Privacy Policy
Last updated: October 16, 2026
Watchflows is a local-first Mac app. Your flows, their data and their history live on your Mac, and we do not run a backend that ingests them. A few things do leave your Mac, each one because you asked for a feature that needs it. This page lists every one of them: what is sent, to whom, why, how long it is kept, and what you can ask us to do about it.
- Who is responsible
- The short version
- What stays on your Mac
- What leaves your Mac, and why
- AI providers you bring
- The Setapp edition
- Service providers
- Where data is processed
- No sale of data, and what happens if Watchflows changes hands
- Your rights
- Do Not Track
- Security
- Children
- Changes to this policy
- Contact
1. Who is responsible
The controller of the personal data described here is BaggaDonuts LLC, a California limited liability company, 1187 N Willow Ave #103-815, Clovis, CA 93611, United States, trading as Watchflows. Reach us at support@watchflows.app. We have not appointed a data protection officer; the same address reaches the person responsible for privacy.
2. The short version
- The app has no usage analytics and no account requirement. Nothing about your flows or their data is sent to us unless you use a feature that needs a server: the webhook relay, Watchflows AI, Community Flows, Send Feedback, or opt-in error reports.
- Our marketing claims of "local-first" and "no upload" describe the app with your own or on-device AI and no hosted feature turned on. Section 4 is the precise statement; where the two differ, section 4 is right.
- When a hosted feature is on, we keep the minimum for the shortest time we can, and section 4 gives the period for each.
- You can ask us to show, correct or delete what we hold. Section 10 says how.
3. What stays on your Mac
- All workflow files (
.watchflow) and the SQLite database that backs them. - Execution history, payloads, logs and timeline data.
- Any text, files or content that flows through your nodes, and the AI prompts and responses your nodes exchange with the provider you chose.
- Your AI-provider keys, in the macOS Keychain.
- Your license key (direct edition), in a local application file; your trial start date; the version and time at which you accepted the Terms.
- Your AI cost history and the local log of every error report the app has sent.
We never see this data. Removing the app and its data folder wipes everything related to your installation from your Mac.
4. What leaves your Mac, and why
Each row is one feature. "Basis" is the legal ground we rely on under the GDPR and similar laws: contract means we need it to provide something you asked for; consent means you turned it on and can turn it off; legitimate interest means we need it to run the service safely, in a way you would reasonably expect. Where a row is marked "direct edition", it does not exist in the Setapp edition.
| Feature | What is sent | Why, and basis | Kept |
|---|---|---|---|
| Update checks direct edition |
Your app version, macOS version and the standard Sparkle user agent, once per launch, to our update feed. | To offer you the right release. Legitimate interest. | Web-server logs, including the requesting IP address, for 30 days. |
| License activation and recovery direct edition |
Activation verifies the key's signature on your Mac and contacts no server. The "Recover license" form on this site sends the email address you type to our recovery endpoint, which looks up your purchase in Stripe and re-sends the key. | To get you your key. Contract. | The request is not stored beyond the email delivery record at Resend. Your purchase record stays in Stripe for as long as tax and accounting law requires. |
| Watchflows AI account both editions, only if you create one |
Your email address; a device code (a one-way code computed on your Mac from its hardware identifier, which itself never leaves); your trial end date; counts of sign-in requests per address, device code and IP address. | To sign you in with a link or code, send receipts, send one trial reminder, and limit free Sparks to once per person and once per Mac. Contract; the abuse counters are legitimate interest. | Counters expire within a day. The account record is kept while the account is in use and deleted 24 months after its last sign-in or purchase, or sooner on request. |
| Entitlement checks only with a subscription, Sparks or an account |
About once a day, your license key (which embeds your purchase email) or your account identity, a timestamp and a one-time nonce, to our billing endpoint, which returns a signed receipt for your plan and Spark balance. Never your flows, payloads, prompts or anything a flow processes. | To know what you are entitled to. Contract. | On arrival the email is reduced to a salted one-way hash, and that hash is the only identity the entitlement records store; pseudonymous data is still personal data, and we treat it that way. Kept while you have a plan, Sparks or an account, then deleted with the account record above. |
| Watchflows AI (Sparks) only when you use Watchflows AI |
Your prompts and the content you send through AI nodes go from your Mac straight to OpenRouter, our hosted-AI processor, using a spending-capped key we mint for you. They do not pass through our servers. We see the key's aggregate usage in Sparks. | To run the model and meter Sparks. Contract. | We keep the usage totals with your entitlement record. OpenRouter's and the underlying model provider's policies govern their handling of the prompt itself. |
| Public webhook relay only for channels you create |
A delivery that a sender POSTs to your channel URL: body, headers, method, path and arrival time, up to about 100 KB, queued on our servers until your Mac collects it. Channel bookkeeping is a hash of the access token, a hash of the owning license, a created-at date and queue counters. | To get the delivery to your Mac even when it is briefly offline. Contract. | A delivery is deleted the moment your Mac confirms it; one your Mac never collects is refused after 24 hours and physically deleted within 48. The queue is encrypted at rest. Bodies, headers and channel paths are never written to logs; function logs, which record error names only, expire after 30 days. Channel records are deleted when you revoke the channel or deactivate the license. |
| Community Flows: browsing and installing | Nothing. The catalog ships inside each release. | ||
| Community Flows: submitting direct edition, only when you press Submit |
The flow file, including any text you typed into its nodes (never your saved provider keys); the screen name you choose; your license, which embeds your purchase email; and a checksum of the file. | To review and, if approved, publish the flow under your screen name. Contract, and the dedication you make in the Terms. | The license is reduced to a hash that identifies the submitter. The submission is scanned for secrets, reviewed by an AI model (Anthropic Claude, called through OpenRouter) and read by a person; the review result is emailed to our support mailbox. A published flow, its screen name and its submitter hash are kept until the flow is taken down or you ask for erasure. A rejected or withdrawn submission is deleted within 30 days. A hash of a blocked submitter is kept so the block holds. |
| Send Feedback only when you press Send |
What you typed, an optional reply address, the app and macOS versions, and the edition. It becomes an email to our support mailbox. Never your flows or license key. | To read and answer you. Consent. | In the support mailbox for 3 years, then deleted. |
| Error reports only if you turn them on |
When the app crashes, a node fails to run, or an AI assistant feature cannot reach its provider: the error type, the node type or feature involved, the app and macOS versions, your Mac's model, and a stack trace. A stack trace or a file path inside it can include your macOS user name. Never your flows, their data, your scripts, your prompts or your chat messages. Our error-tracking processor also receives the sending IP address in the course of delivery. | To find and fix bugs. Consent: the app asks once on first launch and the switch is in Settings ▸ General ▸ Privacy. Nothing is sent while it is off, and nothing is ever sent if you never turn it on. | 90 days at Sentry, then deleted. The app keeps a local log of every report it sent and the fields each one carried (Settings ▸ General ▸ Privacy ▸ View sent reports) so you can audit it yourself. |
| Payments direct edition |
Checkout happens on Stripe, which collects your card details and billing address. We receive your email address, a Stripe customer ID, what you bought, and subscription events. | To deliver your license, run your subscription and issue receipts. Contract; records are also a legal obligation. | For as long as tax and accounting law requires, typically seven years. |
| Email we send | License delivery, sign-in links, receipts, the one trial reminder, subscription notices and support replies go through Resend, which processes the address and the message. | Contract. | Resend keeps delivery records per its policy; our copies live in the support mailbox (3 years). |
| This website | Plausible Analytics counts visits: the page, how long, the referring site, your country (worked out from your IP address and then discarded; the address is never stored), and generic browser and device information. Events: a purchase on the post-checkout page (a license or a Cloud plan name, never who), a file_download when the download button is clicked, a buy_intent when the pricing page is opened, and a flow_install naming which community flow was added. |
To know which pages help. Legitimate interest; Plausible sets no cookies and needs no consent banner because there is nothing to consent to. | Visitors are counted for a day with a hash that is discarded every 24 hours; there is no identifier that could recognise you tomorrow. Plausible is hosted in the European Union. |
5. AI providers you bring
If you configure an AI node with a provider of your own, whether a cloud provider with your key (OpenAI, Anthropic, Google, OpenRouter, an OpenAI-compatible endpoint), a subscription tool signed in on your Mac (Claude Code, Codex), or a model running locally (Ollama, LM Studio, Apple Intelligence), the prompts and content go directly from your Mac to that provider. We do not proxy, see or store that traffic. The provider's privacy policy governs it. Local providers keep everything on your machine.
6. The Setapp edition
If you installed Watchflows through Setapp, three things are different:
- Setapp's framework reports usage to Setapp. The Setapp framework inside the app tells Setapp (MacPaw Way Ltd.) that the app is installed and in use, so Setapp can run your membership and pay developers. That data goes to Setapp under Setapp's privacy policy; we receive aggregate figures, never your identity.
- Setapp AI goes through Setapp's gateway. If you pick Setapp AI as a provider, the app signs you in with your Setapp account and sends your prompts and content through Setapp's AI gateway to the model provider you chose there, currently OpenAI, Anthropic, Google or xAI, billed in Setapp AI credits. Setapp and each model provider handle that data under their own policies; we never see it. Setapp lists the providers at setapp.com/supported-ai-models. For that processing, Setapp and we act as separate controllers, and the model providers act independently.
- Most direct-edition services are absent. The Setapp edition has no update checks of its own, no license, no Cloud plans, no Spark packs and no Community Flows submission. You may choose to create a free Watchflows account, which asks only for an email address, to use the public webhook relay and the one-time grant of free Sparks; if you do, the account, entitlement, Sparks and relay rows in section 4 apply exactly as written, and we may check the account against your Setapp membership. Browsing Community Flows, Send Feedback and opt-in error reports work as described in section 4, and the error report says which edition it came from.
We do not use any data from Setapp AI to train models or to improve prompts, and we do not log it.
7. Service providers
These are the companies that process personal data for us, and what each one does.
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services | Hosts this website and the downloads (S3, CloudFront), the relay, the billing and account services, and the Community Flows pipeline. | United States (us-east-1) |
| Stripe | Payments, subscriptions, receipts and the renewal reminder email. | United States, with regional entities |
| Resend | Sends our email. | United States |
| OpenRouter | Serves Watchflows AI requests and the Community Flows AI review, routing to the model provider (Anthropic for the review). | United States |
| Sentry | Receives opt-in error reports. | United States |
| Plausible Analytics | Counts website visits. | European Union |
| Setapp (MacPaw Way Ltd.) | Setapp edition only: distribution, membership usage reporting, and the AI gateway. | Cyprus and Ukraine, with providers worldwide |
8. Where data is processed
We are in the United States, and most of our providers process data there. If you are in the European Economic Area, the United Kingdom or Switzerland, the data in section 4 is transferred to the United States. We rely on the provider's participation in the EU-US Data Privacy Framework where it participates, and otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreement with that provider. You can ask us for details of the safeguard that applies to a given provider.
9. No sale of data, and what happens if Watchflows changes hands
We do not sell personal data, share it for cross-context behavioral advertising, or use it for profiling. We disclose it only to the providers in section 7, to the extent each needs it, and when the law requires us to. If BaggaDonuts LLC or the Watchflows product is sold, merged or transferred, the data described here may be transferred to the successor, who must honor this policy for data collected under it; we will tell you in the release notes or by email.
10. Your rights
Wherever you live, you can ask us to tell you what personal data we hold about you, to give you a copy in a usable format, to correct it, to delete it, to restrict or object to how we use it, and to withdraw a consent you gave (which does not affect what was done before you withdrew it). Email support@watchflows.app from the address on your purchase, subscription or account, or tell us how to verify it is you; we answer within 30 days. We honor these requests for everyone, including California residents, whether or not a particular law requires it, and we will never treat you differently for making one.
Most of it you can do yourself: turn error reports off in Settings; revoke a relay channel in the node inspector; cancel a subscription at watchflows.app/manage; delete the app and its data folder to remove everything local. What remains on our side after that is the server-side data in section 4, and an email to us removes it, subject to records we must keep by law.
If you are in the EEA, the UK or Switzerland and believe we have not handled your data lawfully, you have the right to complain to your local data protection authority; we would appreciate the chance to resolve it first.
11. Do Not Track
Some browsers send a "Do Not Track" or Global Privacy Control signal. This website does not track visitors across sites or over time, sets no tracking cookies and runs no advertising, so there is nothing for such a signal to switch off; we do not change our behavior in response to it, because the behavior it asks for is already our default.
12. Security
The relay queue is encrypted at rest and is read with hashes, not secrets. Entitlement and license records hold a salted hash of your email rather than the address. Provider keys live in your Mac's Keychain. Our services run on AWS with access limited to the one person who operates Watchflows. No method of transmission or storage is perfectly secure; if we learn of a breach affecting your data we will tell you and, where the law requires it, the relevant authority, without undue delay.
13. Children
Watchflows is not directed at anyone under 16, and the Terms require you to be at least 18 (or the age of majority where you live) to accept them. We do not knowingly collect data from children; if you believe a child has given us data, email us and we will delete it.
14. Changes to this policy
We update this page when the product changes what leaves your Mac. A change that adds a data flow, changes a purpose or shares data with a new kind of recipient is announced in the release notes and, if it is material, the app asks you to accept the updated Terms and this policy before you continue. The "Last updated" date at the top always tells you the current version.
15. Contact
BaggaDonuts LLC, 1187 N Willow Ave #103-815, Clovis, CA 93611, United States.
Privacy questions and requests: support@watchflows.app.