the app therefore stops all future events immediately, but we have no way to find or remove the past ones, because nothing links them back to you.

Several apps also let you export your data directly, for example as a CSV file. Where export exists it is free, and it stays free after a subscription lapses. Some apps have no export yet - Worldly is one, where the only thing you can take out today is a single visit shared as an image - and each app's own page says so plainly.

Children

Our apps are not directed at children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy as our apps change. When we do, we will update the date at the top of this page.

Questions about this policy?