Terms of Service

Effective Date: December 12, 2025
Last Updated: July 10, 2026

1. Acceptance of Terms

By creating a Flowsta identity, you agree to these Terms and our Privacy Policy.

Requirements:

  • You must be 13+ years old (16+ in the European Union)
  • You are responsible for your account security
  • You understand the technical realities of a zero-knowledge, device-held identity (section 6)
  • You agree to use Flowsta lawfully

2. Your Account & Security

Your Flowsta account is created in the Flowsta Vault on your own device. Two things protect it, with different jobs:

  • Your vault password unlocks the Vault on one machine. Forget it, and your recovery phrase restores your identity on a fresh Vault.
  • Your 24-word recovery phrase is the master key to your identity itself - created with your identity, shown once, held only by you.

Your responsibilities:

  • Protect your recovery phrase - store it offline, in more than one safe place. If you lose it, your identity is permanently unrecoverable; no one, including Flowsta, can reset it.
  • Export your data - your private data lives only on your device; an export from Vault → Your Data is the only backup of it. Your phrase restores your identity; your export restores your private data.
  • Secure your device and keep a verified email on your account for important notices.
  • Notify us of any unauthorized access.

Accounts created before device-held identity sign in once through the Vault to upgrade; web password sign-in is retired.

3. Flowsta Vault

Flowsta Vault is the desktop app where your identity is created and lives. It runs a local Holochain conductor on your device.

  • Your keys and data are on your machine - encrypted, and never accessible to us. Backing them up (via export) is your responsibility.
  • You approve every connection - apps and sites must ask before they authenticate, link, or sign as you.
  • Identity links are permanent - approving a link commits an immutable attestation to the public identity network. Approve carefully.
  • Web signing routes through your Vault - signing from flowsta.com sends the request to your Vault for your approval; your keys never leave your device.

4. Sign It - File Signing (Optional)

Sign It lets you cryptographically sign files with your identity.

How it works: your file is hashed on your device (never uploaded), and a signature record - hash, timestamp, your public key, and any metadata you declare - is committed to a public signing network where anyone can verify it.

What you agree to:

  • Declared content rights are your own public statement. Only declare rights you actually hold.
  • Don't sign content that is illegal in your jurisdiction or make false claims of authorship.
  • Records are immutable - revocation is a separate signed entry; the original stays visible. Amending links versions rather than replacing them.

Flowsta's role: we don't police or enforce declared rights - they're your cryptographically-signed statement, usable as evidence. Our contact relay lets others message you about signed work without learning your email.

Quotas: monthly signing quotas and pricing live on the Premium page. Verification is always free and unlimited.

5. Acceptable Use Policy

You may NOT use Flowsta for:

Activities creating direct legal liability:

  • Child sexual abuse material (CSAM)
  • Credible threats of violence against specific people or groups

Infrastructure abuse:

  • Automated attacks (DoS, spam), API abuse beyond rate limits, security compromise attempts

System integrity violations:

  • Large-scale identity theft, systematic bot account creation, network manipulation attempts

What we don't enforce

We don't police speech or opinions, and we don't moderate content on partner sites - they make their own moderation decisions. We provide identity infrastructure, not a content platform.

Partner site independence

Each site using Flowsta sets its own policies. Sites can ban you from their platform; they cannot delete your Flowsta identity. Bans are site-specific, never system-wide.

If we ban you

We can delete your server-side account records and block API access. We cannot delete your identity from the public network, access your private data, or stop you using your keys - your identity remains yours, and you can self-host against the open standard if technically capable.

6. Technical Realities

You acknowledge:

  1. Immutable network data - your DID, profile picture, and identity links cannot be deleted, by design for censorship resistance
  2. Zero-knowledge - we cannot access your private data or recover anything for you
  3. Your recovery phrase restores your identity; it is never stored by anyone and cannot be reset
  4. Your export is the only backup of your private data - device data is your responsibility
  5. Signatures are permanent public records (revocable, but never erased)

7. Cryptographic Autonomy License

Flowsta runs on Holochain, licensed under the Cryptographic Autonomy License. Your identity and data are truly yours:

  • Full export anytime via Vault → Your Data - decrypted only on your device; we never see it
  • True portability - your recovery phrase rebuilds your identity on any compatible Holochain conductor, independent of Flowsta. Even if Flowsta ceased operations, your identity and signed work keep working
  • No restrictions - we impose no technical or legal limits on using your own data (CAL §4.2.1-4.2.3)

8. Service Availability

We strive for 99.9% uptime on Flowsta's services, provided "as is" without warranty. Your identity doesn't depend on it: it lives on your device and the public network, and keeps working even when our services don't.

9. Fees & Premium Features

Current pricing and quotas are always on the Premium page.

9.1 Free

  • Account creation and sign-in everywhere · 8+ character usernames · 2 Sign It signatures/month · unlimited verification

9.2 Premium

  • Monthly or annual billing · 100 signatures/month · 6-7 character usernames · shorter-username add-ons available · priority support
  • Auto-renews unless cancelled; cancellation takes effect at the end of the billing period (no prorated refunds)

9.3 Premium Plus

  • Monthly or annual billing · 1,000 signatures/month · 5-character username included · shorter-username add-ons available · priority support

9.4 Short-Username Add-Ons (Annual)

  • Require an active Premium or Premium Plus subscription - cancelled if the base subscription ends
  • One username per account · first-come-first-serve · no refunds when changing tier mid-term
  • 14-day grace period if your subscription lapses, then the username is released to others

9.5 Username Changes & Reserved Names

  • Change your username anytime (subject to availability and tier). When a paid tier ends, short usernames are released and you set a new 8+ character one.
  • Some usernames are reserved (brands, offensive terms) and may be assigned to verified owners on request.

10. Termination

You can stop using Flowsta at any time: reset your Vault to erase your device data, and email privacy@flowsta.com to have your server-side account records deleted.

We can terminate for Terms violations, or with 30 days notice.

Either way: API access ends and server records are deleted - but your identity remains on the public network (immutable), your keys remain yours, and your recovery phrase keeps working.

11. Governing Law & Contact

Jurisdiction: Victoria, Australia

Changes to These Terms

We'll notify you of material changes by email and on this page. Continued use after changes constitutes acceptance.