Last updated: June 2025
FlowBeats ("we", "us", or "our") is a web application that generates AI-powered focus music. We take your privacy seriously and collect only what is necessary to provide the service.
Email address — collected when you request AI-generated music. Used solely to enforce the free generation limit (3 sessions/month) and associate your Pro subscription. We do not send marketing emails.
Stripe payment data — if you subscribe to Pro ($7/month), payment is processed by Stripe. We store only the Stripe Checkout session ID to verify your subscription status. We never see or store your card details.
Usage data — session stats (focus time, session count) are stored locally in your browser's localStorage. This never leaves your device.
Generated tracks — AI-generated audio tracks are cached server-side for 24 hours using a BPM/genre key (not linked to your identity) to reduce API costs and improve performance.
Replicate — AI music generation. Your BPM and genre selection is sent to Replicate's API to generate audio. See Replicate's Privacy Policy.
Stripe — payment processing for Pro subscriptions. See Stripe's Privacy Policy.
Vercel — hosting. Standard server logs (IP address, request metadata) are retained per Vercel's policy. See Vercel's Privacy Policy.
Upstash Redis — serverless key-value store used to cache generated tracks and track generation counts. Data is stored for 24–30 days maximum.
Email addresses and generation counts are stored in Redis with a 30-day TTL and automatically deleted. Pro subscription status is cached for 24 hours. No personal data is permanently stored in a database.
If you are in the EU/UK, you have the right to access, correct, or delete your data. To request deletion of your email address from our systems, email us at the address below. We will process requests within 30 days.
We process your email address under legitimate interest — to operate the free-tier limit and prevent abuse of our generation service. We process Stripe payment data under contractual necessity — to provide the Pro subscription you've purchased. You may object to processing based on legitimate interest at any time by contacting us below.
Our service providers (Stripe, Replicate, Vercel, Upstash) are based in or operate servers in the United States. Where data is transferred outside the UK/EEA, these providers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR. We do not control these providers' infrastructure directly but have selected providers with published GDPR-compliance commitments.
We apply the following technical safeguards:
X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-PolicyNo system is 100% secure. If you discover a vulnerability, please report it to the email below before public disclosure — we'll respond promptly.
FlowBeats is not directed at children under 13. We do not knowingly collect data from children.
We may update this policy as the product evolves. Significant changes will be noted at the top of this page with an updated date.
Questions about your privacy or data? Reach us at: privacy@flowbeats.net