1. Summary
BackToFlow does not require an account and contains no advertising or analytics SDK. It does not upload your original files, folders, URLs, or work-session history to a BackToFlow server.
Tasks, next actions, connections, and explicit work sessions stay on your Mac. BackToFlow does not operate a synchronization server.
2. Data stored on this Mac
BackToFlow stores the task names, notes, checklists, next actions, tags, Target Dates, libraries, categories, statuses, file locations, macOS security-scoped bookmarks, and user-started work-session records that you enter or select.
It does not copy or move originals. Exported backups may contain this information and an encrypted secure area, so keep them in a safe location.
Spotlight
Spotlight integration is off by default. If enabled, BackToFlow provides macOS with only the task name, kind, and tags for non-secure, non-deleted tasks. Notes, file paths, and work-time records are not indexed.
3. Apple services and permissions
- StoreKit may contact Apple to verify or restore an App Store purchase.
- Local reminders use macOS notification permission.
- User-selected file access uses macOS security-scoped bookmarks.
- Quick Look and Spotlight use the respective macOS system feature when enabled.
Apple's policies apply to Apple's processing.
4. Secure Area
Secure-area task metadata is encrypted with AES-GCM using a PBKDF2-derived key. The password is not stored and cannot be recovered. The Secure Area does not encrypt the original files themselves.
When a public task enters the Secure Area, earlier app-managed automatic, safety, and recovery backups are removed so they do not retain plaintext traces. Managed storage files are created with owner-only permissions.
5. Your control and deletion
You can delete tasks through BackToFlow or disable Deleted items for immediate permanent deletion. Deleting a task never deletes the original file. To remove all app data, quit BackToFlow and remove its Application Support folder.
Support diagnostics never contain task titles, notes, file paths, URLs, bookmarks, or secure-area data.
6. Changes and contact
If data practices change, this policy and its date will be updated. See the support page for the current public support channel.