FlowHRMS by Flowacord
Data Safety
A short summary of the data the FlowHRMS Android app handles and why. The full detail is in the Privacy Policy.
Last updated 6 November 2026
Encrypted in transit
Everything the app sends goes over encrypted (HTTPS) connections.
No selling, no ads
Data is not sold or used for advertising. The app contains no advertising or analytics SDKs.
No biometrics
No fingerprint, face or other biometric data is collected.
You can ask for deletion
In the app, or see Account Deletion.
About this page
This page explains our data practices in plain language. It is separate from the “Data safety” section on the FlowHRMS Google Play listing, which Flowacord completes in Google Play Console. If the two ever differ, the Privacy Policy describes what we actually do.
What the app handles depends on the features your company switches on.
Route tracking and monitoring
FlowHRMS is an employee management app that your employer provides. Where your company switches route tracking on for you and you agree in the app, it is also an employee monitoring tool: it records your location from check-in to check-out, including while the app is closed, so you and your manager can see the day’s route.
- It never records before check-in, after check-out or on days off.
- A notification shows on your phone the whole time it records.
- You can stop it at any time in the app: My route or Privacy & consent → Stop sharing my route. Saying no never stops you checking in.
Because of this feature, FlowHRMS is declared to Google Play as an employee monitoring app, and Google Play Protect may tell you that a monitoring app is installed on your phone.
Data the app handles
| Data | Examples | Why | Required? |
|---|---|---|---|
| Personal info | Your name, email address and mobile number; your FlowHRMS account ID, sent with each request; for people a manager adds from the app, their name, email, mobile, department and designation; company name, address and GSTIN (owners and admins); the details on an ID document you choose to upload, such as an ID number, date of birth or address | Account, sign-in, employment record | Yes |
| Precise location | Latitude, longitude and accuracy when you check in or out, and whether a fake-location app was in use; where your company uses field visits, the same when you tap Going out, Reached, End visit or Back at office, if you allow it; a branch's position, when an admin sets it from their phone | Record attendance, confirm the place of work, and record work trips | Yes, to check in from the app; optional at field-visit taps |
| Approximate location | If you let FlowHRMS use only your approximate location: the position your phone sends when you check in or out (FlowHRMS refuses it and doesn't keep it), and at field-visit taps if you allow location there (kept with the visit). Route tracking never records it | As for precise location | Optional — only if you choose approximate location |
| Precise location — route | Your position every few seconds (about once a minute while you are still) from check-in to check-out, only where your company switches route tracking on for you and you agree | Show your working day's route and distance to you and your manager | Optional |
| Fitness info — physical activity | Steps the phone counts, which way it faces, and whether you are still, walking, cycling or in a vehicle — during route tracking only, if you allow it | Follow your route where GPS can't reach, and tell walking from driving | Optional |
| Health info | That a leave request is for sick leave, and the reason you write for it | Your leave record | Optional — only if you ask for sick leave |
| Photos | Profile photo; photos you take or pick as proof of a task; the photo you take when you reach a place on a field visit | Profile, ID card, proof of work, record of a visit | Optional, unless your company asks for a photo at each visit |
| Files and documents | Documents you upload to your document vault, such as ID, address or bank proof | Employment records your company needs | Optional |
| Financial info | The bank details on a bank proof (a cheque or bank statement) if you choose to upload one to your document vault. FlowHRMS has no fields for bank account or card numbers, and the app takes no payments | Employment records your company needs, such as where your salary is paid | Optional |
| Work records and messages | Check-in and check-out times; leave requests and their reasons; tasks, notes and comments; field-visit places, purposes and notes; approvals you give; the reason you give when you ask for your account to be deleted | The HR features you use | As your company requires |
| Device or other IDs | A push notification token for this phone, and the installation identifiers Firebase Cloud Messaging and Expo create to deliver notifications to it — only after you sign in, and only while notifications are allowed for FlowHRMS; your IP address (see Security data) | Send you notifications, and stop when you sign out; security | Yes for the IP address; the notification token is optional |
| App diagnostics | During route tracking: battery level, and whether location, location permission or battery saver was switched off; whether a file upload worked, and why not | Explain gaps in a route; fix failed uploads | Yes, while you use those features |
| Security data | IP address and device details when you sign up or give consent; IP address in our hosting provider's request logs (on Google Play, under Device or other IDs) | Security, and proof of consent | Yes |
None of this is used for advertising, and none is sold. Within your company, people see records according to the roles your company sets. FlowHRMS keeps these records for your employer, so your employer seeing them is the purpose of the app, not sharing with an outside company.
The app also shows you records your employer keeps in FlowHRMS on the website — for example salary details and payslips, or a blood group on your ID card. The app displays them but does not send them, so they are not data the app collects; the Privacy Policy covers them.
Phone permissions
| Permission | When it is used |
|---|---|
| Location — while using the app | When you check in or out (and on the Attendance screen, to show your position first); at field-visit taps if your company uses field visits; when an admin sets a branch from their current position. |
| Location — all the time | Only for route tracking, where your company switches it on for you and you agree: from check-in to check-out, with a notification showing the whole time. |
| Physical activity | Only during route tracking, if you allow it: steps and whether you are walking or in a vehicle. Refusing it changes nothing else. |
| Camera | Only when you choose to take a photo — proof of a task, or a photo at a field visit. |
| Photos and files | Only the items you pick with Android's picker, to upload them. |
| Notifications | Android asks once after you sign in. If you allow it, FlowHRMS can notify you, for example when a leave request is decided. Route tracking needs it, so you can always see when your route is recorded. |
You can turn any of these off in your phone’s settings; the feature that needs it then stops working.
What the app does not collect
- Biometric data — no fingerprint, face or voice recognition.
- Location in the background unless route tracking applies to you — and never a route before check-in or after check-out.
- Contacts, call logs, SMS, or your photo gallery beyond the items you pick.
- Advertising IDs, browsing history, or how you use the app: the app has no analytics or crash-reporting software.
- Bank account or card numbers in any field — FlowHRMS has none. A bank document you choose to upload is kept as a file.
Who receives it
We do not sell data or share it for advertising. These service providers process data from the app for Flowacord, on our instructions:
- Supabase — database, sign-in and private file storage, in its Mumbai (India) region.
- Cloudinary — storage of files uploaded from the Android app.
- Hostinger — hosting of the website and server, and email (sending FlowHRMS emails and the help@flowacord.com mailbox).
- Firebase Cloud Messaging (Google) — delivery of push notifications to Android phones.
- Google Drive — encrypted backups.
These companies receive some data from the app to provide their service and may also use it for their own purposes, under their own privacy policies, so the Google Play listing shows it as shared:
- Google Maps Platform — works out road distance for field visits: FlowHRMS's server sends Google the start and end point of each field-visit leg, with no name or other identifier. The Android app itself shows no Google map (privacy policy (opens in a new tab)).
- Expo — delivers push notifications to the app. It receives this phone's push token and installation identifier, and the title and text of each notification, which can include a colleague's name, leave dates or the reason given for a decision (privacy policy (opens in a new tab)).
When you choose to share a report or file from the app to another app, it goes where you send it. Details are in section 12 of the Privacy Policy. We disclose data to authorities only where the law requires it.
How it is protected
- Encrypted (HTTPS) connections between the app, FlowHRMS and the services above; the website accepts only HTTPS.
- Each company’s data kept separate from every other company’s.
- Your password is handled by our sign-in provider and never stored by FlowHRMS.
- On your phone, your sign-in session is kept in Android’s encrypted secure storage.
- Uploaded files are private and open through short-lived links.
- Support access by Flowacord staff is recorded.
Deleting your data
You can ask for your account and data to be deleted in the app (Account → Delete account), on the website after signing in, or by email to help@flowacord.com. We answer within 90 days. Our team carries out the deletion and confirms it to you. Some records — for example wage and attendance records your employer must keep by law — are kept for as long as the law requires.
What is kept, and why
The Account Deletion page lists exactly what is deleted and what is kept.