FLOW — Privacy Policy
1. Who we are
FLOW is a marketplace that connects kitesurfing riders with instructors, schools and stations on the Egyptian Red Sea. This policy explains exactly what the app collects, why, and what you can do about it.
2. What we collect
We only collect what the app needs to run. Everything below is data you enter yourself or that is created by using the service — we do not buy data, and we do not track you across other apps or websites.
| Category | What | Why |
|---|---|---|
| Account | Name, email address | To create and sign you into your account. Passwords are handled by Google Firebase Authentication and are never seen or stored by FLOW. |
| Profile | Profile photo, short bio, riding level, home spot, town or area you type in, nationality, age, phone number | So riders and instructors can recognise and reach each other. All of it is optional except your name and email. |
| Instructor and school details | Certification body, level, IKO number, uploaded certificate files, years teaching, hourly rate, specialities, facilities, gear brands, group size, insurance status, Google Maps link, website, Instagram, WhatsApp | To list a professional on the marketplace and let us verify that their credentials are real before they can take bookings. |
| Bookings | Sessions booked, dates, times, cancellations | To operate the booking itself and show both sides their schedule. |
| Payments | Amount, currency, method, status, and the payment reference returned by our payment processor | To take a deposit and to handle refunds. FLOW never receives or stores your card number, expiry date or CVV — those are entered on the secure page of our payment processor, Paymob, and stay with Paymob. |
| Messages and reviews | Chat between a rider and an instructor, support tickets you open, and reviews and ratings you leave | To let you arrange a lesson, to help you when you contact support, and to show other riders honest feedback. |
| Notifications | A push notification token for your device | To tell you when a booking is confirmed, changed or cancelled. You can turn notifications off in your Android settings at any time. |
| Device integrity | A Google Play Integrity attestation | A security check that confirms requests come from a genuine copy of FLOW. It does not identify you. |
3. What we do not collect
We think this list matters as much as the one above.
- No device location. The app does not request location permission. Any place shown on your profile is text you typed in yourself.
- No advertising ID, no ad tracking, no advertising of any kind.
- No analytics and no third-party crash reporting. We do not measure your behaviour in the app.
- No contacts, no call logs, no SMS, no files beyond the photo or certificate you deliberately choose to upload.
- No card details, as described above.
4. Camera
FLOW asks for camera permission for one purpose: scanning the QR code that confirms you attended a session. Scanning happens entirely on your device. No photo or video from the scanner is stored or transmitted. The camera is never used in the background.
5. Who your data is shared with
We do not sell your personal data, and we never have. It is shared only with the service providers that make the app work:
- Google Firebase (Authentication, Firestore, Storage, Cloud Messaging, App Check) — hosts your account, your data and your uploads. See Firebase privacy.
- Paymob — processes deposit payments and refunds. Card data is entered directly with Paymob and never reaches FLOW. See Paymob privacy.
Beyond that, information is shared only between you and the other party to a booking: when you book a lesson, the instructor sees the profile details and contact information needed to teach it, and you see theirs.
We may also disclose information where the law requires it, or where it is necessary to investigate fraud or a safety issue.
6. Your rights and your choices
- Delete your account, from inside the app. Open Profile → Privacy & data → Delete account. This removes your profile and personal data. It cannot be undone.
- Edit or correct any profile field at any time.
- Turn off notifications in Android settings.
- Request a copy of the data we hold about you, by contacting us at the address below.
Some records must outlive the account. Completed bookings and payment records are kept where tax, accounting or fraud-prevention law requires it, and reviews you have left may remain visible without your name attached, so that the rating history of a professional stays honest.
7. Keeping data secure
Data is stored on Google Firebase infrastructure and is protected in transit and at rest. Access is restricted by server-side security rules, and every request from the app carries a Google Play Integrity attestation. No system is perfect, but we do not take shortcuts with your data.
8. Children
FLOW is not intended for children. You must be 18 or older to hold an account. Where a lesson is booked for a minor, it is booked and paid for by a parent or guardian on their own account.
9. Changes to this policy
If this policy changes in a way that affects you, we will update the date at the top and, where the change is significant, tell you in the app.
10. Contact
Questions about this policy, or about the data we hold about you:
WLF Tech
Email: info@wlf-tech.com