Privacy Disclosure

Last updated: 2026-06-09

FlowTutor is a contextual coding tutor: it explains code as your AI tools generate it — in editors like Claude Code, Cursor and Windsurf via a local helper, and on claude.ai via the browser extension. This document describes exactly what data FlowTutor handles. It covers the free tier and the optional paid features (credits and "bring your own key").

What is sent off your device, and where to

• Code you choose to have explained. When a supported snippet (Python, JavaScript, TypeScript, JSX/TSX, SQL) is captured, its text is sent to the FlowTutor backend (https://flowtutor.co.uk) solely to generate the explanation cards. The backend forwards it to an LLM provider and returns the explanations. The code is used transiently and is not stored.
  • Local desktop mode: the FlowTutor bridge runs on your own machine (127.0.0.1). In its default local mode it calls the LLM provider directly and your code does not transit flowtutor.co.uk.
  • Bring Your Own Key (BYOK) mode: if you unlock BYOK and supply your own provider API key, the code is sent directly to your provider (https://api.anthropic.com or https://api.openai.com) and never to flowtutor.co.uk. Your key never leaves your device except to that provider.
• Your email address — only if you sign in, or if you join our launch list. Sign-in uses a one-time code (OTP) sent to your email via our authentication provider, Supabase (https://xpqvzecrazxhryhcbfka.supabase.co). A launch-list email submitted on flowtutor.co.uk is stored solely to notify you when FlowTutor ships. Your email is used to identify your account or notify you — never for third-party marketing.
• Your session token (a signed login token) is sent to flowtutor.co.uk on authenticated requests (/account, /billing/checkout) so the server knows it's you.
• An anonymous install ID. A random UUID generated on first run, stored locally. It is sent with explanation requests for free-tier rate limiting. On its own it is not linked to your identity; if you sign in, it is associated with your account so your balance follows you.
• Anonymous event counts. Aggregate counters only (e.g. "an annotation was requested", "a cached result was used") and the canonical concept id of an explanation plus the number of lines it covered — never the code itself, no URLs, no personal information.

Payments

Credit purchases ($5 = 100 credits) and the one-time BYOK unlock ($15) are processed by Stripe using Stripe's hosted Checkout page. Card details are entered on Stripe and never touch the FlowTutor backend. We store a record of the purchase and a credit ledger (tied to your account) for billing and audit. Stripe's handling of your payment data is governed by Stripe's own privacy policy.

What is NOT collected

• No card or payment details ever reach our servers — those stay with Stripe.
• No browsing history. The browser extension's content script runs only on https://claude.ai/*; the desktop helper only sees files in the project folder you point it at.
• Code is not stored. It is used transiently to produce explanations.
• Your BYOK key is never sent to FlowTutor's servers. It is stored only on your device and used only for direct calls to your chosen provider.
• We do not sell your data or use it for advertising.

Storage on your device

• chrome.storage.local (extension): the anonymous install ID, your signed-in session (if any), and your BYOK key + on/off flag (if you use BYOK).
• chrome.storage.session (extension): a short-lived cache of explanations (cleared when the browser session ends) so identical code blocks aren't re-sent.
• Desktop helper: a local bridge token, stored in your project/home directory, authenticating your machine to the local bridge.

Data retention and your rights

• Your account record (email) and credit ledger are retained while your account exists, so your balance and purchase history are available to you.
• You can request account deletion by contacting us (below). Deleting your account removes your account record and cascades to your installs, usage counters, ledger, and purchase records.
• Your BYOK key can be removed at any time from the sidebar ("Remove key"), which deletes it from local storage immediately.

Contact

Questions or deletion requests: hello@flowtutor.co.uk.

See also our Terms of Service.