Privacy Policy
Last updated 11 November 2026.
Data controller and contact
Flowdiction is operated by Nasredine Habes, the data controller responsible for personal data Flowdiction collects directly: accounts, contact messages, newsletter subscriptions, comments, favorites and our own visit log. Google acts independently for the advertising and analytics cookies and associated data it processes under its own terms; this does not remove Flowdiction’s responsibilities for its implementation and directly collected data. Send privacy questions and rights requests to info@flowdiction.com or contact us on WhatsApp. Only send information needed for your request; do not include passwords.
What we actually collect
Accounts: email address, account identifier and profile information you provide. Contact forms: name, email, message and subject, plus WhatsApp, LinkedIn or contact-channel details if supplied. Newsletter: email, subscription source, language, confirmation and subscription timestamps; the subscriber record is created after email confirmation. Comments: account identifier, author name, comment text, article and time. Favorites: account identifier and saved article references. We also store our own visit log: page path and title, referrer, browser-session identifier, language, traffic source and campaign parameters, and visit time. This log is separate from Google Analytics and can be recorded without an advertising-consent choice. Browser-session identifiers and analytics identifiers can be personal data even without a name.
Domain tools and submitted URLs
Some naming calculations run locally. Live availability checks send domain names to Cloudflare DNS and Google Public DNS. Domain and SEO features may send submitted domains or keywords to Semrush, WhoisFreaks or Wikidata, depending on the tool. SEO audits fetch the submitted public URL and follow its redirects. Domain-image lookups may send the domain to Clearbit, Icon Horse, Google favicon services or the domain’s own website, with UI Avatars as a fallback. Do not submit URLs containing private tokens or confidential information.
Service providers and third parties
The browser scripts include Google Analytics and Google AdSense. Google Tag Manager is optional in the code and is not configured in the current environment; GA4 does not depend on it. Lovable provides hosting, Lovable Cloud database/authentication and managed transactional email. Data services used by the relevant tools include Semrush, WhoisFreaks, Cloudflare DNS, Google Public DNS, Wikidata, Clearbit, Icon Horse, Google favicon services and UI Avatars. Firecrawl retrieves public DNJournal sales data for market updates, rather than receiving a visitor’s search in that scheduled flow. Lovable AI handles editorial translation and cover-generation requests when those features are used. Clicking a Dynadot purchase link sends the selected domain to Dynadot; using WhatsApp sends your message to WhatsApp. These services have their own privacy terms. Not every provider receives data on every visit. We do not sell personal data.
Google Analytics and consent: current implementation
GA4 is loaded directly using Google’s gtag.js, not through GTM. We use basic Google Consent Mode: analytics and advertising signals start denied, and GA4 is not downloaded or sent events for visitors in the EEA, UK or Switzerland, or when location is unresolved, until Google’s message reports an explicit analytics-storage grant. Advertising consent alone is not analytics consent. The owner must enable analytics-purpose Consent Mode in AdSense Privacy & messaging and publish the Google message; if no analytics grant is available, GA4 stays blocked in those regions. Outside consent regions, ordinary analytics can run unless you refuse or enable Global Privacy Control. Earlier blocked events are not replayed. Downloads still wait for document load and browser idle time. Analytics may include visited URLs, referrer, browser/device information and cookie identifiers; aggregate reports do not make collection anonymous.
Advertising and withdrawing consent
Google AdSense and its partners may use cookies or device identifiers for ads, measurement and fraud prevention. The AdSense head script bootstraps Google’s privacy message when the owner has published it and Google makes it applicable. Visitors in the EEA, UK and Switzerland can use Cookie settings below or in the footer to reopen Google’s message when available and change or withdraw their choices. We use Google’s stored consent choice as the consent record, rather than a separate Flowdiction banner. Changing the analytics choice stops subsequent GA4 events; the app rechecks the Google choice before sending and observes changes in other open tabs. Opening Cookie settings alone does not change your choice. You may also use browser cookie controls, Google Ads Settings and Google’s Analytics opt-out tools. Withdrawing consent does not affect the lawfulness of earlier processing.
Local storage and essential session data
Saved comparisons use localStorage under flowdiction:comparison-history. Language, theme, installation dismissal and authentication sessions also use browser storage. The visit-session identifier fd_visit_session uses sessionStorage and normally lasts for the tab’s browser session (session restoration may preserve it). Persistent localStorage entries do not have a built-in expiry and remain until cleared, signed out or removed by the relevant feature. Clearing browser storage does not delete server-held comments, favorites, contact messages or visit logs.
Legal bases
Where GDPR applies, account management, requested services rely on performance of a contract or steps you request before a contract. Answering inquiries, keeping the service secure and proportionate operational records rely on legitimate interests, subject to your rights. Newsletter delivery and non-essential analytics/advertising cookies require consent where applicable. Google Analytics is blocked before the required analytics consent; this does not replace our obligations for other data processing.
Retention
No automatic expiry or scheduled deletion period is currently implemented for account-related records, contact messages, confirmed newsletter records, comments, favorites or our visit logs. They can remain stored until an applicable deletion action or request is handled; ending a browser session does not erase the server visit log. A fixed retention schedule for these records has not yet been established in this policy. Google Analytics property-level data retention and vendor log-retention settings have not been verified; cookie lifetime is not the same as server data retention. Contact us to request deletion; legal obligations may require some records to be retained.
Transfers outside Europe
Our providers may process data outside the EEA, the UK or Switzerland. Their actual hosting regions and transfer arrangements have not been verified here, so we do not claim that all data stays in Europe. Where required, international transfers need an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact info@flowdiction.com for information about the safeguards applicable to your data.
Your rights and complaints
Where applicable, you may request access, correction, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent. Email info@flowdiction.com; we may ask for proportionate verification of identity. You have the right to complain to a competent data-protection supervisory authority, especially in your country of residence, work or the alleged infringement; in France this is the CNIL. Local data can be cleared in your browser. Our service is not directed at children under 13, and we do not knowingly collect their information.
Main cookies and browser storage
These are Google’s documented defaults and our implemented storage lifetimes, not a guarantee that every cookie is present. Google can change cookies, and consent, browser restrictions and vendor settings affect what is set. Actual third-party expiries must be checked in the browser; provider-side retention settings are not verified.
| Name / provider | Purpose | Lifetime |
|---|---|---|
| _ga · Google Analytics | Distinguishes browsers/visitors | 2 years by default; can be renewed on activity |
| _ga_50ZNCEDPLB · Google Analytics | Maintains GA4 session state | 2 years by default; vendor settings can change it |
| IDE / id, __gads / __gpi · Google advertising | Advertising identifiers, delivery and measurement, when set | Provider-controlled and variable; actual expiry not verified for this site |
| Google consent-message storage | Remembers choices in Google’s applicable message | Provider-controlled; names and expiry not verified |
| fd_visit_session · Flowdiction (sessionStorage) | Groups our own page-visit records for a browser session | Tab/session lifetime; not the server-log retention period |
| Flowdiction preferences, saved comparisons and auth (localStorage) | Language, theme, saved tools and sign-in | No automatic expiry for preferences; auth session validity is separately managed |