Privacy Policy

Overview

SymFlowBuilder ("we", "our", or "the Service") is a visual builder for Symfony Workflow configurations operated from https://symflowbuilder.com. This policy describes what data we handle and why. We do not sell your data and we collect only what is needed to provide the Service.

Data we collect

• Account data. When you sign in with GitHub or Google via Auth.js, we receive your name, email, avatar URL, and provider account ID. This is the minimum required to create and identify your account.
• Workflow content. Workflows you create or import (places, transitions, metadata, names, descriptions, share settings, and collaborator assignments) are stored in our PostgreSQL database against your account.
• Guest drafts. If you use the editor without signing in, your draft is saved only to your browser's localStorage. It never leaves your device until you sign in and choose to migrate it.
• Session cookies. Auth.js sets a secure, HTTP-only session cookie to keep you signed in. We do not use third-party tracking or advertising cookies.
• Server logs. Our hosting infrastructure records standard request logs (IP address, user agent, timestamp, URL) for operational, security, and abuse-prevention purposes. These logs are rotated and not used for profiling.

How we use your data

• To authenticate you and keep you signed in.
• To save, version, share, and load the workflows you create.
• To enable collaboration features (inviting teammates, public share links, the Explore page for workflows you mark as public).
• To operate, secure, and improve the Service — including diagnosing bugs and preventing abuse.

We do not use your workflow content to train machine learning models, and we do not sell, rent, or share personal data with advertisers.

Public & shared content

When you generate a public share link or mark a workflow as public, its graph, metadata, and exported YAML become accessible to anyone with the link, and may appear on the Explore page and in iframe embeds. Do not place secrets, customer data, or sensitive business information in workflow names, descriptions, or guard expressions you intend to share publicly. You can revoke a share link at any time from the dashboard.

Sub-processors

• GitHub OAuth and Google OAuth — used only to authenticate you.
• Hosting provider — runs the application servers and PostgreSQL database that store your workflows.

We may add or change sub-processors as the Service evolves; material changes will be reflected on this page.

Data retention

We retain your account and workflows for as long as your account is active. You can delete individual workflows from the dashboard at any time. To delete your account and associated data, contact us at the address below — deletion is irreversible. Server logs are retained for a limited period for security and operational purposes, then purged on rotation.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to certain uses of it. To exercise these rights, email us at thovandeth@gmail.com. We will respond within a reasonable timeframe.

Children

SymFlowBuilder is a developer tool not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can remove it.

Self-hosting

SymFlowBuilder is open source under the MIT license and can be self-hosted. This policy applies only to the hosted Service at symflowbuilder.com. Self-hosted deployments are operated entirely by you and are not covered here.

Changes to this policy

We may update this Privacy Policy as the Service evolves. The "Last updated" date at the top of this page reflects the latest revision. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

Contact

Questions about this policy or your data? Email thovandeth@gmail.com or open an issue at github.com/vandetho/symflowbuilder. See also our Terms of Use.