Privacy Policy

Last updated: July 15, 2026

Watchflows is a local-first macOS application. Your workflows, payloads, and execution history live on your Mac. We do not run a backend that ingests your data. This page explains what data does leave your Mac, when, and why.

What stays on your Mac

We never see this data. The app has no usage analytics and sends no automatic reports about you or your flows. The one exception is optional error reporting — described below — which stays off unless you turn it on.

What leaves your Mac (and why)

Update checks (Sparkle)

Watchflows uses the open-source Sparkle framework to check for new versions. By default it queries our update feed once per launch. Each request includes the standard Sparkle User-Agent, your current app version, and macOS version. We use this only to decide which release to serve. Logs are retained for short-term debugging.

License activation

When you activate a license, the app verifies the embedded Ed25519 signature locally. Verification does not contact any server. The "Recover license" form on this site sends only the email address you provide to our license-recovery endpoint, which looks up your purchase in Stripe and re-emails the license key.

Watchflows Cloud entitlement checks (only if you subscribe)

If you subscribe to Watchflows Cloud or buy Spark packs, the app keeps a signed entitlement receipt recording your current plan and Spark balance. About once a day — and right after you make a change — the app contacts our entitlement service to refresh that signed receipt. These checks confirm your subscription status and remaining Sparks and nothing more: they never send your flows, payloads, node data, prompts, chat messages, or anything your workflows process. If you use only the one-time app license (with your own or local LLMs), the app makes no such checks.

In our entitlement records your identity is your email address hashed with HMAC on our server — we store only the hash, never your raw email address, in the entitlement table, so your plan can be looked up without us holding your address there. Payments themselves are handled by Stripe, and subscription emails by Resend, both described below.

AI nodes (only when you configure them)

If you add an AI node and configure it with a third-party provider (OpenAI, Anthropic, Ollama, LM Studio, etc.), the prompts and content you send through that node go directly from your Mac to the provider you chose. We do not proxy AI traffic. Local providers (Ollama, LM Studio) keep everything on your machine. The privacy policy of the provider you select governs the data handed to them.

Workflow-initiated network calls

Workflows can include nodes that make HTTP requests, send email, post to webhooks, or otherwise reach external services. Those calls go to the destinations you configure. We never see, route, or store that traffic.

Error reports (opt-in)

If you opt in — you're asked once on first launch (existing users are asked once after upgrading), and the toggle lives in Settings → General → Privacy — the app sends an anonymous report when it crashes, when a node fails to run, or when an AI assistant feature (like the flow builder or script explainer) can't reach its provider. Reports go to Sentry, our error-tracking processor (US region), and contain the error type, the node type or feature involved, the app and macOS versions, and a stack trace. They never contain your flows, their data, the contents of your scripts, your prompts, your chat messages, or anything a flow processes. Turn it off anytime; nothing is sent while it is off, and nothing is ever sent if you never turn it on. And you don't have to take our word for any of this: Settings → General → Privacy → View sent reports keeps a local log of the reports the app has sent and the identifying fields each one carried, so you can audit it yourself.

Payment

Purchases and subscriptions are processed by Stripe. Stripe collects the payment information required to complete the transaction. We receive your email address and a customer ID so we can issue and re-issue your license and, for Watchflows Cloud, keep your subscription state current. Stripe's privacy policy applies to the data they hold.

Watchflows Cloud (optional subscription)

If you subscribe to Watchflows Cloud, the app refreshes its entitlement roughly once a day: it sends your license key — which embeds the email address you purchased with — plus a timestamp and a one-time nonce to our billing endpoint, and receives back a short-lived, signed entitlement receipt. So each refresh does transmit your email to our server; on arrival it is verified and reduced to a salted one-way hash, which is the only identifier our subscription records store — the raw address is never stored by the entitlement service. Nothing about your flows or their data is ever sent. There is no account, no password, and no profile; subscription state lives in Stripe and our entitlement database (AWS). If you never subscribe, none of this traffic exists.

Hosted AI (Sparks)

When you use the hosted AI included with a Watchflows Cloud subscription, your prompts and the content you send through AI nodes go directly from your Mac to OpenRouter, our AI routing provider, using a spending-capped key we mint for you. We never see, proxy, or store your prompts or the AI's responses — the traffic doesn't pass through our servers. We can see the key's aggregate usage (Sparks spent), which is how allowances are metered. If you configure your own AI provider instead, hosted AI is never used and this section doesn't apply. OpenRouter's privacy policy governs the data they process.

Email (Resend)

License delivery and support email are sent through Resend. Resend processes the email address and message body required to deliver the email.

What we collect on watchflows.app

The marketing site at watchflows.app uses Google Analytics 4 to measure how visitors find and use the site. This is separate from the app, which has no usage analytics — the only thing the app can ever send us is the opt-in error reporting described above.

What Google Analytics records on our behalf:

We have configured Google Analytics with anonymize_ip enabled and Google Signals (cross-device tracking and demographic inference) disabled. We do not send Google your name, email, license key, or any other personally identifying information. Google's handling of the data they receive is governed by their privacy policy.

No accounts, no profiles

Watchflows has no user accounts. There is nothing to "log in" to and no profile to delete — and a Watchflows Cloud subscription doesn't change that: there is still no login; your subscription is managed through an emailed billing-portal link. Removing the app and its local data wipes everything related to your installation. The only record we keep server-side is the subscription state described above, keyed to a hashed form of your email rather than the address itself. Cancel from the portal, and email support@watchflows.app if you want that server-side record erased.

Children

Watchflows is intended for general use and is not directed at children under 13. We do not knowingly collect data from anyone in that age range.

Changes to this policy

We may update this policy as the product evolves (for example, when we add a feature that involves new data flow). Material changes will be noted in the app's release notes and reflected in the "Last updated" date above.

Contact

Questions about privacy: support@watchflows.app.