Flowzito Privacy Policy

Contact: hai@zhouworks.com

1. Overview

Flowzito is designed as a local-first application. Most of the data required for the app to operate is processed and stored directly on your device.

When you use project features, Flowzito communicates directly from your device with Autodesk Forma and related Autodesk services using the Autodesk account you choose to connect.

In the current implementation, Flowzito does not use a separate Flowzito backend to relay or store your project data.

2. Data Flowzito processes

Depending on the features you use, Flowzito may process:

Autodesk account information: account identifier, display name, and email provided through Autodesk OAuth/OpenID Connect.
Authentication information: Autodesk access token, refresh token, and token expiry information.
Workspace information: Hub/Project identifiers, names, data region, Workspace name, and active Workspace selection.
Autodesk Forma project data: folder and file metadata, members, permissions, Reviews, RFIs, Issues, Forms, Assets, Submittals, Schedule data, and other data required by a feature you choose to use.
Data Connector data: datasets or CSV files downloaded from Autodesk to your device for dashboards and analysis.
Files you select: such as Excel files used for imports or PDFs selected for processing.
Local operational data: scenarios, dashboards, filters, preferences, job state, summaries of completed/failed/cancelled jobs, and certain checkpoints used to continue operations.
Files generated by Flowzito: such as CSV reports or QR-stamped PDFs.

3. Where data is processed

Flowzito performs many operations directly on your device, including reading selected files, preparing import data, processing certain datasets, generating reports, and processing PDFs.

When a feature needs to read or modify project data, the application sends requests directly from your device to Autodesk Forma or the relevant Autodesk service using the permissions of the signed-in Autodesk account.

Flowzito currently does not upload a full copy of your project data to a separate Flowzito server for processing.

4. Data stored on your device

Flowzito stores certain data locally so the application can continue working between sessions, including:

Workspace and Hub/Project metadata;
linked-account metadata;
dashboards and layouts;
scenarios and tool preferences;
job history;
Data Connector preferences and downloaded datasets;
certain temporary files or artifacts created during export/share operations.

This data is stored within the application's local storage area. Not all local data receives an additional application-level encryption layer from Flowzito, so the device should remain protected by appropriate operating-system security and organizational policies.

5. Sign-in and token storage

Flowzito uses the Autodesk OAuth Authorization Code Flow with PKCE.

On iOS/Android:

access tokens, refresh tokens, and expiry information are stored using operating-system secure storage through Expo SecureStore;
tokens are not stored in AsyncStorage;
signing out deletes authentication secrets stored by Flowzito.

In the current web implementation, tokens are held only in memory for the running session and are not written by Flowzito to persistent local storage.

6. Who Flowzito communicates with

In the current implementation, network traffic is primarily exchanged directly with Autodesk Forma and supporting Autodesk services, including Autodesk Platform Services, Autodesk user profile services, and Autodesk Construction Cloud.

Where Autodesk provides signed download URLs, Flowzito may download data directly from those URLs.

When you use device sharing, files are passed to the operating-system share sheet and then to the application or service you choose.

The inspected source currently contains no third-party advertising SDK, behavioral analytics SDK, or crash-reporting SDK.

7. How Flowzito uses data

Flowzito processes data to:

authenticate and maintain your Autodesk session;
identify the correct Hub, Project, and Workspace;
read data required for dashboards and tools;
perform operations you explicitly request in Autodesk Forma;
preserve local configuration and state between sessions;
generate, export, or share files at your request.

Flowzito does not sell personal data and does not use Autodesk Forma project data for behavioral advertising.

8. Retention

Tokens are retained until they expire, are replaced, or you sign out.
Signing out removes Autodesk authentication secrets stored by Flowzito.
Some local Workspace, dashboard, scenario, job-history, preference, and dataset data may remain on the device after sign-out.
Local data may be removed using available in-app deletion controls, by clearing application data, or by uninstalling Flowzito, depending on the data type and platform.
Data created or modified in Autodesk Forma remains within the Autodesk environment and is governed by Autodesk and the organization that owns the relevant project.

9. Your controls

You can:

sign out to disconnect your Autodesk session;
remove Workspaces or local artifacts where relevant controls are available;
revoke Flowzito access through Autodesk account controls;
clear application data or uninstall Flowzito to remove remaining local data;
contact hai@zhouworks.com with questions about data directly controlled by Flowzito.

Flowzito cannot delete Autodesk Forma data on your behalf where that data belongs to an Autodesk account, Hub, or Project controlled by Autodesk or your organization.

10. Children

Flowzito is designed for professional project work and is not directed to children.

11. Changes to this policy

This policy may be updated when Flowzito's storage architecture, product features, or Autodesk integrations change. The updated policy will show a new effective date.

12. Contact

Privacy questions may be sent to hai@zhouworks.com.