Privacy Policy

Modulo Flow operates Modulo Flow and is responsible for the personal information described here. We are based in Australia and we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you have any question about your data, the contact address is at the bottom of this page.

This policy covers all three places you can meet us: the website at moduloflow.com, the app at app.moduloflow.com, and the desktop app.

• Account details: your email address, your name if you give one, and, where you sign in with Apple or Microsoft, the basic profile they return. If you set a password we store only a scrypt hash of it, never the password itself.
• Waitlist details: if you join the pre-launch waitlist, your email address and which part of the site you joined from. That is the whole record. While Modulo Flow is in testing, the list is also the enrolment list: we check it when someone tries to create an account, so joining is what gives you access rather than only a place in a queue.
• Onboarding details: whether you are at school or university, and the university, degree, and learning-management system you tell us during setup, so the app can match your institution. You can skip these.
• Your coursework: the outlines, timetables, notes, files, assessments, and questions you put into the app.
• Usage and AI metering: enough to run the service and keep it fair: sign-in events, and a per-account count of AI requests and their cost.
• Technical data: your IP address and the ordinary details of a web request, such as the page asked for, the browser it came from, and the time. They are used to serve the page, to count requests against a rate limit, and to shut down abuse.

We do not run third-party analytics, session recording, or advertising trackers. There is no ad pixel on this site. We keep our own anonymous count of visits to the marketing pages: the page, the site that linked here, whether the device was a phone or a desktop, and a hash that cannot be turned back into you and changes every day. That record stores no IP address, no user agent and no cookie, and nothing is written at all if your browser sends Do Not Track. The app itself (on your Mac, or at app.moduloflow.com) sends no analytics and no crash reports.

Your IP address is briefly stored in one place, and it is worth being exact about it: the counter that limits how often something can arrive from one connection. That covers sign-in emails, waitlist joins and code attempts, and it also covers simply loading a marketing page, because the same counter is what stops one source flooding the visit count. Those counting rows are cleared within a day, they are never joined to your account or to the visit counts above, and the address is used for nothing else. The anonymous visit record described above is separate and still holds no address.

• to run the service: build your plan, track assessments, and answer your questions;
• to keep it working and fair, including rate-limiting AI use per account;
• to secure accounts, and to detect and prevent abuse;
• to contact you about the service, including while it is in testing;
• to send you updates about Modulo Flow, if you joined the waitlist.

We do not sell your personal information, we do not hand it to anyone for their own marketing, and we do not use your content to train AI models.

Joining the waitlist is optional and takes one field. When you join we send one welcome email to that address, and after that we email it updates about Modulo Flow: when you can get the app, when sign-ups open, and changes worth knowing about. We keep those occasional and we do not send a newsletter. We do not pass the list to anyone, and it sits in the same Australian database as everything else.

Every one of those emails has a link that takes you off the list, and you can also ask us at any time by emailing the address at the bottom of this page. Either way deletes the row rather than flagging it. Service messages are a different thing: while you have an account we will still send what the account needs, such as sign-in links, codes, and security notices.

Two features can read your own course material: building recall cards from your notes, and answering questions using your files. Both are off by default and turn on only with your explicit consent, which you can withdraw at any time. Withdrawing it deletes the index built from your files rather than merely hiding it, and the app shows you exactly what has been read.

We use cookies only where the site cannot do its job without them. There are no advertising cookies here, no third-party analytics cookies, and nothing that follows you to another site.

• Signing in: a session cookie that keeps you signed in, and a token cookie that stops another site submitting forms as you. Both are ours, set on our own domain. The session cookie is deliberately host-only, so no other subdomain can read it.
• Signing in with Apple or Microsoft: short-lived cookies that carry the sign-in safely between us and them, discarded once you land back.
• On your device, but not a cookie: the app keeps your preferences in your browser’s local storage, such as the theme, which panels are open, and how wide you dragged one. Those stay on the device and are never sent to us.
• Counting a visit once: the marketing pages keep a random id in session storage so one visit is not counted twice. It is tied to nothing, it disappears when you close the tab, and it is not created at all when your browser sends Do Not Track.

You can block or clear cookies and site data in your browser settings. Blocking the sign-in cookies means you cannot stay signed in. Blocking the rest costs you a remembered theme, and nothing else.

Your account and your coursework are stored in Sydney, Australia, on a managed Postgres database, and the servers that run the app run in the same region. Each account is isolated at the database level, not only by application code, so a request for your data cannot return anyone else’s.

The desktop app also keeps its own copy on your own machine, along with any files it mirrors into the folder you chose. Those are yours, and deleting your account does not touch them.

There is one exception to “stored in Australia”, and it is the AI: a question you ask has to be sent to a model to be answered, and the models are overseas. The next section says which ones and where.

We use a small number of providers to run the service. Each processes data only to provide its part of it, under its own terms and security obligations. Some are outside Australia, so using the AI features means part of what you typed is disclosed overseas. Australian Privacy Principle 8 asks us to say so plainly, so:

• Anthropic (United States): the main AI provider, behind tutoring answers, exam and diagram generation, and reading a course outline. The relevant parts of what you ask, which can include text or files you attach, are sent there to produce an answer. Under Anthropic’s commercial terms, what we send is not used to train their models.
• DeepSeek (China): a second AI provider that serves the cheaper, high-volume work: building flashcards and practice material from your notes, and the planning assistant that reads your own task list to answer questions about your schedule. The text of those requests is processed on DeepSeek’s servers.
• Hosting and database (Sydney): our application host and our managed Postgres database both run in the Sydney region. Both companies are United States businesses, so their own staff and systems can reach the infrastructure from there.
• Email (United States): our email provider sends sign-in links, codes, and service messages, and so receives the address each message goes to.
• Sign-in providers: Apple and Microsoft, if you choose one of them. They tell us the sign-in succeeded and return a basic profile. Your password with them is never seen by us.

On the desktop app, connecting your learning-management system (Blackboard or Canvas) keeps that session encrypted on your own machine. Your LMS username and password are never seen, sent, or stored by us.

We do not sell your personal information and we do not disclose it to anyone for their own marketing. Where a provider is overseas, we take the steps reasonably open to a service of our size to have it handled consistently with the Australian Privacy Principles, but you should know that the protections of Australian law do not always follow data out of the country.

• Your account and its contents: while the account exists. You can delete it yourself, at any time, from Settings in the app or on the website; it asks you to type your email and then removes the account and everything in it in one step, including sign-in tokens and AI usage records.
• Waitlist entries: until you leave the list, using the link in any of our emails or by asking us. While Modulo Flow is in testing, being on the list is also what lets you create an account, so your entry is kept while you have one. Deleting your account takes your waitlist entry with it.
• Marketing page counts: kept as history, with nothing in a row that identifies you and a daily hash that cannot be linked from one day to the next.
• Rate-limit counters: cleared within a day.
• Flux conversations: 30 days after you last opened one, unless you pin it. Pinned chats are kept until you delete them. Opening a conversation counts as using it, so a chat you keep coming back to is not swept while you are still reading it.
• AI usage records: the metering rows behind your weekly allowance (which model, how many tokens, what it cost) are kept while the account exists and go when it is deleted. They hold no part of what you asked or what the model answered.
• Text extracted from a course outline: up to 90 days, keyed by a fingerprint of the document rather than by you, so a second student uploading the same official course profile does not pay to have it read again. It is not linked to your account and is not removed by deleting yours, because there is nothing in it that says it was yours.
• Sign-in emails and codes: the send counters for a week, the codes themselves for a day.
• Files the desktop app mirrored to your computer: they stay where you put them, because they are yours.

We keep nothing that identifies you after a deletion, except what a legal obligation requires and the outline text described above, which was never attached to you.

You can access, correct, export, or delete your data, and withdraw any consent you have given. Most of it you can do yourself in Settings; for the rest, email us. We will answer within 30 days and we will not charge you for asking.

You can also decline to give us information, or ask to deal with us without identifying yourself, though an account needs an email address to exist at all and we cannot run one without it.

If you think we have handled your information badly, tell us first at the address below. If our answer does not satisfy you, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, which costs nothing.

We protect your data with per-account isolation enforced by the database itself, encrypted connections, hashed passwords, rate limits on the public forms, and access controls. No system is perfectly secure, but we design for the assumption that a bug above the database must not be able to expose another account’s data.

If a breach happens that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

The service is intended for secondary and tertiary students. If you are under 18, you should use it with a parent or guardian’s permission. We do not knowingly collect data from children under the age at which consent is required in their country without that permission.

We may update this policy as the product changes; the “last updated” date above reflects the current version. If a change is significant, we will make a reasonable effort to tell you.

Questions about your privacy, or a request about your data? Email info@moduloflow.com.