Privacy Policy
We built TopFlow with privacy as a core principle. Here's exactly what we do (and don't do) with your data.
We collect minimal data. Your workflows and API keys are stored in your browser and sent to our server only when you run a workflow — used in memory, never stored or logged. We set no cookies and use only anonymous page analytics; we don't track individuals or sell data.
✅ Your API keys (stored in your browser; used only in memory to run a workflow)
✅ Your workflows (stored locally only)
✅ Execution results (ephemeral processing)
✅ Personal information (we don't store it)
📊 Page views (anonymous analytics)
📊 Referrer sources (where visitors come from)
📊 Basic device info (browser, OS)
❌ NO personal identification
Client-Side Storage (Your Browser)
The following data is stored locally in your browser using localStorage:
- API Keys: Your AI provider credentials (OpenAI, Anthropic, Google, Groq)
- Workflows: Your created workflow definitions and configurations
- Version History: Previous versions of your workflows
- UI Preferences: Settings like sidebar state
This data never leaves your device unless you explicitly execute a workflow.
Cookies & Browser Storage
TopFlow sets no cookies. It uses your browser's localStorage, which never leaves your device on its own:
| localStorage key(s) | Purpose |
|---|---|
ai-agent-api-keys, ai-agent-github-token | Your provider keys and GitHub token (AES-256-GCM encrypted) |
ai-agent-workflows, ai-agent-versions, ai-agent-builder-workflow | Your saved workflows, version history and current work |
palette-collapsed, topflow-blog-*, cookie-notice-dismissed | Interface preferences |
Analytics (Vercel Analytics)
We use Vercel Analytics to understand how people use our demo. This helps us improve the product.
What Vercel Analytics collects:
- Page URLs visited
- Referrer (where you came from)
- Browser and OS information
- Device type (desktop, mobile, tablet)
- Anonymous session data
Vercel Web Analytics sets no cookies (the site sets none at all). For how Vercel processes request data, see its privacy documentation below.
Learn more: Vercel Analytics Privacy Policy
- No email collection (no sign-up required)
- No user accounts or profiles
- No marketing cookies or tracking pixels
- No selling of data to third parties
- No cross-site tracking or retargeting
- No device fingerprinting
- No server-side storage of your workflows or API keys
When you execute a workflow on TopFlow:
- Your workflow graph and API keys are temporarily sent to our server
- Our server validates and executes your workflow
- Results are streamed back to your browser in real-time
- Your workflow content, inputs and API keys are never stored or written to our logs — our logs record only counts, IDs and error types
- Our host (Vercel) keeps standard request logs (such as IP address and URL) to operate the service; our rate limiter keeps only an HMAC-hashed form of your IP, for about a minute
The execution is ephemeral—once complete, all data is immediately discarded from server memory.
Vercel (Hosting & Analytics)
Our website is hosted on Vercel. They provide infrastructure and anonymous analytics.
Vercel Privacy Policy
Google Fonts
We use Google Fonts for typography. Google may receive font file requests and basic HTTP request data (IP address, user agent). Google Fonts does not set cookies.
Google Fonts Privacy FAQ
AI Providers (User-Provided Credentials)
When you execute workflows, requests are sent to AI providers using your own API keys. We never see or store your API keys on our servers. Your keys remain in your browser's localStorage.
- • OpenAI: Privacy Policy
- • Anthropic: Privacy Policy
- • Google: Privacy Policy
- • Groq: Privacy Policy
Right to Access
All your data is stored in your browser's localStorage. You can view it anytime using browser developer tools (F12 → Application → Local Storage).
Right to Deletion
Clear your browser data to delete all workflows, API keys, and preferences. This is instant and permanent.
Right to Data Portability
Export your workflows as JSON files directly from the app. You own your data.
Right to Opt-Out (CCPA)
We do not sell personal information. There is nothing to opt out of.
Since all sensitive data is stored client-side in your browser:
- Your data is protected by your device's security (password, encryption)
- Your API keys are stored in encrypted browser storage when using HTTPS
- We recommend using strong browser passwords and device encryption
- Never access TopFlow from shared or public computers
Our service is not directed to children under 13. We do not knowingly collect data from children.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via our homepage.
For privacy questions or concerns:
"We built TopFlow with privacy as a core principle. Your data is yours—we never see it, store it (server-side), or share it."