What we collect
When you order, the order form asks for:
- your name, phone number and delivery address;
- your email address — unless you tell us you have none;
- how you will pay: bank transfer or cash on delivery;
- any special requests you write.
Your order also records the design you made in the studio: the place, your settings, and — for a run or a journey — the route. A GPX file you upload is kept with your order and used only to make your piece.
When you write to us from a journal post, we receive your name, your email, your phone number if you give it, and your message.
When you pay by bank transfer, the transfer shows us the sender’s name and the transfer note, as every transfer does.
Why
To make your piece, deliver it, and contact you about it. To send your order confirmation. To answer your message. Nothing else: no newsletters, no advertising, no profiles.
Who handles it
A few services run this shop for us. Each one receives only what its job needs:
- Supabase — our database and file storage. Your order, your message and any GPX file you upload are kept there.
- Vercel — hosts this website. Its Web Analytics counts page visits without cookies and without identifying you.
- Resend — sends the emails about your order or your message, so it handles your email address and what those emails say.
- Sentry — receives a report when something on this site breaks. Before a report leaves the site, what you sent in the request, your cookies and the query part of web addresses are removed from it, and email addresses and phone numbers are blanked out.
- GitHub — keeps an encrypted weekly backup of the orders for 90 days. Only we hold the key.
- The delivery service — receives your name, phone number and address, to bring you the parcel.
Maps, place names, routes and elevations come from public map services built on OpenStreetMap and open elevation data. When you search for a place, draw an area or plan a route, the place names and map positions go to them — never your name or contact details. In the studio, your browser also loads typefaces from Google Fonts and asks OpenStreetMap for the name of the place on your map.
Videos in the journal play from YouTube’s privacy-enhanced player, and only after you press play.
What we never collect
- Card or bank account numbers: nothing on this site takes a payment.
- Identity card numbers, dates of birth, or anything you did not type into a form.
- Your location from your device — unless you press “Use my location as the start” while planning a journey. Your browser asks you first, and the position is used only as the start of your route.
- Advertising or tracking cookies. This site sets no cookies for visitors at all. Your language and your studio settings stay in your own browser.
The view counter and the request limits
Neither stores personal data.
Journal posts show how often they have been read. To count each reader once a day, the site mixes the visit’s network address and browser type with a code that changes every day, and keeps only the scrambled result — never the address itself. It cannot be traced back to you, and the next day it no longer matches anything.
To protect the forms and the map tools from abuse, the site counts requests from each visitor for an hour or a day. It keeps a scrambled code in place of the network address — never the address itself — and deletes each count when its hour or day is over.
How long we keep it
We keep your order and your messages for as long as we need them to make and deliver your piece, to help with anything that comes up afterwards, and to keep our own records. The encrypted backups are kept for 90 days.
A copy, a correction, or deletion
Write to contact@theflowworkshop.com from the email address on your order, or give us your order reference. We send you a copy of what we hold, correct it, or delete it. If we must keep part of an order — the record of a payment, for example — we tell you which part, and why.
Changes to this page
When this page changes, the date at the top changes with it.