Data Security Policy

Effective Date: July 3, 2026

Flow-Entertainment applies technical and organisational measures designed to protect the personal data processed through Flow.

1. Message Security

Direct messages and related media are transmitted over secure network connections and stored on access-controlled backend infrastructure; access to message content is limited to authorised systems and personnel as described below.

2. Infrastructure

Secure backend infrastructure hosted on Supabase, with role-based access controls limiting who can access production data.

HTTPS/TLS enforced for all network traffic between the App and our servers.

Sensitive credentials on-device (such as authentication tokens) are stored using the operating system's secure storage (iOS Keychain / Android Keystore) rather than in plain text.

Access-controlled storage of profile photos and other user-uploaded media.

3. Access Control

Access to production systems and user data is limited to authorised personnel on a need-to-know basis and is logged.

4. Testing and Audits

We conduct periodic security reviews of the App and backend and remediate identified issues on a risk-prioritised basis.

5. Incident Response

In the event of a data breach affecting your personal data, we will notify affected users and, where legally required, the relevant supervisory authority, without undue delay and in line with GDPR breach-notification timelines.

6. Your Role

Keep your device, operating system, and the App updated, use a strong device passcode, and never share your one-time SMS codes with anyone.

7. Contact

Security concerns or suspected vulnerabilities: privacy@flow-entertainment.com.