ConvoFlow is local-first: your memories, prompts, and projects are stored on your device (chrome.storage.local) and storage works fully offline. Two things involve our systems, and you control both. AI processing — to summarise a chat, check an answer, or broadcast a prompt, the relevant text is sent through our Cloudflare Worker to an AI provider (Kimi/Moonshot, Anthropic, or OpenRouter); it is processed to return a result and is not stored on our servers. Cloud backup & sync is optional and off by default — if you turn it on, your memories and prompts are backed up to your ConvoFlow account so only you can access them, and you can turn it off (and delete the cloud copy) anytime. We never sell your data and never use it to train AI models.
1. Who we are
ConvoFlow ("we", "us", or "our") is a Chrome browser extension that helps you save, organise, and reuse your AI conversations across platforms including ChatGPT, Claude, Gemini, Perplexity, Grok, and DeepSeek.
For privacy enquiries, you can contact us at: privacy@convoflow.work
2. What data ConvoFlow processes
| Data type | Where it lives | Sent externally? |
|---|---|---|
| AI conversation content (memories) | chrome.storage.local (source of truth); your account only if cloud sync is ON | Sent to an AI provider for summarisation (transient, not stored by us); backed up to your account only if you enable cloud sync |
| Prompt library entries | chrome.storage.local; your account if cloud sync is ON | Only if cloud sync is ON |
| Project definitions & context blocks | chrome.storage.local; your account if cloud sync is ON | Only if cloud sync is ON |
| Connection tokens (Gmail, Outlook, GitHub, Figma, Notion, Slack) | chrome.storage.local — encrypted where possible | Used only to call the respective service APIs on your behalf |
| Conversation text (for summarisation, verify, or Broadcast) | Not stored by ConvoFlow | Routed through ConvoFlow's Cloudflare Worker proxy (oauth.convoflow.work) to Kimi/Moonshot, Anthropic, or OpenRouter — see Sections 4 and 7 |
| Ad Shield diagnostic report | Last 20 entries in chrome.storage.local | Yes — page URL, extension version, and timestamp sent to our Worker when an ad is not skipped after 5 s. No conversation content or PII. See Section 8. |
| Usage events (anonymous) | PostHog analytics server | Yes — see Section 5 |
| Account email | Your ConvoFlow account (Supabase Auth), only if you create one | Yes — for authentication and lifecycle email (Loops.so) |
3. Storage: local-first, cloud optional
Your device is the source of truth. All memories, prompts, and project data are stored in chrome.storage.local, and ConvoFlow works fully offline for storage. If you uninstall the extension, all local data is deleted.
Cloud backup & sync is opt-in and off by default. Until you turn it on — via a one-tap prompt after you save your first memory, or the toggle in Settings — nothing is uploaded. When it is on, your memories and prompts are backed up to your ConvoFlow account so they sync across your devices and survive a reinstall. Turning sync off stops all uploads, and you can also delete the cloud copy.
Your account data is stored on Supabase (managed Postgres, hosted in the United States) and isolated to your account by row-level security, so no other user — and no unauthenticated request — can read it. Creating an account (Google sign-in or email/password) is required only for cloud sync and the optional Daily OS features; you can use ConvoFlow fully without an account using "Continue without account".
If you create an account, we may send you product and onboarding emails via Loops.so; your email address is shared with Loops solely to deliver these, and you can unsubscribe anytime. We do not sell or rent your data, and we never use it to train AI models.
4. AI processing (summarise, verify, broadcast)
To generate a memory card, check an answer, or run an API broadcast, the relevant text is sent through ConvoFlow's Cloudflare Worker (oauth.convoflow.work), which holds the API keys server-side so they never ship in the extension. The Worker is a pass-through — it does not log, store, or inspect your content.
- Summarisation: Kimi (Moonshot AI) as the primary model, Anthropic (Claude) as fallback.
- Verify (check an answer): Anthropic (Claude) with web search.
- API Broadcast (ConvoFlow AI mode): OpenRouter, which routes to the chosen models.
- Your text is processed to return a result and is not retained by us or, per their terms, used to train models.
- Provider policies: Anthropic, OpenRouter, and Cloudflare.
5. Anonymous analytics (PostHog)
ConvoFlow uses PostHog to collect anonymous usage statistics. This helps us understand which features are being used so we can improve the product.
Anonymous event counts only — e.g. "session_saved", "memory_injected", "popup_opened". Each installation generates a random anonymous identifier (not linked to your identity). No conversation content, no URLs, no personal data.
- Events tracked:
extension_installed,session_saved,memory_injected,popup_opened,memory_deleted,copy_for_notion_clicked. - Each install generates a random UUID — this is not linked to your identity in any way.
- No message content, no conversation URLs, no personal information is ever sent to PostHog.
- PostHog is self-hostable and GDPR-compliant. Their privacy policy is available at posthog.com/privacy.
6. Third-party service connections
ConvoFlow optionally connects to external services for the Daily OS morning brief. When you connect a service, ConvoFlow reads data from it using OAuth tokens stored on your device.
- Gmail & Google Calendar: Read-only access to unread emails and today's events. Data is processed locally to generate your morning brief and never stored by ConvoFlow.
- Outlook: Connects via Microsoft PKCE OAuth. Same read-only, no-store policy as Gmail.
- GitHub: Reads your public and private repository activity (commits, PRs) via OAuth. Not stored externally.
- Figma: Reads recent design file activity via OAuth. Not stored externally.
- Notion: Reads pages updated in the last 7 days via Notion OAuth. Used solely to surface relevant pages in your morning brief. Not stored by ConvoFlow.
- Slack: Reads unread DMs and @mentions via Slack OAuth. Data is used only to generate your morning brief and is not stored by ConvoFlow.
OAuth token exchanges for GitHub, Figma, Notion, and Slack are performed through ConvoFlow's Cloudflare Worker proxy (oauth.convoflow.work) to keep client secrets secure. The Worker does not log or retain your tokens.
Connecting these services is optional. You can disconnect any service at any time from the Settings panel in ConvoFlow.
ConvoFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data (Gmail, Calendar, and Drive metadata) is used only to generate your on-device Daily OS brief; it is never sold, never transferred except to provide that feature, never used for advertising, and never used to train models.
7. Broadcast feature
When you use the Broadcast feature in Personal AI mode, ConvoFlow injects your prompt into open browser tabs on the respective AI platforms using your existing logged-in sessions. ConvoFlow does not intercept, store, or transmit the AI platform's responses.
In ConvoFlow AI mode (powered by OpenRouter), your prompt is routed through ConvoFlow's Cloudflare Worker proxy (oauth.convoflow.work) and then forwarded to OpenRouter's API, which routes it to the relevant AI models. The Worker does not store your prompt. OpenRouter's privacy policy governs their processing of your request.
8. Ad Shield
Ad Shield is an optional ad-blocking feature toggled from the Morning Brief tab. It operates in three layers:
- Network blocking: Uses Chrome's built-in
declarativeNetRequestAPI with a bundled ruleset to block ad network requests. No browsing data is collected or transmitted for this layer. - Cosmetic hiding: Injects CSS to hide ad elements on pages. Requires the optional
<all_urls>host permission, requested once at runtime when you first enable Ad Shield — not at install time. Used solely to inject ad-hiding styles; does not read or transmit page content. - YouTube ad skipping: Monitors the YouTube player DOM for ad indicators and attempts to skip them automatically.
If YouTube ad-skipping detects that an ad played through without being skipped, ConvoFlow automatically sends a diagnostic report to our Worker. This report contains only: the YouTube page URL, the extension version number, and a timestamp. No conversation content, no watch history, and no personal information is included. Reports are rate-limited to once per 5 minutes.
Ad Shield can be disabled at any time from the Morning Brief tab. Disabling it stops all blocking, CSS injection, and diagnostic reporting immediately.
9. Children's privacy
ConvoFlow is not directed at children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided information through our extension, please contact us and we will address it promptly.
10. Your rights
Your data is on your device by default, and any cloud copy is yours to control. You can:
- Export: download all memories as JSON from Settings; local data lives in
chrome.storage.local. - Delete: remove individual memories or "Clear all memories"; uninstalling wipes local data; turning off cloud sync can also delete the cloud copy; contact us to delete your account entirely.
- Stay local: decline cloud sync and nothing is uploaded. Disconnect any connected app anytime.
- Portability (MCP): when you choose to, you can connect your memories to your own AI tools (e.g. Claude Desktop, Cursor) via the Model Context Protocol. This is entirely user-initiated — you authorise a client through OAuth and approve what it can access. The data you request flows from your account to the app you connected; we are the pipe you control, and you can revoke access anytime.
If you are in the EEA/UK and have concerns about data processing, you have the right to lodge a complaint with your local data protection authority.
11. Data security
Local data is sandboxed to the ConvoFlow extension and not accessible to other extensions or websites. If you enable cloud sync, that data is isolated to your account by row-level security, transmitted over HTTPS, and encrypted at rest by Supabase. API keys live only in our Cloudflare Worker and never ship in the extension.
We recommend keeping your Chrome browser and the ConvoFlow extension up to date to benefit from the latest security improvements.
12. Changes to this policy
We may update this Privacy Policy as the product evolves. When we do, we will update the "Last updated" date at the top and, for significant changes, notify you via the extension.
13. Contact us
Questions or concerns?
We take privacy seriously. If you have any questions about this policy or how ConvoFlow handles your data, reach out:
privacy@convoflow.work