Privacy notice

Last updated: 2026-10-22. This is the privacy notice for flowdonia.com, the private portfolio at design.flowdonia.com and flowdonia.studio, and Truing, the client app at app.flowdonia.com. Short version: flowdonia.com uses one functional cookie for your language preference, no tracking pixels, and no third-party analytics. Otherwise anonymous traffic data only, plus any email you choose to send. Truing keeps an account for each person who signs in and a record of what they enter, described in its own section below.

Data controller

Dylan Evans, natural person, based in Amsterdam, Netherlands. Contact: [email protected].

What is collected

• Anonymous traffic data via Cloudflare Analytics. Cookieless. Collects: page paths visited, referring URL, country (from IP), browser type, screen size. Does NOT collect: your IP address (Cloudflare anonymises it before storage), individual identifiers, cross-site tracking data.
• Aggregate scroll-depth counts across this site, via a first-party beacon to this site only. Counts how far down a page a visit scrolls, in four steps, by layout size, and how often the contact link is used. No cookies, no identifiers, nothing personal; stored as totals in Cloudflare.
• Inbound emails if you email [email protected]. Your message, sender address, and any attachments you choose to include are received via Proton Mail (Switzerland) and held in a personal inbox.
• Language-preference cookie: if you use the language switch (EN | NL), or your browser signals a Dutch language preference, the site stores one functional cookie (name: flow_lang, retention: 1 year, SameSite=Lax, Secure) to remember your choice. It holds no personal data and is not shared with third parties.

What is NOT collected

• No tracking cookies, no analytics cookies, no advertising cookies.
• No tracking pixels, web beacons, or fingerprinting.
• No third-party analytics (no Google Analytics, no Hotjar, no similar).
• No advertising identifiers.
• No contact form data (the site has no contact form).

Private portfolio access

The portfolio at design.flowdonia.com and flowdonia.studio is private and sits behind a Cloudflare Access login. To enter, you give an email address and receive a one-time code. This involves:

• The email address you enter, used to send the one-time code and to check it against the list of people allowed in.
• Access logs via Cloudflare Access: email address, IP address, timestamp, approximate country, and browser type for each sign-in attempt. The basis is legitimate interest in controlling access to confidential material and keeping a security record. These logs are retained for about 24 hours.
• Two strictly necessary cookies set by Cloudflare Access after sign-in (CF_AppSession and CF_Authorization). They keep you signed in for the session and are required to deliver the access you requested, so they need no consent. The portfolio uses no analytics or tracking cookies.

Truing

Truing at app.flowdonia.com is the app Flowdonia's clients use during an engagement. Only people Flowdonia has added for a client can sign in, through a Cloudflare Access login. This involves:

• The email address you enter, used to send the one-time code and to check it against the list of people allowed in.
• Access logs via Cloudflare Access: email address, IP address, timestamp, approximate country, and browser type for each sign-in attempt, retained for about 24 hours.
• Your account: your email address, your name if it is given, your company, and your role in the app.
• What you enter: the changes, answers and notes you add, and any measure values you post, are stored with your account and the time. Everyone in your company can see who added a change or a note. Answers by name are seen only by your company's owners and Flowdonia. You can also be named as the owner of a decision, a need or a measure.
• A four-week record for each person who submits changes: how many they submitted, how many have been read, and how many of those were read as strengthening the company's attributes, with a flag when five or more have been read and all of them strengthen. In Truing, your company's owners and Flowdonia can see other people's records. Members cannot see any, and nobody is shown their own.
• Scorecard answers are stored without your name or account.
• Two strictly necessary cookies set by Cloudflare Access (CF_AppSession and CF_Authorization), which keep you signed in.

Truing has no analytics and no tracking cookies, and the app itself writes no log of your visits.

How long data is retained

• Analytics: per Cloudflare's standard retention (currently 6 months for detailed data, indefinitely for aggregated counts).
• Emails: retained as long as the conversation is relevant. Old correspondence is periodically reviewed and deleted.
• Truing: account details and entries are kept while your company's engagement runs, and deleted when it ends. When your seat ends, your account is deleted within 90 days. If you ask, it is deleted promptly, without that wait. The entries you made stay in Truing under your company's name, with your name removed as their author. If your name appears in anything written there, ask and we will remove it. Deleted data can stay in Cloudflare's database backups for up to 7 days, and then it is gone. Beyond that, we keep data longer only where we must for a legal reason. This can include your account. When entries you made must be kept for a legal reason, including one that concerns a colleague, your account is kept with them until that reason ends, and deleted after that. This applies even if you have asked us to delete it.

Your rights under GDPR

You have the right to access, correct, delete, port, or object to processing of your personal data. To exercise any of these, email [email protected]. Requests are handled within 30 days.

If you believe your rights have been infringed, you may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Third-party processors

• Cloudflare (USA, with EU data presence) - hosting, anonymous analytics, Access (authentication and access logging for the private portfolio and Truing), and Truing's database. Cloudflare privacy policy.
• Proton Mail (Switzerland) - email handling. Proton privacy policy.

Changes to this notice

Material changes will be noted at the top of this page with the new "Last updated" date.