Privacy Policy

Last updated: 7 October 2026

1. Introduction

AutoFlow ("AutoFlow", "we", "us", "our") is operated by amine.smpc and makes the AutoFlow Studio and AutoFlow Motion Chrome browser extensions. This Privacy Policy explains what personal data we collect through these extensions and the website at auto-flow.studio, how we use it, how we store and protect it, who we share it with, and your rights regarding that data. Where something applies to only one of the extensions, this policy says so.

By installing or using AutoFlow Studio or AutoFlow Motion you agree to this policy. If you do not agree, please uninstall the extension and do not use our services.

2. Data We Collect

2.1 Account & Authentication Data

When you create an account or sign in, we collect the following. One AutoFlow account works in both extensions.

  • Email address — used to identify your account, communicate important service updates, and link your subscription.
  • Password (email/password sign-up only) — hashed on the server; we never store or transmit your password in plain text.
  • Google ID token (Google Sign-In only) — received from Google via Chrome's identity API and sent to our server solely to verify your identity. We do not receive or store your Google password.

2.2 Usage Data (AutoFlow Studio)

To enforce plan limits (free vs. Pro) and prevent abuse, we collect the following numeric counts only:

  • Prompt counts — number of text and full prompts submitted per day.
  • Workflow run counts — number of queue runs started per day, broken down by mode (lite / flow / full).
  • Download counts — number of media downloads per day.
  • Node and generate counts — number of nodes and generation steps per workflow run.

These counts are tied to your account for billing purposes. We do not collect the content of your prompts, the text of AI responses, or any images or videos. AutoFlow Motion keeps job records instead of these counts; see Section 2.6.

2.3 Community Template Submissions (AutoFlow Studio, Optional)

If you choose to share a workflow as a community template, we collect:

  • Your display name (author name you provide).
  • The workflow payload — the node graph, prompt text, and settings you explicitly choose to publish.

This is entirely voluntary. Workflows are never uploaded unless you press the "Share" button.

2.4 Review Reward Claims (Optional)

If you claim a review reward, we collect the reviewer name you provide so we can verify the review.

2.5 Websites the Extensions Work On

To automate the video work you ask for, the extensions open and operate pages on the following sites, using your own signed-in accounts:

  • Google Flow — labs.google and flow.google.com. The extensions also download the media of your own Flow generations from flow-content.google and googlevideo.com.
  • ChatGPT — chatgpt.com
  • Gemini — gemini.google.com
  • Claude — claude.ai
  • Grok — grok.com (AutoFlow Studio only)
  • Z.AI — chat.z.ai (AutoFlow Studio only)
  • auto-flow.studio — our own website, so you can send an analysis from the Extractor into AutoFlow Studio (AutoFlow Studio only)

On these sites, the extensions read only the parts of the page that your task needs — the prompt box, upload and progress indicators, and the results — to bring AI responses and finished videos back into your workflow. What they read is processed locally in your browser and is not sent to our servers. The extensions do not read your conversation history, your other tabs, or any other website.

2.6 AutoFlow Motion

AutoFlow Motion turns the movement of a video you choose into new clips in Google Flow. This is the data it handles:

  • Your videos, images and prompts go only to the services you use for the job. The extension cuts your video into pieces on your computer. It sends the pieces (and, when a step needs them, your reference images) to the AI assistant you choose — Gemini, ChatGPT or Claude — which writes a prompt for each piece. It then uploads the pieces, your subject and place images and the prompts to Google Flow, which generates your clips. All of this happens in your browser with your own accounts. None of it passes through our servers or is stored by us.
  • Plan and job records. To give Free accounts 3 Motion jobs a day and AutoFlow Pro accounts unlimited jobs, the extension asks our server for your Motion allowance and registers each job you start. A job record holds a random job ID, a fingerprint, the date, and the time it was created. The fingerprint is a SHA-256 hash, calculated on your computer from your video file and the job's settings, which lets us recognise a retry of the same job so that retries are never counted again. It cannot be turned back into your video, and the video itself is never sent to us.
  • Uploads to Flow. Automated uploads are off until you turn them on in the panel. When they are on, the extension uses Chrome's debugger permission only to choose your video file in Flow's file picker, and detaches when the upload is done; Chrome shows a "started debugging this browser" banner while it is attached. To make the file available to that picker, each piece is saved briefly to an autoflow-omni-temp folder in your Downloads, which the extension empties at the start of the next upload. Turning uploads off stops new uploads; it does not delete anything already uploaded.
  • Saving clips. The clips you choose to save are ordinary browser downloads or, with "Download all", files written into a folder you pick in Chrome's own folder picker. Either way they go only to your device. The extension's downloads permission is used only for the temporary upload folder above, and to empty it.

2.7 Technical Data

When the extensions or the website contact our server, our hosting providers process standard technical data needed to deliver and secure the service, such as your IP address and the time of the request. The extensions also send their version number with each request.

3. Data We Do NOT Collect

  • Your prompts, AI responses, videos, images, or generated clips (in AutoFlow Motion these go only to the services you choose; see Section 2.6)
  • Your browsing history or activity on sites other than those listed in Section 2.5
  • Financial or payment information (payments are handled by our third-party payment processor, Whop; see Section 6)
  • Location data
  • Health or biometric data
  • Any personal data beyond what is described in Section 2

4. How We Use Your Data

  • Authentication: To sign you in, issue and refresh session tokens, and reset your password.
  • Plan enforcement: To check and enforce the daily and monthly usage limits of your plan, including the AutoFlow Motion daily job allowance.
  • Service operation: To maintain the extensions, detect and prevent abuse, and improve reliability.
  • Community features: To display shared templates and attribute them to their authors.

We do not use your data for advertising, profiling, or any purpose unrelated to operating AutoFlow's extensions and website.

5. Where and How Data Is Stored

5.1 Data Stored Locally (On Your Device)

The following data is stored in your browser using Chrome's chrome.storage.local and IndexedDB. It leaves your device only when you share it, or when a task you start sends it to one of the services in Section 2.5:

  • Workflows (node graphs, prompt text, settings)
  • Reference images and extracted video frames
  • AutoFlow Motion projects: your source video and its pieces, subject and place images, prompts, links to your results, and upload receipts
  • Queue configurations and run logs
  • Extension settings and preferences
  • Authentication tokens (used to stay signed in)

5.2 Data Stored on Our Servers

The following data is stored on our backend at api.auto-flow.studio, hosted on secured infrastructure:

  • Email address and hashed password
  • Plan type and subscription status
  • Daily and monthly usage counts (numeric values only)
  • AutoFlow Motion job records (job ID, fingerprint, date)
  • Community templates you choose to share (pending moderation before publication)
  • Review reward claim records

6. Data Sharing and Third Parties

We do not sell your data to any third party.

We share data only with the following parties:

  • Google (Sign-In): When you sign in with Google, your Google ID token is sent from Google to our server to verify your identity. We receive your email address from this token. No other Google data is accessed.
  • Whop (Payment processing): If you upgrade to Pro, payment is processed by Whop. Your email is shared with Whop to match the payment to your AutoFlow account. We do not handle credit card numbers or payment details directly.
  • AI and video services (in your browser): The extensions work with the services listed in Section 2.5 inside your own browser session, using your own signed-in accounts. When you run a task, the content it needs — your prompts and, in AutoFlow Motion, your video pieces and reference images — goes from your browser directly to those services, under their own terms and privacy policies. It can remain in your accounts there until you delete it with that service. No content is routed through our servers.
  • Railway (Server hosting): Our backend at api.auto-flow.studio, which holds the data in Section 5.2, is hosted on Railway.
  • Vercel (Website hosting): Our website at auto-flow.studio is hosted on Vercel, which may collect standard web analytics (page views, country-level geo). This does not apply to the extensions themselves.

Your data is not used or transferred for purposes unrelated to the extensions' core functionality, and is not used to determine creditworthiness or for lending purposes. Our use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. Data Retention

  • Local data is retained until you clear it manually, clear your browser data, or uninstall the extension. AutoFlow Motion projects can be deleted from the extension's project list; removing the extension deletes everything it stored in your browser.
  • Server-side account data is retained for as long as your account is active. Usage counts are aggregated daily and older daily records are automatically purged.
  • AutoFlow Motion job records are kept while your account is active, so that your daily allowance and retries work, and are deleted with your account.
  • Content you sent to Google Flow or an AI assistant stays in your account with that service until you delete it there.
  • Deleted accounts: Upon account deletion request, all personal data (email, usage records, Motion job records, shared templates) is permanently deleted from our servers within 30 days.

8. Your Rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data (e.g., update your email or password).
  • Delete your account and all associated data.
  • Export your locally stored workflows (AutoFlow Studio provides a Share/Export feature).
  • Control uploads by turning AutoFlow Motion's automated uploads off at any time.
  • Withdraw consent by uninstalling the extension at any time, which stops all data collection immediately.

To exercise any of these rights, email support@auto-flow.studio.

9. Security

We protect your data with the following measures:

  • Passwords are hashed server-side and never stored in plain text.
  • All communication between the extensions and our backend uses HTTPS (TLS encryption).
  • Authentication tokens are stored locally in Chrome's sandboxed extension storage, inaccessible to other extensions or websites.
  • The extensions do not load or execute any remotely fetched code.

10. Children's Privacy

Our extensions and website are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the extensions after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at: