Last updated September 2, 2026. Plain-language summary up top, full detail below.
RoundFlow is a small, independently-run tool — not a company with a data team. This page explains, as plainly as possible, what we collect, why, and what we do with it. If anything here is unclear, email robert.lebeda@gmail.com and ask.
This policy covers roundflow.cx and the RoundFlow app (together, "RoundFlow," "we," "us"). RoundFlow is operated by an individual, Robert Lebeda, not a company. If you're a student using RoundFlow through a school or a parent/educator account, see Section 7 for how that works.
When you create an account, we collect your name, email address, a password (which we store as a salted hash — we never store or can see your actual password), and your account type (Student, Educator, or Parent). We use a session cookie to keep you signed in; it's required for the account to work and isn't used to track you across other sites.
The content you create on the flow board — arguments, cards, links, colors, everything — is saved to your own browser's local storage. It is not uploaded to or stored on our servers by default. If you clear your browser data or switch devices, that content doesn't travel with you unless you use Copy/Import to move it yourself. Two features are the exception:
An Educator account can create a roster with an invite code; we store that roster's name and invite code, and which Student accounts have joined it.
If you upgrade to a paid plan, your payment is handled entirely by Stripe, our payment processor. We never receive or store your card number. We store a Stripe customer reference ID so we can manage your subscription status (active, trialing, canceled), and your subscription's billing email.
We use Google Search Console and Semrush to review aggregate site traffic and search-ranking performance. As of this writing, roundflow.cx does not embed a visitor-tracking script or advertising cookie of any kind — no Google Analytics, no ad pixels. If that changes in the future (for example, if we add on-site analytics or ads), this policy will be updated first, and you'll be able to tell because a new section will appear here describing exactly what's added and why.
We use exactly one cookie: an HttpOnly session cookie that keeps you signed in. It's strictly necessary for the account features to work and can't be used to track you elsewhere. We don't currently use any advertising, analytics, or third-party tracking cookies. (Free-tier Parent accounts may in the future see non-tracking, contextual ads — this feature is planned but not yet built or turned on; this policy will be updated before it goes live.)
We use the information above only to: run and maintain the service (authenticate you, save your account settings, remember your plan); process payments and manage subscriptions through Stripe; make the roster/Send-to-teacher features work as described; and send you service-related messages (for example, a password reset or a billing receipt from Stripe). We do not use your information for advertising, and we do not sell it.
We share information only with the vendors that make the service run, and only as much as each one needs:
We do not share your information with advertisers, data brokers, or anyone else for their own marketing purposes.
We keep your account information for as long as your account exists. If you want your account and associated data deleted, email robert.lebeda@gmail.com from the address on the account and we'll delete it, aside from what we're required to keep for billing/tax records if you were ever a paid subscriber.
RoundFlow's Student account type is often used by people under 18, sometimes as part of a class through an Educator's roster. We don't knowingly collect more information from a Student account than the account basics described above (name, email, password, roster membership, and any Preflow/submission content that account creates). Student and Educator accounts never see ads. If you're a school or educator setting up rosters for students under 13, you're responsible for confirming this fits your school's own policies and any consent your school requires — we're a small, independently-run tool, not a vetted education vendor, and this policy is not a substitute for your own school's review.
You can review and change your account name/email by contacting us, cancel a paid subscription at any time (it remains active through the end of the billing period you already paid for), export your flow content yourself at any time via Copy/Import or Download for offline, and request deletion of your account as described in Section 6.
Passwords are salted and hashed, never stored in plain text. The site is served over HTTPS. As with any online service, no method of storage or transmission is perfectly secure, but we don't store anything more sensitive than we need to run the features described above — notably, we never handle your card details ourselves.
If this policy changes in a way that affects what we collect or how we use it, we'll update the "last updated" date at the top of this page and, for a material change, make a reasonable effort to note it on the site.
Questions, requests, or concerns about privacy: robert.lebeda@gmail.com.
Not legal advice: this page is written in plain language to be genuinely useful, not as a substitute for a lawyer's review — particularly around student data handling in a school setting, where requirements vary by state and by school. If RoundFlow is adopted more widely by schools, a proper legal review of this policy (and of FERPA/COPPA-specific obligations) is worth doing before that happens.