Privacy Policy and Data Protection Notice

Data controller

The data controller for your personal data is the person or organization that operates this Heronflow installation:

Data we process

• Account information: with Google sign-in, your name, email address, profile picture and Google account ID; with username and password sign-in, your username and an irreversible hash of your password (the password itself is never stored).
• Workspace content: the projects, tasks, notes, comments and images you create or upload, workspace members and their roles, invites and notifications.
• Preferences: theme, language, the workspace you opened last and your dashboard layout.
• Access keys: for the keys you create for the MCP integration, only a hash and a prefix are stored.
• Technical data: the session cookie, IP address and browser information, processed in server logs and in the CDN or security layer for security, abuse prevention, rate limiting and debugging.
• Measurement data: only on the marketing site and only if you consent, anonymous usage statistics through Google Analytics 4. No analytics are used inside the app.

Purposes and legal bases

• Providing the service, managing your account and syncing your data: contract (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)).
• Keeping the service secure and preventing abuse and errors: legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)).
• Visit statistics on the marketing site: consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)). You can withdraw your consent at any time through Cookie preferences.
• Meeting legal obligations and answering requests from competent authorities: legal obligation (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c)).

Your data is not processed for marketing, no profiles are built about you and your personal data is never sold.

AI and Gemini Nano

The AI features use the Gemini Nano model that runs on your device inside Chrome. The text you write is given to the model on your device and is not sent to the Heronflow server or to any AI service. Chrome downloads the model file from Google by itself, and that download is subject to Chrome’s and Google’s own policies. A task, note or comment suggested by Nano is not created until you approve it.

Who receives your data

We do not sell your personal data. It is shared only as far as the service requires, with:

• Workspace members: they see your content to the extent of your role and the access settings you choose. Guests only see the project or note that was opened to them.
• Hosting and infrastructure providers: the provider that runs the server and, where used, a CDN or security provider, which may process IP addresses and request information as traffic passes through.
• Google: for authentication when you use “Sign in with Google” and, if you consent, for Google Analytics.
• Competent authorities: where there is a legal obligation.

Some providers may be located abroad. In that case transfers are made in line with the safeguards of KVKK Art. 9 and Chapter V of the GDPR (for example standard contractual clauses).

Retention

• Account and workspace content: kept while your account is open and deleted within a reasonable time after you ask us to.
• Sessions: at most 30 days.
• Notifications: cleared after 60 days.
• Demo accounts: deleted automatically after 24 hours.
• Invite codes: valid for 7 days.
• Server logs and backups: kept for as long as security and continuity require.

Security

To protect your data, production deployments use HTTPS, HttpOnly and Secure session cookies, one-way password hashes, role-based access control enforced on the server, rate limiting and security headers. No system is entirely free of risk; if a breach occurs we will meet our legal notification duties.

Cookies and local storage

For details about cookies and local storage, see the Cookie Policy.

Your rights

Under KVKK Art. 11 and the GDPR you have the right to:

• find out whether your data is processed and request information about it,
• learn the purpose of the processing and whether it is used accordingly,
• know the third parties your data is transferred to, at home or abroad,
• have incomplete or inaccurate data corrected,
• have your data deleted or destroyed,
• object to the processing and ask for data portability,
• withdraw your consent where processing is based on it,
• object to an outcome that works against you and claim compensation for damage.

You can send your requests to the contact address above and we will answer within 30 days at the latest. You can also export your data yourself with the JSON backup in the app. If you are not satisfied with our answer, you may complain to the Turkish Personal Data Protection Board or to the data protection authority in your country of residence.

Children

Heronflow is not aimed at children under 16 and we do not knowingly process their data. If you notice such a case, please tell us.

Changes

We may update this notice from time to time. For significant changes we will inform you through the app or the site. The date of the latest update is at the top of the page.