Privacy

Privacy

Last updated 14 November 2026

This notice covers the Flow websites: flowking.life, flowos.world, noahnuru.com, flowspace.world and flowvault.shop. They are run by Noah Nuru, an individual operating as Flow, who decides how your data is used (the data controller). Questions or requests: flowking@mail.grokbot.com.

The short version: we collect what you give us to deliver what you asked for. We don’t sell your information, and signing up for one thing doesn’t sign you up for anything else.

What we collect

• Free Flow Audit. Your answers, an optional first name, and your email only when you ask us to send your report. We also record progress and delivery events. Your answers are processed by an AI model to write your result. The check has its own notice with more detail: Free Flow Audit privacy.
• Support chat. Guide searches stay in the current tab. If you agree to save a conversation, we store its questions, replies and consent time in the existing Flow support system. This browser tab stores a private access key and any submission awaiting confirmation. An email claim does not link account or order history. Chat content is excluded from website analytics.
• The Flow Business Audit form. The form linked from your Free Flow Audit result runs on Typeform. It collects your answers about your business, role, revenue range, team size, timing and budget, and your name, email and an optional website.
• Earlier applications. Applications are no longer offered on these sites. If you sent one, we hold your name, email, main bottleneck and the details you gave.
• Earlier FlowState launch interest. This list is no longer collected. If you joined it, we hold your email and the time and version of your consent to launch updates. Joining this first-party list does not start a paid subscription or enroll you on Substack.
• Earlier waitlists and interest forms. Waitlists are no longer offered on these sites. If you joined one, we hold your email, an optional name, the offer or item you chose, and, for priced offers, that you acknowledged the price and whether you’d buy within 90 days. We store the time you agreed to be contacted.
• Where you came from. Campaign tags in the link you used, the page you landed on and the site that referred you, so we know which posts and pages bring people.
• Analytics, only if you allow it. Page visits and clicks. Analytics never include your Audit answers, name or email.
• Security. Your IP address is used briefly to limit repeated submissions and sign-in attempts; the limit counters store a one-way hash of the address, not the address. Our hosting provider keeps standard request logs.
• Email opt-outs. If you unsubscribe from Flow marketing emails, we keep a one-way hash of your address so we don’t email you again.

Please don’t send passwords, customer records, payment details or medical information in any form.

How we use it

• To generate and send your Audit and let you reopen it.
• To confirm and review your application and reply if there’s a fit.
• To email you once when an offer or item you chose opens.
• To understand, in aggregate, which pages and posts are useful.
• To keep the sites secure and working.

The Flow Letter on Substack is a separate, free publication under Substack’s own terms. FlowState on these sites is free. Nothing on these sites starts a subscription or billing.

AI. Free Flow Audit answers are processed by an AI model to write your result. The result is a starting point to think with, not professional advice.

Legal basis (EU and UK visitors)

We use analytics only with your consent, which you can withdraw at any time in the footer privacy controls. We process what you send through a form (the Free Flow Audit, the Flow Business Audit form) to do what you asked: that is necessary to take the steps you requested before any contract, or is in our legitimate interest in replying to and reviewing requests you chose to send. Security logs and rate limits rely on our legitimate interest in keeping the sites working and safe.

Who processes it

Provider	What it does for us
Supabase	Stores applications, Free Flow Audit records, waitlist entries, consent records and email opt-outs
Vercel	Hosts flowking.life, noahnuru.com, flowos.world, flowspace.world and flowvault.shop and, through Vercel AI Gateway, routes Free Flow Audit requests to AI model providers
AI model providers	Write your Free Flow Audit result from the answers you submit, reached through Vercel AI Gateway
NVIDIA	Runs the AI model for the Free Flow Audit when Flow routes it to NVIDIA’s model service
Resend	Sends Free Flow Audit results, confirmations and service emails
PostHog	Measures page visits and clicks, only after you allow analytics
Typeform	Runs the Flow Business Audit form linked from your Free Flow Audit result. Typeform sets its own cookies and trackers under its own policy
Stripe	Would process payments once a paid offer opens; no live payments today
Substack	Runs the Flow Letter if you subscribe there. Substack sets its own cookies and trackers under its own policy
Cloudflare	Protects and delivers some Flow sites and sets bot-protection cookies there
Discord	Hosts the FlowKing community if you are invited and choose to join

Cookies and local storage

• Optional website analytics. On flowking.life, noahnuru.com, flowos.world, flowspace.world and flowvault.shop, PostHog analytics are off until you choose Allow analytics. Your choice is saved in local storage (flow.analytics.consent.v1). After opt-in, a random anonymous ID is stored locally (flow.anon.v1) and in a first-party cookie that expires 180 days after the last consented analytics event. Local storage remains until you clear it. This ID is not synchronized across Flow domains. No form answers or email addresses are sent to this collector; no session replay or autocapture is used. Withdraw analytics consent using Privacy settings in the footer. Do Not Track and Global Privacy Control override an opt-in.
• Campaign link in this tab. When you open a Flow page from a campaign link, this browser tab stores the link tags utm_source, utm_medium, utm_campaign, utm_content and click_id in session storage under the key flow.hook.first.v1. The purpose is to let a free Audit you start or finish in this same tab record which post brought you. This key is session storage only until you allow analytics. The browser clears session storage when you close the tab. The key is not written to local storage before that choice. No name, email or Audit answers are stored in it. If you choose Allow analytics, the same key may also be kept in local storage for 24 hours and is removed if analytics is turned off.
• Visit confirmation on noahnuru.com. When you arrive at noahnuru.com/audit from a Flow campaign link, the page sends only that link’s click ID to flowking.life/api/click-landing, before any analytics choice, to confirm the visit arrived. It sets no cookie and stores nothing in your browser. On our side it only records the time that click landed, on the existing click record. It is skipped when Do Not Track or Global Privacy Control is on.
• Form attribution and support. A form you choose to send can include the campaign tags from this tab. This is separate from optional analytics. Support chat keys remain in session storage as described above.
• Admin and invites. A signed sign-in cookie (fk_admin) is set only for Noah’s admin access. Approved community members joining Discord get two short-lived cookies (fk_join_state, fk_join_token) for ten minutes during the join.
• Typeform sets its own cookies and trackers when you open the Flow Business Audit form there.
• Substack sets its own cookies and trackers when you read or subscribe to the Flow Letter there.

How long we keep it

Audit answers saved on your own device are kept there for up to seven days. Free Flow Audit records, applications and waitlist entries are kept until you ask us to delete them or we no longer need them to provide what you asked for. You can delete a saved Free Flow Audit yourself from its management link. Leaving a waitlist with the link in a waitlist email deletes your waitlist entry. Flow also keeps one customer record per email address (the email, and a name if you gave one) that links the forms you have used across the Flow sites; leaving a waitlist does not delete that record, but you can ask us to. Rate-limit counters hold only a one-way hash and stop counting when their window ends; expired counters are cleared as new requests arrive. Email opt-outs are kept as long as we need them to honour your choice.

Saved chat access expires 30 days after creation. The daily cleanup removes its message content; a minimal case record remains for operational accounting. You can remove the message content sooner with Delete conversation. Browser access and any unconfirmed submission remain in session storage until you clear the tab’s support session or your browser removes it. Hosting and database backups follow their existing retention settings.

FK AI is off by default. When enabled, only approved public Flow information and the questions in your own conversation are sent to the configured model provider. The guide itself does not make model calls. Private founder context and other customers’ history are not part of chat answers.

Your choices

• Ask for a copy, a correction or deletion of your information by emailing flowking@mail.grokbot.com. We reply within 30 days.
• Delete a saved Audit from its management link.
• Change your analytics choice at any time with the privacy controls in the site footer.
• Leave a waitlist with the link in a waitlist email, or by emailing flowking@mail.grokbot.com.
• Unsubscribe from Flow marketing emails with the link at the bottom of any of them.

Children

The Flow websites are for adults running a business or career. They aren’t intended for anyone under 18.

Changes

If we change how we handle information, we’ll update this page and the date above.