The Privacy Contract
Flowback was engineered from line 1 for developers working on proprietary, sensitive, and air-gapped codebases. Our architectural posture is strictly local-first, least-privilege, and zero-trust.
What Flowback NEVER Observes, Captures, or Stores:
- ❌ NO Screenshots or Screen Captures: Flowback never captures video or display buffers.
- ❌ NO Keystroke or Keylogging: Idle detection queries system elapsed seconds via
CGEventSourceSecondsSinceLastEventType; it cannot inspect which keys are pressed. - ❌ NO Mouse Coordinates or Cursor Tracking: Flowback does not record pointer trajectories.
- ❌ NO Source Code or File Contents: Flowback stores folder paths and window IDs, never source code lines or git diffs.
- ❌ NO Environment Variables, API Keys, or Secrets: Hook dispatchers strip sensitive tokens.
- ❌ NO Telemetry, Analytics, or Remote Crash Dumps: Zero telemetry tracking, zero analytics beacons. The only outbound network request ever made is strictly user-initiated or opt-in to fetch
release-manifest.jsonwhen checking for app updates. - ❌ NO Accounts or Cloud Sync: No user registration, no telemetry keys.
What Flowback DOES Observe & Store Locally:
To restore you to the correct working window, Flowback records only minimal structural metadata in local SQLite:
| Field | Purpose | Example |
|---|---|---|
bundleIdentifier |
Which app was active | com.microsoft.VSCode |
processIdentifier |
Target process ID | 4821 |
windowIdentifier |
Target window ID | 42 |
windowTitle |
Workspace title match | matchday — Visual Studio Code |
workspacePath |
Project directory | /Users/name/src/matchday |
timestamp |
Session start / stop time | 2026-10-16T09:00:00Z |