Privacy Policy
Effective October 25, 2026
- We collect what the app needs: your account details and your writing, with its edit history.
- No ads, no selling data, no tracking cookies. One session cookie keeps you signed in.
- No generative AI. Your writing is never sent to an AI provider.
- You decide what is shared. Delete your account any time in Settings.
1. Who we are
Buflowski is run by Jon Pivko, Waldwick, New Jersey, USA. Contact: [email protected].
2. What we collect
- Account: your name, email, username, and a hash of your password (we never store the password itself). Optional profile details you add.
- Your writing: projects, documents and notes, stored in the cloud (Cloudflare D1).
- Edit history: a keystroke-level record of edits and timings made in the Buflowski editor. It is used to build your authorship proof and playback. It does not record anything you do outside Buflowski.
- Writing stats: daily word counts (typed, pasted, deleted) and time spent writing, used for goals, streaks and your stats.
- Technical data: your IP address is used briefly for security, such as limiting sign-up and sign-in attempts. Our host keeps standard server logs.
3. How we use it
Only to run Buflowski: to sign you in, save and sync your writing, show your stats, build your proof and playback, and keep the service safe. No ads, no profiling, and we never sell or rent your data.
4. Who can see your writing
- You, always.
- Co-writers see only the projects you share with them.
- Friends see only your weekly typed-word total, never titles or text. You can turn this off in Settings.
- Anyone with a link: replay links (
/r/…) and proof links (/p/…) you create are public to anyone who has the link. They are kept out of search engines. - Us: we don't read your writing, except when needed to keep the service running, to investigate abuse, or when the law requires it.
5. Helpers and AI
Helpers are built-in rules and word lists. There is no generative AI, and your writing is not sent to any AI provider.
6. Fernfolk link (optional)
If you link a Fernfolk account, Buflowski sends it your word counts, goal and streak only, never titles or text. The token you paste is stored on our server, never shown back to your browser, and deleted when you disconnect.
7. Cookies
One session cookie keeps you signed in. No tracking or advertising cookies, no third-party analytics. The app also stores its own files on your device so it loads quickly and works offline.
8. Where data lives
Buflowski is hosted on Cloudflare (hosting, database, and the domain), which processes data on our behalf. Data may be processed in the United States and other countries where Cloudflare operates.
9. Keeping and deleting
We keep your data while your account exists. You can export your work any time, and delete your account in Settings (Account > Delete my account), which removes your account and writing. You can also email us to ask for deletion or a copy of your data.
10. Security
Passwords are hashed, connections use HTTPS, and access is limited. No system is perfectly secure, so please use a strong, unique password.
11. Children
Buflowski is not for children under 13. If you believe a child under 13 has an account, contact us and we will delete it.
12. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data. Most of this you can do in the app; for anything else, email us.
13. Changes
If we change this policy in a meaningful way we will say so in the app and update the date above.