What we keep,
and why.

Last updated 8 September 2026

OurFlow is a private memory space for a group of friends. This page says exactly what the app collects, who can see it, and how to make it go away. It is written to be read, not to be survived.

The short version

We collect what you put in — your name, your handle, your photos, your notes — and what is needed to sign you in.
Only the people in your crew can see what you put in that crew.
We do not sell anything, we do not advertise, and we do not track you across other apps or websites.
You can delete your account, and everything only you had, from inside the app.

Who is responsible

OurFlow is operated by the developer of the OurFlow app. For anything in this policy, including a request to access or delete your data, write to contact@yusufbera.de.

What we collect

What	Why	Where it comes from
Your name and handle	So your crew can find you and see who did what	You, when you sign up
A user identifier and email address	To sign you in and keep your account yours	Apple or Google, when you sign in
Photos and video you add	They are the app	You
Titles, notes and dates	They are the app	You
A place name and coordinate	Only when you ask a memory where it happened	Your phone, with your permission
Your birthday	Optional. It is what lets a day know whose it is	You, if you give it
Whether a crew is paid for, and by whom	To keep the crew open for everybody in it	Apple, through RevenueCat, when somebody subscribes
A notification token for your phone, its language, and which notifications you want	Only if you allow notifications: to tell you when something happens in one of your crews	Your phone, when you allow notifications

We do not collect your contacts, your browsing, your advertising identifier, or your location in the background. There is no analytics SDK in the app and no third party that receives your content.

Sign in with Apple

If you use Sign in with Apple and choose to hide your email address, Apple gives us a relay address instead of your real one. That is fine — we never need your real address, and we never try to work it out.

Who can see what

A crew's memories, photos and plans: only the people in that crew.
An AirFlow drop: only the people in that crew, and only until it expires.
Your name, handle, picture and colour: these four, and only these four, are returned to anyone signed in who searches for your handle. That is what makes it possible for your friends to add you. There is no way to browse a list of people, and no way to ask for anything about somebody that is not on this line.
Your birthday: only the crews you are in. It is not part of the profile a search can reach.
Your email address: nobody. It is used to sign you in and is never shown to another person.

When you leave a crew, or somebody removes you from one, your access to everything in it — including the photographs — ends with the next request you make.

Who we use to run it

The app stores your data with Google Firebase (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Firebase Cloud Messaging), acting as our processor. Firebase's own privacy information is at firebase.google.com/support/privacy. Data may be processed on Google servers outside your country; transfers out of the EEA and the UK rely on the European Commission's Standard Contractual Clauses.

If you allow notifications, they are delivered through Firebase Cloud Messaging and Apple's push notification service. A notification carries one line — who did what in which crew, and for an idea's conversation the first words of the message — and never a photograph. You can turn them off in the app's settings, all of them or one crew at a time, or in your phone's settings.

Subscriptions are sold by Apple and checked for us by RevenueCat, which receives an identifier for your account and what the App Store says about your subscription — never your photographs, your memories, or anything in a crew. RevenueCat's privacy policy is at revenuecat.com/privacy. We never see your payment details; Apple does not give them to us.

We use no other third-party service. There is no analytics SDK, no advertising, and no tracking. Nobody buys, rents, or is given your content.

How long we keep it

AirFlow drops are deleted when their window runs out — one hour to one week, chosen by the crew, twenty-four hours by default. A job on our server does it, not the app, so it happens whether or not anybody opens their phone.
Memories and crews stay until somebody deletes them. When the last member of a crew leaves, the crew and everything in it — including every photograph and video — is deleted.
Your account stays until you delete it. When you do, it goes immediately; backups roll off within 30 days.
A record that a subscription existed is kept while it is running and for as long as tax law requires afterwards. It holds no content.

Deleting your account

In the app: You → Settings → Delete my account. It removes your account, your handle, your profile, every crew where you were the only member, and every AirFlow drop that was yours.

Memories in crews that other people are also in belong to that group, and stay with them — the same way a photograph you gave a friend stays theirs. If you want those removed too, delete them, or leave the crew, before you delete your account. You can also ask us at contact@yusufbera.de, or use the web form.

Your rights

If you are in the EEA or the UK, the GDPR gives you the right to access, correct, export, restrict, object to, and delete what we hold about you. Our legal basis is the performance of our contract with you (Art. 6(1)(b)) for running the app, and your consent (Art. 6(1)(a)) for camera, photo library and location access, which you can withdraw in iOS Settings at any time. Write to contact@yusufbera.de and you will get an answer within 30 days. You may also complain to your local supervisory authority.

Children

OurFlow is not intended for children under 13, and we do not knowingly collect anything from them. If you believe a child has an account, write to us and it will be removed.

Security

Everything travels over TLS. What a crew holds — its memories and its files alike — is readable only by accounts on that crew's roster, and that is enforced on the server on every single request rather than in the app. Joining a crew requires an invite code checked on the server; knowing a crew exists is not a way into it. On your phone, the journal is written with iOS file protection.

Changes

If this policy changes in a way that matters, the app will say so before the change takes effect. The date at the top always says when it was last touched.

What we keep,and why.