Privacy Policy

This policy explains what personal information Initfinity collects, why, who we share it with, how long we keep it, and the choices you have. It applies to initfinity.io, the Initfinity apps, hosted flows, AI agents and related services (the "Service").

Who is responsible

The controller of your personal information is Universal Syntax, LLC, the operator of Initfinity. Contact us at privacy@initfinity.io for any privacy question or request.

Local-first by design

You can use the Service without an account. In that case your flows, files, notes and stored credentials stay in your browser's storage on your device, and we do not receive them. Data reaches our servers only when you create an account or use a cloud feature: hosted flows, AI features, AI agents, backups, collaboration, custom domains, support, or billing. Your workflows can also call outside websites and APIs you choose (for example an AI provider with your own key); that traffic goes to those services directly, under their terms.

Information we collect

Account data: email address, name or display name, avatar, password hash (if you use a password), and the sign-in provider you used (Google or GitHub). We never receive your Google or GitHub password.
Content you put in the cloud: flows and their saved versions, published public flows, hosted credentials (encrypted at rest), backups and files you upload, support messages, team and invitation details.
Execution and agent data: when a hosted flow or agent runs we store the trigger payload, result or error, timing and approval requests (including tool inputs) so you can review history. AI agent conversation history is stored per thread (the most recent 50 turns), including prompts and responses.
AI requests: prompts and flow data you send to AI features are transmitted to our AI providers to generate a response. We keep usage records (model, token counts, latency, cost, status) but not the prompt text in those records. For free-plan requests we may pass the prompt text to an automated moderation service (OpenAI's moderation endpoint) to detect abuse, and we send our AI providers a pseudonymous identifier derived from your account id so misuse can be attributed to one account.
Billing data: your plan, subscription status and Stripe customer identifier. Card details go to Stripe; we do not see or store full card numbers.
Technical data: IP address and network (ASN), used for security, abuse prevention and rate limiting; browser and device type; request logs and error diagnostics; and aggregate usage metrics. We also log requests to certain endpoints and resources we operate for security and to detect unauthorized access, copying or analysis of the Service or its software (including by automated tools), recording only standard request details such as time, IP address, country, user agent and the resource requested.
Referral data: when you first visit, we store where you came from (a link tag such as ?ref=, or the referring website) in a first-party cookie named if_src for up to 90 days. If you create an account, that source is saved with it so we can tell which channels bring people to Initfinity. It is not shared with third parties.
Mobile app data: if you use the Android or iOS app, we also process a push notification token (only if you allow notifications), your app version, operating system version and device model, and an app-instance identifier, to deliver notifications and updates and to diagnose problems. The app stores your sign-in token in the device's secure storage (Android Keystore or iOS Keychain). If you enable biometric unlock, your fingerprint or face is checked by the operating system on your device; we never receive or store biometric data. The app updates its web content over the air from our update provider (Capgo), which receives the app identifier, app version, and the device's platform and a random device identifier to select the right update.
Device features you choose to use: flow nodes can read your location, take photos, record audio, trigger haptics or share files, but only after your device asks for permission and only when you run a flow that uses them. That data stays on your device unless the flow sends it somewhere, for example to a hosted flow, an AI feature or another service you configure. You can revoke permissions at any time in your device settings.
Command-line tools and API tokens: if you create an access token for the Initfinity CLI, MCP server, VS Code extension or API, we store a hash of the token (never the token itself), its name, scopes and last-used time, and an audit record of token activity: creation, revocation, use from a new IP address, and each write made with it (token id, scope, route, flow id, client name and version). When the CLI opens a flow in the web app we hold it for up to 5 minutes, readable once by your account. We also record server-side milestones of your own account activity (for example first token created, first push, first deploy) to understand which channels work. The CLI binary itself sends no analytics or telemetry and talks only to the API you configure; its update check asks the package registry for the newest version and sends only a standard request, and you can turn it off with --offline.
Crash reports (native apps): the Android, iOS and desktop apps may send crash and error reports to Sentry: stack traces, app and operating system version, device model and an event identifier, without advertising identifiers, session replay or tracing. Reports are not sent from the web app.
Collaboration data: real-time collaboration uses peer-to-peer connections. Our signaling service helps participants connect, and participants can see each other's network addresses, as with any peer-to-peer connection.
Rooms and guests: a shared room keeps an encrypted copy of its contents on our servers while the room exists, so people can join when the owner is offline. The key is in the invite link and is never sent to us, so we cannot read the contents. A room with no activity for 30 days is moved to cold storage, still encrypted, and is deleted when its owner ends it. Opening a room link without an account creates a guest: an anonymous account with a generated name and no email address, kept only to join rooms. We also see the guest's network address for abuse limits. Guest accounts and their room memberships are deleted after 30 days without use, or when the guest signs in to a real account (which keeps their rooms).

Cookies and similar technologies

Strictly necessary: a session cookie to keep you signed in, security and bot-check tokens, and a short-lived if_tos cookie recording that you agreed to these terms while signing up. Browser storage also keeps your local files and preferences.
Referral: the if_src cookie described above.
Abuse prevention: when you use our AI features on a free plan, we set an if_dev cookie holding a random identifier, for up to one year. It lets us apply a daily usage limit per browser so that opening many accounts does not multiply free usage. It contains nothing about you and is not used for advertising or shared with third parties.
Analytics: we use counter.dev, a privacy-focused analytics script, to see aggregate page views, referrers, countries and devices. We do not use advertising cookies and we do not sell or "share" personal information for cross-context behavioral advertising. Clearing your cookies and site data removes the cookies and local storage.

How we use information and our legal bases

To provide the Service (account, hosting and running your flows, AI features, backups, billing, support). Basis: performance of our contract with you.
To keep the Service secure and fair (abuse, fraud and spam prevention, rate limiting, spend and plan limits, debugging, and protecting the Service and our intellectual property against unauthorized access, copying or reverse engineering). Basis: our legitimate interests in running a safe, sustainable service.
To understand and improve the Service (aggregate analytics, acquisition sources, product improvement). Basis: legitimate interests; consent where the law requires it.
To communicate with you (verification, password reset, run-failure alerts, service and legal notices). Basis: contract and legitimate interests.
To meet legal obligations (tax, accounting, responding to lawful requests). Basis: legal obligation. We do not use the content of your flows, prompts or files to train AI models, and our AI providers are instructed to process it only to return a response (see their policies for details and options).

We do not sell your personal information. We share it only with service providers who process it for us, and in the other cases below.

Infrastructure providers: cloud hosting, networking, databases, file and backup storage, bot protection and transactional email delivery, which store and process the data described above on our behalf. The current list is on our subprocessors page.
Stripe: payment processing and subscription management.
AI providers: OpenRouter and OpenAI (and the model providers they route to), to process your AI requests.
Sign-in providers: Google and GitHub, if you choose to sign in with them.
Crash reporting (native apps): Sentry.
Push and update delivery (mobile apps): Google Firebase Cloud Messaging (and Apple's push service on iOS) to deliver notifications, and Capgo to deliver over-the-air app updates.
counter.dev: aggregate website analytics.
Embedded players and integrations you choose to use, such as the Spotify player in the Jukebox, which loads only after you pick a playlist and then connects your browser to the provider under its own terms.
Other people you choose: collaborators, team members and anyone who can view a flow you publish.
Legal and corporate: authorities where required by law or to protect rights and safety; and a successor in a merger, acquisition or sale of the business, who must honor this policy. Providers may change; we will keep these categories current.

International transfers

We are based in the United States and our providers operate globally, so your information is processed in the United States and other countries. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK addendum, or a provider's participation in the EU-U.S. Data Privacy Framework. Business customers can use our Data Processing Addendum, which incorporates the Standard Contractual Clauses.

How long we keep information

Account and profile data: until you delete your account, then removed within 30 days, except what we must keep by law.
Flows, published flows, credentials, backups and files: until you delete them or your account. Saved versions of a flow are limited by plan (10 on Free, 50 on Pro).
Execution records (payloads, results, errors): 30 days.
AI usage records (model, tokens, cost; no prompt text): 90 days.
Token audit records (CLI and API activity): 90 days. Token records are deleted with your account.
CLI handoffs: 5 minutes.
Crash reports: as long as our crash-reporting provider retains them, generally up to 90 days.
Rate-limit and abuse-prevention counters (including IP-based): about 31 days.
Security and enforcement logs (the endpoint logs described under technical data): up to 12 months, longer if needed to establish, exercise or defend legal claims.
Agent conversation history: the most recent 50 turns per thread, until the thread or your account is deleted.
Push tokens: until you sign out, turn notifications off, uninstall the app, or the push service reports the token invalid.
Billing records: as long as tax and accounting law requires.
Support messages: until resolved, and for a reasonable period afterward.
Backups of our own systems may keep deleted data for a short additional period before they expire.

Security

We protect information with encryption in transit, encryption of stored credentials, access controls, and monitoring, and we limit staff access to what is needed. No system is perfectly secure; keep your passwords and API keys private, and use the narrowest-permission keys you can. If a breach affects your personal information we will notify you and regulators as the law requires.

Your rights and choices

Depending on where you live (including the EU, UK, California and other U.S. states) you may have the right to access, correct, delete, export or restrict the use of your personal information, to object to certain processing, to withdraw consent, and not to be discriminated against for exercising these rights. You can edit your profile in the app, publish or unpublish flows, and delete data you created. To exercise any right, or to delete your account, email privacy@initfinity.io; we may need to verify your identity and will respond within 30 days (45 for some U.S. requests). If we deny a request you may appeal by replying to us. If you are in the EU or UK you can also complain to your data-protection authority. California residents: we do not sell or share personal information as those terms are defined in the CCPA/CPRA.

Children

The Service is not for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it. Where local law sets a higher age of digital consent, the Service may only be used with a parent or guardian's permission.

Changes to this policy

We may update this policy from time to time. Updates take effect when posted, and we will show the new version in the app and may ask you to accept it before you continue using the Service. The date below shows the latest revision. Your continued use of the Service after you accept, or after an update takes effect where acceptance is not requested, means you agree to the updated policy.

Last updated: November 8, 2026