Privacy Policy

Last updated: October 2026

This policy explains what information MicroFlow handles when you use it, and in particular what it does with data from your Google account if you choose to connect one.

1. Information we handle

• Account sign-in. Access to MicroFlow is protected by a user name and password configured by the server's operator. A session cookie keeps you signed in.
• Workflows and settings. The workflows, environment values and credentials you create are stored in the operator's database. Secrets and OAuth tokens are encrypted before they are stored.
• Google account data (only if you click Connect). See section 2.
• Execution logs. Run history is kept only for a short time (about 12 hours) and is then deleted automatically.

2. Google user data

When you click Connect for a Google service, MicroFlow asks Google for the minimum access that service needs:

• Your email address (userinfo.email, with openid) — shown in the dashboard as “Connected as” so you know which account is linked. It does not give access to your mail.
• Gmail (gmail.send) — only to send emails that your own workflow composes. MicroFlow does not read, list or delete your email.
• YouTube (youtube.upload, youtube) — only to upload and manage videos on your own channel as directed by your workflow.
• Google Sheets (spreadsheets) — only to read and write the spreadsheets your workflow points to.

Each service is requested separately and independently of the others. Google data is accessed only when a workflow you created runs, and only to perform the action you configured.

3. How we use Google data

We use Google user data solely to provide the features described above to you. We do not sell it, do not use it for advertising, do not use it to build or train generalised AI/ML models, and do not transfer it to third parties except as needed to carry out the action you asked for, to comply with law, or with your consent. No person reads your Google data unless you ask for support and explicitly allow it, it is necessary for security or abuse investigation, or the law requires it.

MicroFlow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Storage, security and retention

The OAuth refresh/access tokens issued by Google are stored encrypted (AES-GCM, using the server's master key) and are used only to call the Google APIs you connected. Tokens are kept until you disconnect the service or revoke access. Data returned by Google while a workflow runs is processed in memory and may appear in the short-lived execution log described in section 1.

5. Your choices and deleting your data

• Click Disconnect next to a Google service in the dashboard to delete the stored tokens for it.
• You can also revoke access at any time at myaccount.google.com/permissions.
• To have other stored data removed, contact us (section 7) or the operator of this installation.

6. Changes

We may update this policy; the date above shows the latest revision. Material changes affecting Google user data will be reflected here before they take effect.

7. Contact

Questions or requests about this policy: the support email address listed on our Google OAuth consent screen.