Privacy Policy

Last updated: 14 June 2026

Flow Blog ("we", "us") is operated by Merlion Agency. This policy explains what personal data we collect, why we collect it, and your rights regarding that data. If you have any questions, contact us at gerwyn@merlionagency.com.

Data we collect

  • Account data: your email address and a securely hashed password, or, if you sign in with a social provider, the account identifier supplied by Google or GitHub.
  • Profile data: your username, display name, optional "about" text, and profile picture.
  • Content you create: blog posts, comments, and any images you upload.
  • Technical data: a session cookie used to keep you signed in, and standard server logs (such as IP address and request information) used for security and debugging.

How we use your data

  • To create and manage your account and authenticate you.
  • To provide the core functionality of the site (publishing posts, commenting, profiles).
  • To send transactional emails such as email verification and password-reset codes.
  • To keep the service secure and prevent abuse (e.g. rate-limiting).

Cookies

We use a single essential session cookie to keep you logged in. It is not used for advertising or cross-site tracking. Without it, the authenticated parts of the site cannot function.

Third-party services

We share data only with the service providers required to run the site:

  • MongoDB Atlas — database hosting (stores your account, profile, and content).
  • Upstash (Redis) — stores login sessions.
  • Google & GitHub — only if you choose to sign in with them, to authenticate you.
  • Brevo — sends verification and password-reset emails.
  • Vercel and Bonto — host the website and backend.

Data retention

We keep your account data for as long as your account exists. Email verification and password-reset codes are short-lived and expire automatically. You may request deletion of your account and associated data at any time.

Your rights

Depending on your location, you may have the right to access, correct, or delete your personal data, and to object to or restrict its processing. To exercise these rights, email us at gerwyn@merlionagency.com.

Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated revision date.