Privacy Policy

Last updated: February 28, 2026

1. Data Controller

Name: Stephan Pirson
Country: Spain
Email: stephanpirso.n@gmail.com

2. What Data We Process

Crow Flow is a client-side graph visualisation tool. We keep data processing to an absolute minimum:

Server access logs: When you visit this website, our hosting provider automatically collects your IP address, browser user agent, requested URL, timestamp, and HTTP status code. These are standard web server logs.
No cookies: This website does not set any cookies.
Local storage: The application uses your browser's localStorage to save your graph scenarios. This data is stored entirely on your device and is never transmitted to our servers.
No analytics or tracking: We do not use any analytics tools, advertising trackers, or third-party scripts that collect personal data.

3. Hosting Provider

This website is hosted by Railway Corp. (San Francisco, USA). When you access this site, Railway processes server access logs as described above. Railway acts as a data processor on our behalf.

Railway's privacy policy: https://railway.app/legal/privacy

Since Railway is based in the United States, your data may be transferred outside the European Economic Area. This transfer is safeguarded by Standard Contractual Clauses (SCCs) as approved by the European Commission, which are incorporated into Railway's Data Processing Agreement.

4. Legal Basis for Processing

We process server access logs on the basis of our legitimate interest (GDPR Art. 6(1)(f)) in operating and securing this website. The legitimate interest is maintaining the availability, performance, and security of the service.

5. Data Retention

Server access logs are retained for 7 days and then automatically deleted.

Data stored in your browser's localStorage remains on your device until you manually clear it.

6. Third-Party Links

This website contains a link to Buy Me a Coffee. Clicking this link will take you to an external website governed by its own privacy policy. We have no control over the data practices of third-party sites.

7. Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights regarding your personal data:

Right of access (Art. 15) — request a copy of the data we hold about you
Right to rectification (Art. 16) — request correction of inaccurate data
Right to erasure (Art. 17) — request deletion of your data
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21) — object to processing based on legitimate interest

To exercise any of these rights, contact us at the email address listed above.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD) — https://www.aepd.es.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.