Flow Privacy Policy

Effective date: April 1, 2026

This Privacy Policy explains how Flow uses information when you run visual sensor pipelines on your iPhone or iPad. Flow is designed as a local-first sensor routing tool. Most processing happens on-device, and any network traffic is created only by the workflows and destinations you configure.

Who We Are

Flow is published by Granu Lab. Our website is granulab.xyz. For privacy or support questions, contact info@granulab.xyz.

What Data Flow Uses

Camera, vision, motion, and AR data. If you enable relevant nodes, Flow can access camera frames, body pose, hand tracking, face landmarks, face tracking values, accelerometer, gyroscope, magnetometer, barometer, and ARKit tracking data. This information is processed on your device to generate the live values shown in your workflows.

Workflows and presets. Flow stores the workflows, destination presets, and configuration data you create so you can save, reload, and reuse them later.

Local network configuration. When you send data over OSC, UDP, or TCP, Flow uses the IP addresses, ports, and payload settings you configure. This information is used only to route data to the destinations you choose.

API request nodes. If you use Flow's API Request nodes, the app will send the request method, headers, body, and URL that you configure to the third-party endpoint you selected. Response data may be read, parsed, and displayed inside your workflow.

No accounts, ads, or analytics. Flow does not require a Granu Lab account and does not use ad networks or analytics SDKs.

Face Data and TrueDepth APIs

On supported devices, Flow may access Face Data generated by ARKit and the front-facing TrueDepth camera, such as face landmarks, face mesh data, facial coordinates, blend shape values, and face pose data, when you explicitly enable face-tracking features in a workflow.

Flow uses this Face Data only to provide the face-tracking, visualization, monitoring, and routing functions you intentionally activate inside the app.

Granu Lab does not use Face Data for identification, authentication, advertising, marketing, analytics-based profiling, or building user profiles, and does not sell or provide Face Data to data brokers, advertising platforms, or similar third parties.

By default, Face Data is processed on-device. If you deliberately configure a workflow that sends face-tracking values to another device or service over OSC, UDP, TCP, or another user-configured destination, that transfer occurs only because you enabled that behavior for that specific workflow.

How Data Is Processed and Stored

Sensor and vision data are processed on-device in real time. Granu Lab does not receive your live camera feed, motion data, AR session data, or node values just because you use the app.

Saved workflows, templates, and destination presets are stored locally on your device unless you explicitly export or share them using iOS sharing features.

Flow is intended to stream data directly to the devices and services you configure. If you send data to another computer, controller, or network service, that destination receives the data you choose to transmit.

Network Traffic and Third Parties

User-configured destinations. OSC, UDP, and TCP traffic is sent directly from your device to the network destinations you configure. Granu Lab does not relay or proxy that traffic.

User-configured APIs. When you use API Request nodes, the third-party services you target will receive the request data, your IP address, and any headers or payload you choose to include. Their processing is governed by their own terms and privacy policies.

Apple system frameworks. Flow relies on Apple-provided frameworks such as Vision, ARKit, CoreMotion, and Network.framework to deliver app features on your device.

Data Retention and Deletion

Granu Lab does not maintain user accounts for Flow and does not store your Face Data, camera feed, motion values, or AR session data on Granu Lab servers just because you use the app.

Saved workflows, templates, and presets remain on your device until you delete them or remove the app.

If you intentionally transmit data from Flow to your own devices, servers, or third-party APIs, retention of that transmitted data is controlled by those destinations, not by Granu Lab.

Your Choices and Controls

You control whether Flow can access the camera, motion data, AR capabilities, or local network features through iOS permission prompts and Settings.

You also control exactly which devices, servers, and APIs receive data from your workflows. If you do not add a destination or API node, Flow does not transmit that data.

You can revoke consent by disabling the relevant workflow, removing the related nodes, or revoking camera or local network permissions in iOS Settings. If you want saved workflows removed, you can delete them inside the app or remove the app data from your device.

Children's Privacy

Flow is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the app.

Contact Us

For privacy questions or requests related to Flow, email info@granulab.xyz.