Privacy Policy

Last updated: September 5, 2026

1. Data Controller

Name: Stephan Pirson
Country: Spain
Email: stephanpirso.n@gmail.com

2. What Data We Process

Crow Flow is a client-side graph visualisation tool. We keep data processing to an absolute minimum:

Server access logs: When you visit this website, our hosting provider automatically collects your IP address, browser user agent, requested URL, timestamp, and HTTP status code. These are standard web server logs.
Session cookie: Login uses a signed, HTTP-only session cookie containing account information. HTTPS deployments mark this cookie Secure. Signing protects integrity; the cookie is not encrypted.
Local diagrams: Local scenarios are saved in your browser's localStorage. Applying or saving local DSL does not upload diagram content. Local scenarios are shared by people using the same browser profile.
Optional Google login and cloud sync: Login stores your Google account identifier, email, name, and profile picture. Only diagrams you explicitly link to cloud sync are uploaded, including their names, DSL, and node positions. Their caches are separated by account in the browser; this is not encryption against someone with access to your browser profile.
Visit statistics: The application records page paths (without query strings), IP addresses, user agents, timestamps, and account email when logged in. It requests approximate location from ip-api.com using your IP address. This information is available to the service administrator.
Shared links and external resources: A shared link embeds the diagram in the URL, so recipients and infrastructure logging that URL may see it. External icon URLs contact the selected image host.

3. Hosting Provider

This website is hosted by Railway Corp. (San Francisco, USA). When you access this site, Railway processes server access logs as described above. Railway acts as a data processor on our behalf.

Railway's privacy policy: https://railway.app/legal/privacy

Since Railway is based in the United States, your data may be transferred outside the European Economic Area. This transfer is safeguarded by Standard Contractual Clauses (SCCs) as approved by the European Commission, which are incorporated into Railway's Data Processing Agreement.

4. Legal Basis for Processing

We process server access logs on the basis of our legitimate interest (GDPR Art. 6(1)(f)) in operating and securing this website. The legitimate interest is maintaining the availability, performance, and security of the service.

5. Data Retention

Browser data remains until you remove it or clear site storage. Logging out hides the account's cloud cache but does not erase that cache.

Cloud deletion removes a diagram from the active listing. The service retains deletion markers, earlier graph versions, account records, visit statistics, and historical collected diagrams in its database; there is currently no automatic retention purge. Contact the operator to request erasure. Hosting access-log retention is controlled by the hosting configuration.

6. Third-Party Links

This website contains a link to Buy Me a Coffee. Clicking this link will take you to an external website governed by its own privacy policy. We have no control over the data practices of third-party sites.

7. Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights regarding your personal data:

Right of access (Art. 15) — request a copy of the data we hold about you
Right to rectification (Art. 16) — request correction of inaccurate data
Right to erasure (Art. 17) — request deletion of your data
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21) — object to processing based on legitimate interest

To exercise any of these rights, contact us at the email address listed above.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD) — https://www.aepd.es.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.