FlowState home← Back home

Privacy Policy

Last updated: June 4, 2026

1. About This Policy and About FlowState

FlowState is an AI-powered homework planning and study coaching web application built for students at Milken Community School in Los Angeles, California. This Privacy Policy explains what information FlowState collects, how it is used, who it is shared with, and the rights you have over your information.

FlowState is currently a student-built project created by Eli Afshani, a Milken student, and is operated as part of a pilot program seeking school approval. FlowState is not a registered company or legal entity at this time. This policy describes our practices honestly and is intended to meet the privacy standards expected by schools, parents, and applicable law.

If you have any questions about this policy or your data, contact us at getflowstateai@gmail.com.

2. Who Can Use FlowState

FlowState is intended for students, faculty, and parents connected to Milken Community School.

  • Students sign in using their @milkenschool.org Google account or an email one-time passcode (OTP).
  • Faculty sign in using their @milkenschool.org Google account.
  • Parents sign in using any email address through a one-time passcode and can only view a child's data after that child accepts the link request.

Minimum age: FlowState is not intended for children under 13 years of age. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected data from a child under 13, we will delete it. If you believe a child under 13 has used FlowState, contact us at getflowstateai@gmail.com.

3. Information We Collect

  • Account and profile information: Your name and email address (from Google sign-in or the email you provide), your role (student or parent), your grade level, and for parents, your relationship to the child (such as mother, father, or guardian).
  • Assignment information: Your assignments are pulled from your school's Blackbaud system using a read-only calendar feed link that you provide. This includes assignment titles, descriptions, subjects, due dates, and points. FlowState only reads this information and can never change anything in Blackbaud.
  • Chat messages: Your conversations with Flowy, our AI study assistant, including both academic mode (homework help) and personal mode (general support). We store the messages you send and the responses Flowy gives.
  • Flowy memories: To make tutoring more helpful, Flowy keeps short notes about your learning over time (for example, "prefers visual explanations" or "has a test coming up"). These notes are used only to personalize your tutoring experience and for no other purpose. You can request that these be deleted at any time.
  • Study and planning content: Flashcards, quizzes, daily study plans, and goals that you create or that Flowy generates for you.
  • Usage information: Counts of how many messages you send per day and how many study plans you generate, used to enforce fair usage limits.
  • Points and leaderboard data: Your points balance and history, used for the rewards and leaderboard features.

4. How We Use Your Information

We use your information only to provide and improve the FlowState service for you. Specifically, we use it to:

  • Show you your assignments and generate study plans
  • Power Flowy's tutoring and support responses
  • Create flashcards, quizzes, and goals
  • Personalize your experience through Flowy memories
  • Enforce fair daily usage limits
  • Run the points and leaderboard features
  • Keep the service safe through content moderation

We do not sell your data, share it with advertisers, use it for targeted advertising, or build profiles about you for anything other than providing the educational service. This commitment reflects our obligations under California's Student Online Personal Information Protection Act (SOPIPA).

5. Who We Share Information With (Sub-Processors)

FlowState uses a small number of trusted third-party services to operate. These are called sub-processors. Each one receives only the limited information needed to do its job.

  • OpenAI powers Flowy's AI responses. When you chat with Flowy, your messages, related assignment context, and Flowy memory notes are sent to OpenAI to generate a response. Per OpenAI's API terms, this data is not used to train their models, and it is retained for a limited period only for safety monitoring.
  • Supabase stores all of your FlowState data in a secure database hosted on Amazon Web Services in the United States. Your data does not leave the United States.
  • Vercel hosts the FlowState website. Vercel handles technical request information (such as IP addresses and timestamps) but does not receive your messages or assignment data.
  • Resend sends the one-time passcode emails used to sign in. Resend only receives your email address.
  • Google handles sign-in when you use a Google account. Google returns only your name and email address and does not receive your messages or assignment data.

We do not share your information with any other parties except as required by law.

6. How We Protect Your Information

We use reasonable security measures to protect your data, including:

  • Passwordless sign-in using Google or one-time email codes, so no passwords are stored.
  • Row Level Security on every database table, meaning students can only access their own data and parents can only access a linked child's data after that child consents.
  • Encryption in transit using HTTPS for all data sent to and from FlowState.
  • Encryption at rest through our database provider's standard protections.
  • Content moderation that filters harmful content and logs flagged messages for review.
  • Rate limiting to protect against misuse.

No online service can guarantee perfect security, but we take protecting your information seriously.

7. The Parent Portal

Parents can request to link to their child's account by entering the child's email. The child must explicitly accept the request before the parent can see anything. Once linked, parents have read-only access to view their child's assignments, study plans, and chat history. Parents cannot change or delete the child's data. The child can see all active parent links and can manage them.

8. How Long We Keep Your Information

We keep your information for as long as your account is active and you are using FlowState. We are committed to deleting data that is no longer needed. Our general approach is:

  • Account and learning data is kept while your account is active.
  • If an account becomes inactive for an extended period, or when a student graduates or leaves the school, we will delete the associated data.
  • If a message is flagged by our safety system, a record may be kept for safety review. If you delete your account, any such flagged records are anonymized (no longer tied to your name or identity) and kept only for safety and legal review.

A full data retention and deletion schedule is maintained separately and available to the school on request.

9. Your Rights and Choices

You have the right to:

  • Know what information we collect about you (this policy explains it).
  • Access your information.
  • Request deletion of your account and personal data.
  • Delete Flowy memories specifically, at any time.

To make any of these requests, contact us at getflowstateai@gmail.com, or delete your account directly in the app under Account settings. When you delete your account, your personal data is permanently removed from our database. The only exception is messages previously flagged by our safety system, which are anonymized and kept only for safety and legal review. We will respond to and act on valid requests promptly.

10. Legal Notes (FERPA, CCPA, SOPIPA)

FERPA: Some information in FlowState, such as assignment data from Blackbaud, may be considered an education record under the federal Family Educational Rights and Privacy Act (FERPA). FlowState handles this information only on behalf of and under the direction of the school, for legitimate educational purposes, and does not re-disclose it except to the sub-processors listed above as needed to provide the service.

SOPIPA: FlowState complies with California's Student Online Personal Information Protection Act. We do not use student information for targeted advertising, do not build non-educational profiles, and do not sell student information.

CCPA: To the extent the California Consumer Privacy Act applies, FlowState honors the rights it provides, including the right to know and the right to deletion. Information handled under FERPA is generally exempt from CCPA.

11. Changes to This Policy

We may update this policy as FlowState grows or as legal requirements change. When we make significant changes, we will update the "Last Updated" date at the top and, where appropriate, notify users.

12. Contact Us

If you have questions about this Privacy Policy or your information, contact:

FlowState
Email: getflowstateai@gmail.com
Operated by Eli Afshani, Milken Community School (student project)
Los Angeles, California