Privacy policy

Last updated: October 22, 2026.

This privacy policy explains what data Flowlet collects, what it is used for and who it is shared with, for the Flowlet Android app, the Flowlet iPhone app and useflowlet.com.

Controller

Flowlet, owner of the domain useflowlet.com. Contact for any privacy matter: hello@useflowlet.com.

Summary

Flowlet transcribes your voice so it can type for you. To do that, the audio leaves your phone only for as long as it takes to transcribe it, and is then discarded. The text is saved to your account so your history comes back when you sign in with Google or Apple. We don't sell data, there are no ads, and we don't use your dictations to train models.

What data we process

• Audio of your dictations. It is sent encrypted (HTTPS) to our server and from there to the model provider that transcribes it. The audio is not stored. It is discarded as soon as the text comes out.
• Account. If you sign in with Google or Apple, we receive your email address and an account identifier from them. You can use the app before signing in.
• Usage log. For each call: date, audio length, word count, latency and transcription cost, plus your app account identifier. It is used for quotas, credits and billing. The text of your dictations is not part of this log.
• Diagnostics. To find and fix problems we also record, per call, technical details: phone model, Android or iOS version, app version, network type and estimated bandwidth, how long each step took and the reason for any failure. Never the audio and never the text of your dictations.
• Transcripts. The text of each dictation is saved to your account on our server, so your history is still there when you change phones or reinstall. A copy also stays on your phone. Before it is saved, the raw text goes to a language model that cleans it up and tidies what you said. You can delete transcripts from the app or by deleting your account.
• Purchases. Purchases are made through Google Play Billing on Android and the App Store on iPhone. We receive the purchase identifier and its status from Google or Apple so we can add your credits or your subscription. We never see or process your card or payment account details.
• Your own API keys (optional). Only if you turn on “bring your own key”: your provider keys (Groq and OpenAI) are sent encrypted to our server and stored encrypted, used solely to run your dictations on your accounts with those providers. They are never shown again, never used for anything else, and are deleted when you remove your keys in the app or delete your account.
• Feedback you send. If you report a problem from the app, we receive your message plus the phone model, system version and app version, to answer you and fix it.
• System permissions. On Android, accessibility, used only to insert the transcribed text where you are typing. On iPhone, the keyboard's “Full Access”, needed so the keyboard and the app can share the text. We don't read the content of your text fields or of other apps.
• Abuse prevention. When you claim a bonus or redeem a code, we store an encrypted identifier (hash) of the device, so each promotion can be used once per device. It cannot be used to identify you.
• This website (useflowlet.com). It uses no cookies. Like any web server, ours keeps an access log (IP address, browser, page visited and the page you came from) for 14 days, to count visits and stop abuse; the country is estimated from the IP address. The pages load Google Tag Manager, which at the moment runs no tags and sets no cookies. Your browser stores your language choice in its own local storage.
• Launch notice. If you leave your email, Instagram or phone to hear when Flowlet is out, we use it only to tell you that, and don't share it. Write to us and we delete it.

Purposes and legal basis

• Transcribing your dictations and inserting the text: performance of the contract (the app, its credits and its subscription).
• Quotas, credits and billing: performance of the contract and legal obligation (tax and accounting rules).
• Security, preventing abuse of the service and counting website visits: legitimate interest.
• The launch notice: your consent, which you can withdraw at any time.

We don't make automated decisions based on profiles, and we don't build commercial profiles.

Who we share it with

Your data only leaves our server to go to the providers we need to run the service. They act as data processors, following our instructions:

• Speech and language model provider: receives the audio of each dictation to transcribe it, and the raw text of each dictation to clean it up, and keeps neither nor uses them for training. If you bring your own keys, that provider is the one you choose and the calls are made with your keys.
• Google Ireland Limited (Google Play Billing, Sign in with Google): purchases and sign-in on Android.
• Apple Distribution International Ltd. (App Store, Sign in with Apple): purchases and sign-in on iPhone.
• Email provider: sends the launch notice and our replies to your messages.

There are no other transfers. We don't share data with advertisers and we don't sell it. Write to us if you want details of the providers and the safeguards that apply.

Retention and deletion

The usage log is kept while your account is active and is deleted when you delete the account from the app, except for billing data that the law requires us to keep for the legal period (usually 6 years in Spain). To prevent abuse, after deletion we also keep encrypted identifiers (hashes) of the account and the device, only to stop the welcome bonus and promotions from being claimed again. They cannot identify you or be linked to your data. Transcripts are deleted with the account. How to delete your account.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to hello@useflowlet.com. We reply within the legal period of one month. If you think we haven't handled your request properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es).

Children

Flowlet is not intended for children under 14, and we don't knowingly collect their data. If we find that a child has given us data, we delete it.

Security

Everything travels encrypted over HTTPS. Audio is discarded once transcribed, each account uses its own token, and access to the usage log is limited to what is strictly needed to run the service. API keys you bring are stored encrypted (AES-256) and only decrypted to run your dictations.

Changes to this privacy policy

If the way we process your data changes, we update this page and its date. Significant changes are also announced in the app.

Contact

Any question or request: hello@useflowlet.com.