The short version. We collect your email address when you buy a license, and a random identifier for each machine you activate on. We do not collect your projects, your generated code, your files, or anything about what you build. The website has no analytics, no tracking, and sets no cookies.
1. Who is responsible
SMFlow LLC, an Indiana limited liability company, located in Dyer, Indiana, United States, is the data controller for the information described here. For any privacy question or request — including a request for our postal address — email privacy@smflow.co.
2. What we collect
2.1 When you buy a license
- Your email address — supplied at checkout. It is how your license key reaches you, how key recovery works, and how we reach you about your purchase.
- Your name, if Square supplies it with the payment.
- A payment reference from Square, used to match a payment to a license and to recognize a refund. This is an opaque identifier, not a card number.
We never see your card details. Payment is taken on Square’s hosted checkout page. Card numbers are not transmitted to, processed by, or stored on our servers at any point.Square handles that data as its own controller under its privacy policy.
2.2 When you activate the software
- Your license key, so we can confirm it is valid and count seats.
- An installation fingerprint — a salted hash of a random identifier that SMFlow generates locally the first time it runs.
The fingerprint is worth being precise about, because most licensing systems do this differently. It is not derived from your hardware: no MAC address, no CPU or disk serial, no Windows SID, no registry value, no hostname, no username. It is a random number generated on your machine and then hashed. It tells us that two activations came from the same installation, and nothing else — it cannot be reversed into anything that identifies you, your machine, or your organization.
2.3 When you use the website
The site is static and hosted on Cloudflare Pages. It runs no analytics, embeds no third-party trackers or advertising, and sets no cookies. Our hosting provider processes standard server request logs, including IP addresses, for security and abuse prevention.
One exception worth naming: the download page asks GitHub’s public API for the latest release directly from your browser, so that the download links always point at the current build. That request discloses your IP address to GitHub, as any request to GitHub would.
Pages that feature a video (such as the introduction on the home page) do not load anything from YouTube when the page opens — they show a still image hosted on this site, and set no cookies. Only if you click play do we then load the player from youtube-nocookie.com, which at that point sees your IP address, exactly as if you had followed a link to YouTube. Until you click, no request reaches Google or YouTube. Aside from these two user-initiated cases, no other third party is contacted by any page on this site.
3. What we deliberately do not collect
SMFlow contacts our servers only to activate or deactivate a license and to check for software updates. It does not transmit, and we do not receive:
- Your project files, flows, or graphs.
- The C++ source SMFlow generates, or any binary you compile.
- File names, folder paths, or anything about the contents of your work.
- Usage telemetry, feature analytics, crash dumps, or session recording.
After activation the software is fully functional with no internet connection at all, which is a requirement for the air-gapped facilities SMFlow is used in — and is the reason nothing is designed to phone home.
4. How we use it
We use the information above only to:
- Deliver your license key and honour key recovery requests.
- Validate activations and enforce the per-license machine limit.
- Process refunds and revoke refunded or disputed keys.
- Answer your support and billing enquiries.
- Meet our tax and accounting obligations.
We do not sell your data, rent it, share it for advertising, or use it to profile you. We do not send marketing email unless you ask us to.
5. Who we share it with
Only the providers needed to run the business, each processing on our behalf:
- Square — payment processing.
- Microsoft Azure — hosting for the licensing service and its storage, in the United States.
- Our email provider — delivering license keys and support replies.
- Cloudflare — website hosting and delivery.
We may also disclose information where the law requires it, or to establish or defend a legal claim.
6. How long we keep it
Because a Pro license is perpetual, we keep the license record — email, name, payment reference, and activation fingerprints — for as long as the license exists, so that it can be recovered, re-activated, and supported years after purchase. Deleting it would leave you unable to prove or recover what you bought.
Transaction records are retained for at least seven years where tax and accounting law requires it. Activation fingerprints for a machine you deactivate are removed from the active seat list at that point.
7. Security
License data is held in Microsoft Azure with encryption at rest and in transit. The private key used to sign licenses is held in Azure Key Vault and never leaves it — it cannot be exported, and our own service can ask it to sign but cannot read it. Access to production systems is limited to those who operate them.
One deliberate design note: our key lookup endpoint returns an identical response whether or not an email address is known to us, so it cannot be used to discover who our customers are.
8. Your rights
You may ask us to access, correct, export, or delete the personal data we hold about you, and to stop processing it. Email privacy@smflow.co from the address concerned, and we will respond within 30 days.
Deleting your license record means we can no longer recover or re-activate your key, and the license becomes unusable on any new machine. We will say so clearly before acting on such a request.
Residents of California and other US states with comparable laws have the right to know what is collected, to delete it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those laws define it.
9. Children
SMFlow is a professional engineering tool and is not directed at children under 13. We do not knowingly collect their personal data.
10. International transfers
Our systems are operated in the United States. Sales are currently offered in the United Statesonly; if you contact us from elsewhere, the information you send is processed in the United States.
11. Changes
We may update this policy. Material changes will be reflected in the effective date at the top of this page. Questions: privacy@smflow.co.