Privacy Policy

Effective date: September 21, 2026
Last updated: September 21, 2026

This Privacy Policy explains how Tomorrow Web Design, a California sole-proprietor business operating MinuFlow ("MinuFlow," "we," "us," or "our"), handles personal information when you use MinuFlow.com, create a MinuFlow account, or contact us.

1. The short version

  • You can use the core focus workspace without an account.
  • Tasks, notes, timer history, favorites, and most preferences stay in your browser. They are not uploaded to your MinuFlow account.
  • If you create an account, we collect the minimum information needed to provide and protect it.
  • We do not sell personal information or use it for cross-context behavioral advertising.
  • MinuFlow accounts are available to people age 13 and older. We do not collect a date of birth or offer child or parent-managed accounts.

2. Information we collect

Account information

When you register with email, we process your email address, a securely hashed password, email-verification status, account and sign-in records, acceptance of the Terms and Privacy Policy, and the date and time of your 13-or-older confirmation. Passwords are not stored in readable form.

If you choose Google sign-in, Google provides a verified email address and a stable account identifier. MinuFlow stores the email address and a one-way hash of the Google identifier used to recognize the linked account. We do not request access to Gmail, Google Drive, contacts, or calendars.

Security and technical information

Our site, hosting provider, Cloudflare, WordPress, and security tools may process IP address, browser and device information, request time, requested pages, cookie or session identifiers, and security events. MinuFlow’s account-rate limits use salted digests rather than retaining raw email or IP values in those rate-limit keys.

Cloudflare provides delivery and security. Google Analytics 4, placed through Site Kit, measures use of public pages; the Analytics setting excludes logged-in users. The site may also request web fonts from Google Fonts. Search Console and PageSpeed Insights help us understand site availability and performance.

Communications

If you contact us or make a privacy request, we receive the information in your message and the details needed to respond and verify the request.

Payments

When you choose a paid Premium plan, WooCommerce processes the order and subscription, and Stripe processes the card payment. We retain order, billing, subscription, refund, and invoice records needed to provide the plan and meet legal obligations. We do not directly store complete payment-card numbers. The amount, renewal terms, and refund policy are shown before purchase.

3. Browser-local workspace data

Tasks, notes, timer history, display settings, favorites, and similar focus-space information currently remain in the browser profile where they were created. They are not associated with your account, are not included in an account-data export, and are not removed by signing out or requesting account deletion.

Clearing browser data may erase this workspace. People sharing the same browser profile may be able to see it. Use MinuFlow’s Backup & restore feature if you want a separate copy.

4. Cookies and local storage

MinuFlow uses necessary cookies and browser storage for login sessions, security, site operation, WooCommerce compatibility, and workspace preferences. We do not use advertising cookies. Optional third-party content is loaded only when you choose it where practical; for example, Google sign-in is requested for the Google login flow, and a Spotify player is loaded after you select a Spotify playlist. Those providers apply their own privacy policies.

5. How we use information

We use information to:

  • create, verify, authenticate, secure, and support accounts;
  • send verification, password-reset, privacy-request, and service messages;
  • prevent fraud, abuse, and unauthorized access;
  • operate, troubleshoot, measure, and improve MinuFlow;
  • respond to support and privacy requests;
  • comply with applicable legal, security, tax, accounting, and dispute obligations; and
  • enforce our Terms and protect MinuFlow, our users, and others.

6. When we disclose information

We disclose only what is reasonably necessary to service providers that help us host, secure, deliver, authenticate, email, measure, or support MinuFlow. These may include our hosting provider, Cloudflare, Google when you choose Google services, WordPress/WooCommerce service components, and our email provider. Stripe receives payment information when you choose a paid plan.

We may also disclose information when required by law, to protect rights and safety, to investigate abuse, to establish or defend legal claims, in a business transfer subject to appropriate safeguards, or at your direction.

We do not sell personal information or share it for cross-context behavioral advertising.

7. Retention

We retain account information while an account is active and afterward only as reasonably necessary for security, restoration, disputes, legal obligations, and request handling. Short-lived verification, password-reset, Google challenge, and rate-limit records expire as part of normal operation. Hosting, security, and support records are retained according to operational need and provider settings. Transaction and tax records may be kept for legally required accounting periods.

Deletion requests are verified and reviewed before action. Some information may be retained where required or permitted by law, including security, fraud-prevention, dispute, and transaction records. Browser-local workspace data must be removed in the relevant browser by the user.

8. Your choices and rights

You may use the core workspace without an account, choose email/password or Google sign-in when available, download a workspace backup, request a copy of account data, request account deletion, or contact us to request access, correction, deletion, or help.

Depending on applicable law, you may also have rights to know, correct, delete, restrict or object to processing, receive portable data, withdraw consent, or complain to a regulator. We may need to verify identity before fulfilling a request. We will not discriminate against you for exercising an applicable privacy right.

Account-data exports do not include browser-local tasks and notes. An account-deletion request does not automatically cancel a paid subscription or clear local browser data.

9. Age and accounts

MinuFlow accounts are available only to people age 13 and older. We do not knowingly offer accounts to children under 13. If you believe an under-13 user created an account, email [email protected] so we can review the account. The browser-local focus workspace remains available without an account.

10. Security

We use reasonable safeguards designed to protect information, including HTTPS, password hashing, restricted account endpoints, request verification, rate limits, and access controls. No system is completely secure. Keep your password private and contact us if you suspect unauthorized access.

11. International use and changes

MinuFlow is operated from California, United States. Our service providers may process information in the United States and other countries. We will update this Policy when our practices or the Service materially change and provide additional notice when required.

12. Contact

MinuFlow is a Tomorrow Web Design project.

Privacy requests may be submitted through signed-in MinuFlow account controls or by emailing [email protected].