Privacy policy

Who we are

FlowELMS is an independent student project maintained by xzelleiv. It is not owned, endorsed, or operated by STI or the ELMS provider. This policy covers the FlowELMS Android app and this website.

Kept only on your phone

• Your ELMS session, stored in encrypted secure storage. It is never sent to FlowELMS or to an AI provider.
• Cached courses, pending work, profile, ELMS notifications, files, drafts, quizzes, and AI chats.
• Your Gemini API key and ChatGPT sign-in, stored in encrypted secure storage.
• Your settings, theme, and reminders.

Your FlowELMS account

Accounts run on Supabase. To check access and protect accounts, we store your email address, display name, the invite code you used and who invited you, your role and access status (including any block and its reason), and a record of each sign-in: the time, app version, phone brand, model, Android version, an install ID, and the Android ID.

Device details are used to keep each account on one phone. Signing in from a different phone blocks the account for one day. Admins can see account, sign-in, and device records to handle access and abuse.

Passwords are handled by Supabase Auth and are never visible to us. Confirmation and password reset emails are sent through Resend. The links in those emails pass their one-time code to the app and are removed from your browser history.

Notifications

• Due date reminders are scheduled on your phone and are not sent anywhere.
• If you turn on FlowELMS notifications, we store your Firebase Cloud Messaging token, phone label, and app version, plus a delivery record for each announcement sent to you.

AI, only when you use it

• AI is optional. Requests go from your phone straight to the provider you connected: Google Gemini (with your API key) or OpenAI ChatGPT (with your account). They do not pass through our servers.
• A request contains your message, earlier messages in that chat, and anything you add: photos, PDFs, files, an assignment, the text of the open ELMS page, your ELMS summary, or a quiz question in Quiz Mode.
• Web search, when the assistant uses it, is run by the provider.
• How long the provider keeps that data, and whether it is used for training, depends on the provider and your account settings.

Other connections

• ELMS pages load from elms.sti.edu, and school sign-in may use Microsoft. What you do there is between you and ELMS.
• The app checks GitHub for updates. GitHub receives your IP address as part of that request.
• A bug report opens a prefilled GitHub issue in your browser and is sent only if you submit it. Emails and tokens are removed from it first.
• FlowELMS has no ads, no analytics, and no tracking, and we never sell data.

This website

• The site uses no cookies and no analytics. Theme choices you make on the site are saved in your browser only.
• The hosting provider keeps standard server logs, such as IP address and request time.

Keeping and deleting data

• Local data stays until you reset the ELMS session, clear ELMS data in Settings, or uninstall the app.
• Account data is kept while your account exists. Sign-ups that are never confirmed are removed.
• Deleting an account removes its profile, sign-in records, push tokens, and invite code. A record that an admin acted on the account may remain.

Changes and contact

We will update this page when the app starts handling data differently, and change the effective date above.

To delete your account or ask about your data, contact xzelleiv on GitHub: https://github.com/xzelleiv.