Privacy Policy

Your book stays on your phone. Clients, visits, prices, tips, payouts, photos, notes: all of it lives in Bella Flow on your device and none of it is uploaded to us.

What we do hold on a server is small and specific: your account, and the reviews your clients leave.

Your clients’ names never reach us. The app is built so it cannot send them. The only exception is a first name a client types into her own review, about herself.

We do not sell anything to anyone. There are no ads, no trackers, and no analytics SDK in the app.

You, the beauty professional using the app.

Your client, who taps a review link you sent her. She never installs anything and never makes an account. What she gives us is described in its own section below, and it is short.

Everything that makes up your book:

• Clients you add, and the notes you write about them
• Visits, services, prices, tips, and payment methods
• Payout records, pay schedule, commission rate, and workplace mode
• Photos you attach to a payout or a client
• Goals and your app settings
• Appointments and your day closes

This is stored in the app’s own database on the device. We have no copy of it and no way to read it.

You can export all of it as a JSON file at any time from Settings, and you can clear it from Settings or by deleting the app.

iCloud

Bella Flow keeps a recovery copy of your records in your own iCloud, in a private app container. That is Apple’s storage under your Apple ID, governed by Apple’s terms, not ours. We cannot see inside it.

It exists so a lost or replaced phone does not mean a lost book. It is a recovery copy, not live sync across devices, and normal daily use works completely offline.

An account exists so your work comes back on a new phone. It holds:

About the Apple and Google identifiers. When you sign in with Apple or Google, we receive a stable ID that identifies you to Bella Flow only, plus your email address if the provider shares it. We never receive your password. We do not get access to your Apple or Google account, your contacts, your files, or anything else.

If you use Apple’s Hide My Email, we receive the relay address Apple gives us and never your real one.

When you tap “Ask for a review”, the app creates a review request and sends us:

• A one-time link token
• The service label, for example “Fill + Pedicure”
• The date of the visit
• Whether you shared the link by text, copy, or QR code

Not the client’s name. The app does not have a way to send it. That is enforced in the code, not left to a setting you might change by accident.

What your client gives us

On the review page, she can provide:

• A star rating, 1 to 5. Required.
• Written feedback, up to 500 characters. Optional.
• Compliment tags, stored as language-neutral keys rather than text. Optional.
• Her own first name. Optional, typed by her, about herself.

That last one is the only client name that ever reaches us, and she is the one who chooses to give it.

Review pages carry a noindex instruction, so search engines are told not to list them.

We use these companies to run the service. They process data on our instructions and nothing more.

Our marketing site at getbellaflow.com uses Vercel Analytics to count page visits in aggregate. No cookies, no fingerprinting, no profile of you.

The app itself contains no analytics, advertising, marketing, or tracking SDK. No Firebase, no Mixpanel, no Segment, no Meta Pixel, no Google Analytics.

• We do not sell your data. Not to anyone, not ever.
• We do not share it for advertising.
• We do not read your book. We cannot; it is not on our servers.
• We do not email you marketing because you signed up. Your address is for getting you back into your account.
• We do not use your data to train machine learning models.

Specifics, because “we take security seriously” means nothing:

• Sign-in codes are stored as a one-way hash, never as the code itself, and expire in 10 minutes.
• Device keys are stored as a one-way hash. The key itself is shown to your phone once and never again.
• IP addresses used for abuse limits are salted and hashed. Your IP is never stored in readable form.
• Email addresses used for abuse limits are salted and hashed the same way.
• Everything travels over HTTPS.

No system is perfect, and we will not pretend otherwise. This is what we actually do.

Your book: yours, on your phone. Clear it from Settings or delete the app. We never had a copy.

Your account and reviews: kept while your account exists, because that is what makes your work come back on a new phone.

To delete your account and everything attached to it, email bellaflow@alevyn.io from the address on the account. We will confirm and delete it.

Sign-in codes are deleted the moment they are used, and expire on their own regardless.

Bella Flow is for working beauty professionals and is not directed at children under 13. We do not knowingly collect data from them. If you believe a child has given us information, email us and we will remove it.

If this policy changes in a way that affects what we collect or how we use it, we will update this page and change the date at the top. Material changes get an in-app notice as well.

bellaflow@alevyn.io

Bella Flow is operated by Alevyn LLC.