Privacy Policy.

FLOW Commons (“FLOW”, “we”, “us”) operates at flowcommons.xyz, a research commons for private markets. This policy describes what information we collect, how we use it, and the choices you have.

By using FLOW, you agree to the practices described here. If you do not agree, you should not use the platform.

Account information. When you create an account, we collect your email address. Your email is used for authentication and essential account-related communications. It is never displayed publicly.

Researcher profile. You may create a public researcher profile with a username, display name, bio, and avatar. This information is visible to all visitors.

Content you publish. Investigations, contributions, theses, research events, and bounty submissions you post are stored in our database and displayed publicly. Each contribution is stamped with the company’s market valuation at the time of posting, as provided by PreStocks.

Usage data. We log standard technical information such as browser type, IP address, and timestamps for security, abuse prevention, and analytics purposes.

We use your information to:

• Authenticate your account and maintain sessions
• Display your public researcher profile and published content
• Stamp contributions with market data from PreStocks at the time of posting
• Prevent abuse, manipulation, and unauthorized access
• Improve the platform and understand how it is used

We do not sell your personal information. We do not use your data to train external machine learning models.

Your data is stored in a Supabase-hosted PostgreSQL database. Authentication, profile data, and all published content reside there. Avatar images are stored in Supabase project storage.

Market valuation data displayed alongside your contributions is fetched from the PreStocks edge function and recorded at the time of posting. This data point becomes part of the permanent research record.

FLOW uses local storage and cookies to maintain your authenticated session. We do not use third-party advertising cookies or cross-site tracking pixels.

If you clear your browser storage, you will be signed out and will need to authenticate again.

Most content you publish on FLOW — investigations, contributions, theses, research events, and your researcher profile — is publicly visible. Anyone can read it without an account. Your email address is never shown publicly.

Bounty submissions are visible only to the bounty creator and the submitting researcher.

When a thesis is timestamped on the Solana blockchain, that timestamp and the thesis content hash become part of an immutable public ledger. This record is independent of FLOW and cannot be deleted by us or by you.

You can update your researcher profile (display name, bio, avatar) at any time from your settings page. You can sign out at any time, which clears your local session.

To request deletion of your account and associated content, contact us at hello@flowcommons.xyz. We will process your request within 30 days, subject to the permanent nature of onchain timestamps and the research record’s integrity.

FLOW integrates with the following third-party services:

• Supabase — database, authentication, and file storage
• PreStocks — market data for private company valuations
• Solana — onchain timestamping for theses

Each service has its own privacy policy. FLOW is not responsible for how third-party services handle your data once it reaches their systems.

Your published content remains on FLOW indefinitely as part of the research commons. Usage logs are retained for up to 90 days for security and analytics purposes, then automatically purged.

We enforce row-level security on all database tables, restrict writes to authenticated users, and validate all user input server-side. Avatar uploads are restricted to our project storage. Despite these measures, no system is perfectly secure, and we cannot guarantee absolute protection.

We may update this privacy policy as the platform evolves. We will update the date at the top of this page whenever changes are made. Continued use of FLOW after changes take effect constitutes acceptance of the updated policy.

Questions about this privacy policy? Email hello@flowcommons.xyz.