Privacy Policy

Flow is Zerethon's Application Intelligence Platform — it scans websites and, where an adapter is installed, captures runtime execution traces of the applications you point it at. This policy covers Flow specifically (flow.zerethon.com and flow-api.zerethon.com). Flow is a separate product from Zerethon Social, and its data model is different — this page describes what Flow itself actually stores, not a generic reuse of another product's policy.

Flow does not run its own username/password system. Sign-in goes through Zerethon's shared identity service (auth.zerethon.com); Flow receives your identity via a signed token and stores only what it needs to recognize your session (an encrypted session cookie, valid 12 hours) and to scope your projects to you. Flow does not store your password.

When you create a Project in Flow, we store:

• The project name and base URL you register for scanning.
• Scan results: crawled URLs, page scores, and findings (SEO, security headers, structured data, performance, AI-readiness) produced by our analyzers.
• If you enable Connected mode (installing the flow-laravel adapter) or use Offline upload: runtime execution traces — the request/route/service/database/external-call structure and timing of the traced application's own requests. This data describes the application you registered, not Flow users in general.
• A per-project secret key (used to authenticate an adapter's pushes) — shown to you once at creation, stored encrypted, never displayed again.

Only point Flow's Connected mode at applications you own or are authorized to instrument — a runtime trace can include real request data from that application. flow-laravel masks commonly sensitive values by default (query-string and route-parameter values, email-shaped strings, and sensitive-keyed fields passed to manual trace calls), but this is a best-effort safeguard, not a guarantee that no sensitive data can ever appear in a captured trace — it does not inspect arbitrary request/response body content. Don't trace an application handling regulated or highly sensitive data without reviewing what a capture actually contains first.

Flow uses the data above to:

• Run analyzers and generate the reports and dashboards you see.
• Show score trends and category breakdowns across your own projects.
• Authenticate adapter pushes and scope every project/trace to its owner.
• Diagnose and fix problems with the platform itself.

Flow does not use this data for advertising, and does not run third-party analytics or ad-tracking scripts.

Project secret keys and session data are stored encrypted. Adapter pushes are authenticated per-project (a bearer secret plus project ID); dashboard access is scoped so one account can only read its own projects, scans, and traces. No platform can guarantee absolute security — keep your Zerethon account credentials and any project secret keys confidential.

Project, scan, finding, and trace data is retained for as long as the project exists in Flow. Flow does not currently have a self-service project-deletion feature — to request deletion of a project and its associated data, contact us at the address below.

Flow does not sell data. Information is only shared as needed to operate the platform (e.g. with Zerethon's own identity service for authentication), comply with legal obligations, or protect the platform and its users from abuse.

Flow relies on Zerethon's own identity service (auth.zerethon.com) for sign-in. Flow does not currently integrate any other third-party service that would receive your data.

Flow may update this policy as the product changes. Material changes will be reflected here with a revised "Last updated" date.

For privacy questions or data-deletion requests, contact hello@zerethon.com.