Flowlex Privacy Policy

Effective date: June 24, 2026 Last updated: June 24, 2026

1. Introduction and who we are

This Privacy Policy explains how the company behind flowlex.com ("Flowlex", "we", "us", or "our") collects, uses, shares, and protects information in connection with the Flowlex mobile application and related services (collectively, the "App" or "Service").

If you have any questions about this policy or your data, you can reach us at privacy@flowlex.com.

This policy applies to your use of the Flowlex mobile app and the Flowlex backend services available through flowlex.com. It does not apply to third-party services, wallets, blockchains, or websites that you access through or alongside Flowlex, each of which is governed by its own terms and privacy practices (we identify the key third parties in Section 6).

By using Flowlex, you acknowledge that you have read and understood this Privacy Policy.

2. Flowlex is non-custodial

Flowlex is a non-custodial application. We never have access to your private keys, recovery phrases, or funds, and we cannot move, freeze, or reverse your funds or transactions.

Flowlex helps you create and manage Uniswap V3 liquidity-provider ("LP") positions on the Base blockchain — including auto-rebalancing "Auto Vault" positions, cross-chain bridging of assets, fee claiming, and referrals. Every blockchain transaction is constructed by our backend as an unsigned request and then signed by your own wallet on your device. Our backend prepares transaction data and pricing information; it cannot execute any transaction on your behalf without your wallet's signature.

Because of this design, you are in control of your own assets at all times. You are responsible for safeguarding access to your wallet and, where applicable, for exporting and securing your wallet keys (see Sections 2 and 12 regarding embedded wallets managed by Privy).

3. Information we collect

We collect only the information needed to operate a non-custodial DeFi application. We organize it below by how we obtain it.

3.1 Information you provide to us

Authentication identifiers. When you sign in, you provide an authentication method through our authentication provider, Privy (see Section 6). Depending on the method you choose, this is your email address, your Google account identity, your Apple account identity, or a connected external wallet (e.g., MetaMask, Rabby, Coinbase Wallet, or any wallet connected through WalletConnect / Reown).
Telegram details (optional). If you choose to receive alerts via Telegram, you provide your Telegram username and chat ID so we can deliver notifications to you on Telegram. This is entirely optional and only collected if you link Telegram.
Settings and preferences. Notification preferences, app settings, and similar choices you make in the App.

3.2 Information collected automatically

Wallet addresses. Your signer (externally owned account / EOA) address and your Safe smart-account address. For email, Google, and Apple sign-ins, Flowlex provisions (through Privy) an embedded wallet and an associated Safe smart account (an account-abstraction wallet). For external-wallet sign-ins, we record the address of the wallet you connect and its associated Safe smart account.
Push notification token. A device push token used to deliver push notifications through Expo / EAS (see Section 6). You can disable push notifications at any time in your device or app settings.
Device identifier. A device identifier derived from the operating-system build (the "osBuildId"), used to associate notifications and sessions with your device.
Minimal usage and diagnostic data. Basic operational and error information needed to keep the App functioning and secure. We do not use any third-party advertising, analytics, or tracking SDKs, and we do not track you across other apps or websites (see Section 6).

3.3 Information from third parties

From Privy: your verified authentication identity (email, or your Google/Apple identifier) and wallet address information, returned to us when you sign in.
From wallet-connection and bridging providers (Reown / WalletConnect and Relay): your wallet address and connection or transaction/intent metadata generated when you connect a wallet or bridge assets across chains.

3.4 On-chain public data

When you use Flowlex to create LP positions, claim fees, bridge assets, rebalance, or interact with smart contracts, those actions are recorded on public blockchains (Base, Ethereum, and other supported chains). Flowlex's backend indexes this public on-chain data so it can show you your positions, transactions, and Auto Vault state. This indexed data includes:

Your LP positions and Auto Vault state;
Your transactions and transaction hashes;
Referral relationships and referral earnings associated with your address.

On-chain data is public and permanent by nature. It is visible to anyone, is not controlled by Flowlex, and cannot be deleted from the blockchain by us or by you (see Sections 9 and 10).

3.5 Biometrics (on-device only)

You may choose to use Face ID or another device biometric to unlock the App. Biometric authentication is handled entirely by your device's operating system (iOS). Biometric data never leaves your device and is never collected, transmitted to, or stored by Flowlex.

4. How we use your information

We use the information described above to:

Provide and operate the Service — authenticate you, provision and connect your wallet and smart account, build unsigned transactions for you to sign, display your positions and balances, enable bridging, fee claiming, and Auto Vault auto-rebalancing.
Send notifications — deliver push, in-app, and (if you opt in) Telegram alerts about your positions, such as out-of-range warnings, rebalance events, and other activity you have asked to be informed about.
Operate the referral program — track referral relationships and calculate referral earnings.
Maintain security and prevent abuse — protect against fraud, abuse, and unauthorized access, and ensure the integrity of the Service.
Comply with legal obligations — meet applicable legal, regulatory, and law-enforcement requirements where required.
Improve and maintain the App — diagnose errors and keep the Service reliable, using minimal operational data.

We do not sell your personal information, and we do not use it for third-party advertising or cross-app tracking.

5. Legal bases for processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, we rely on the following legal bases:

Performance of a contract — to provide the Service you request (authentication, wallet provisioning, building transactions, displaying your positions, referrals).
Consent — for optional features you opt into, such as push notifications and Telegram alerts. You may withdraw consent at any time.
Legitimate interests — to secure the Service, prevent fraud and abuse, and maintain and improve the App, balanced against your rights.
Legal obligation — where we must process data to comply with applicable law.

6. How we share information (third parties and sub-processors)

We share information only as needed to operate the Service. We do not sell personal information. The key third parties that receive or process data are:

Privy — authentication and embedded-wallet provisioning. Receives your email or OAuth (Google/Apple) identity and your wallet addresses; for embedded-wallet users, Privy manages the wallet signer. See privy.io and Privy's privacy policy.
Pimlico — account-abstraction bundler/paymaster that sponsors gas for your transactions. Receives your smart-account address and userOperation (transaction) data. See pimlico.io.
Reown / WalletConnect — connection of external wallets. Receives your wallet address and connection metadata. See reown.com and walletconnect.com.
Relay — cross-chain bridging provider. Receives addresses and transaction/intent data when you bridge assets between chains. See relay.link.
Expo / EAS (expo-notifications) — push notification delivery. Receives a device push token. See expo.dev.
Telegram (optional) — if you link Telegram, we send your alerts through Telegram using your username and chat ID. See telegram.org.

In addition:

Public blockchains (Base, Ethereum, and other supported chains). All on-chain activity — wallet addresses and transactions — is publicly visible and permanent, and is not controlled by Flowlex. Anyone can view this data. This is an inherent property of public blockchains, not a disclosure choice we make.
Flowlex backend (flowlex.com/api). Our own backend stores the data described in Section 3 in order to operate the Service.

We may also disclose information where required to comply with law, respond to lawful requests from public authorities, enforce our terms, or protect the rights, safety, and security of Flowlex, our users, or others. If we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this policy.

7. International data transfers

Flowlex and its third-party providers may process and store information in countries other than the one in which you live. Data-protection laws in those countries may differ from those in your jurisdiction. Where we transfer personal data internationally, we take steps to ensure an appropriate level of protection in accordance with applicable law (for example, through recognized transfer mechanisms such as standard contractual clauses, where required).

8. Data retention

We retain personal data only for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. When data is no longer needed for these purposes, we delete or anonymize it.

If you delete your account (see Section 10), we purge your Flowlex backend data, subject to limited retention where required by law. Your Privy sign-in and (for embedded wallets) your wallet are not deleted, so you keep access to your on-chain assets.

On-chain data is permanent and cannot be deleted — see Sections 3.4, 9, and 10.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — ask us to correct inaccurate or incomplete data.
Deletion — ask us to delete your data (see Section 10).
Portability — request your data in a portable, machine-readable format.
Objection / restriction — object to or restrict certain processing, including processing based on legitimate interests.
Withdraw consent — withdraw consent for processing that relies on consent (such as notifications), without affecting prior processing.

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

To exercise any of these rights, use the in-app deletion option (Section 10) or contact us at privacy@flowlex.com. We may need to verify your identity before acting on a request. You also have the right to lodge a complaint with your local data-protection authority.

Important blockchain limitation: these rights apply to data held in the Flowlex backend and with our providers. They cannot be applied to data already recorded on public blockchains, which is permanent and outside our control.

10. Account and data deletion

You can delete your Flowlex account and associated data directly in the App.

In-app: go to Settings → Delete account. This is the quickest way to remove your data.
By email: you can also request deletion by emailing privacy@flowlex.com.

What deletion does:

It purges your Flowlex backend data — including your stored email, wallet addresses, push token, device identifier, indexed position/transaction records held for your account, referral records, notification records and settings, and any Telegram link.
It does not delete your Privy sign-in or your embedded wallet. Your wallet and any on-chain assets remain accessible — deleting your Flowlex account only removes the off-chain data above.

What deletion cannot do — the on-chain caveat:

Data that has already been recorded on a public blockchain — including your wallet addresses and your past transactions — is public and permanent by design and cannot be deleted from the blockchain by Flowlex or by anyone.

11. Children's privacy

Flowlex is not directed to anyone under 18 years of age (or the age of majority in your jurisdiction, if higher). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@flowlex.com and we will take steps to delete it.

12. Security

We use technical and organizational measures designed to protect your information, including secure storage and transport of data and on-device secure storage for sensitive values. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Because Flowlex is non-custodial, certain security responsibilities rest with you and with our providers:

For embedded wallets (email/Google/Apple sign-in), the custody and management of the wallet signer is handled by Privy, under Privy's own security practices and policies. You are responsible for safeguarding access to your account and for exporting and securing your wallet keys if you wish to retain control of the wallet independently of Flowlex.
For external wallets, you are responsible for the security of your wallet and its keys, which are managed entirely by your wallet provider — Flowlex never has access to them.

Keep your authentication credentials and device secure. If you believe your account has been compromised, contact us at privacy@flowlex.com.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice within the App or by other means. Your continued use of Flowlex after an update means you accept the revised policy.

14. Contact us

If you have questions, requests, or complaints about this Privacy Policy or your data, contact us at:

Email: privacy@flowlex.com
Website: https://flowlex.com