Privacy policy for Flows

Last updated: 28 October 2026

Flows is a comic, manga and ebook reader for Android phones and tablets, and for iPhone and iPad, published by Nunninator Apps. This policy says what the app keeps on your device, what leaves it, when, and where it goes. It covers Flows 2.0 and later. Most of it is the same everywhere; what is different on an iPhone or iPad is in On iPhone and iPad below.

The published copy of this policy is at https://flows.nunninatorapps.online/ and is opened from the app by Settings > Help and about > Privacy policy.

The short version

• Flows has no account, no advertising, no analytics of its own and no server of its own.
• Your library, your reading and your settings are kept on your device, and we never see them.
• Something leaves your device only in these cases, each explained below:
  • you connect a server of your own, and Flows talks to that server;
  • you choose to send us a page report or a diagnostics log, by email;
  • you buy Flows Pro or rate the app, which Google Play or the App Store handles;
  • on Android, Google ML Kit, which reads the text on a page on your device, sends Google metrics about how it is working;
  • you share something yourself, Android or iOS backs the app up to your Google account or iCloud, Read aloud hands words to your speech engine, or an ebook points to pictures on the web.
• We never sell data, and never use it for advertising.

What is kept on your device

• Your library. The comics and ebooks you add (a copy of the file, or a link to where it is on your device), their titles, series, covers and page counts, how far you have read each one, bookmarks and their notes, your folders and the folders inside them, the folders you pin to Home, a page you choose as a book's cover, and the choices you make for a single book.
• Book details you edit (Pro). Written into the book's own ComicInfo.xml file.
• What the app works out from your pages. Where the panels and the lines of text are on each page. This is done on your device. No page is uploaded to do it.
• Reading stats. Pages and time read each day, your daily goal and your streak.
• Your settings, including the app lock, the reading reminder, your tap zones and how ebooks look.
• Servers you connect. The address, a second address for your home network if you give one, the name you gave the server and your user name are kept in the app's database. The key, token or password that signs you in is kept encrypted, with a key that Android's keystore holds on this device.
• Books from your servers. Books you download, covers of what you browse, pages of a book you read straight from the server, the download queue, and a list of downloads that failed with the reason.
• A diagnostics log. A small file, at most about 64 KB, of the errors the app ran into, with the app version and the Android version. It stays on your device unless you send it to us.
• Whether you own Flows Pro.

Deleting it. Uninstalling Flows deletes everything the app keeps on your device. Removing a server in the app deletes its stored sign in. Settings > Help and about > Diagnostics shows the log and can clear it. Copies you made yourself, such as a backup file you saved, a panel you saved to your gallery, or an email you sent, stay where you put them.

Android backup. If backup is turned on in your device's settings, Android copies the Flows library database and settings to the backup in your Google account, as it does for other apps, so that they can come back on a new device. Server sign ins, covers and downloaded books are left out. That backup is made and kept by Google under its own terms, and we cannot see it.

Backups you make (Pro). Back up reading state makes a file with your books' titles and where their files were, reading positions, bookmarks, reading stats and most settings, and hands it to the share sheet so that you can keep it where you choose. It does not contain server addresses, sign ins, or the books themselves.

What leaves your device, and when

1. To servers you connect

If you connect Komga, Kavita, Stump, Audiobookshelf or an OPDS catalogue, Flows sends that server, and only that server:

• your sign in (a key, a token, or your user name and password);
• requests for the libraries, books, covers and pages you browse, read or download;
• your reading position, unless you turn off Settings > Servers and downloads > Sync progress with server;
• book details you edit (Pro), when you choose to send them to Komga or Kavita;
• the app's name, Flows, which Kavita shows in its own list of what signed in.

When a server has a second address for your home network, Flows tries that address when it starts and when you ask, to see which one answers.

The server is yours, or one you chose. Nunninator Apps does not run it and receives nothing from it. Questions about data on that server are for whoever runs it.

Connections may be unencrypted. Flows allows plain http:// addresses, because many home servers are set up without https. When you give an https:// address, the connection is encrypted. Over plain http on a network you do not trust, other people on that network could read the traffic, your sign in included. Use https where you can. Flows also trusts certificates you have installed on your device yourself, so that a home server with its own certificate works.

2. Reports and diagnostics you choose to send us

Two things in the app send information to us, and only when you choose to:

• Report this page, in the reader menu, to show us a page where the panels came out wrong.
• Send to the developer, in Settings > Help and about > Diagnostics, to send us the error log.

Neither is ever sent by itself. Each opens your own email app with a message to nunninatorapps@gmail.com, which you can read, change or delete before you send it. Nothing reaches us unless you send it. If your device has no email app, a page report goes to the share sheet instead, and from there wherever you choose.

A page report contains:

• the page image exactly as it is in the book, and a copy with the panels the app found drawn on it;
• the comic's title, the page number and how many pages the book has;
• where the app found the panels, the problems you ticked, how many panels you said there should be, and any note you wrote;
• the reading direction, whether the device was upright or sideways, the size of the screen, your panel mode settings, the app version, the panel detector version, the page's size in pixels and the date.

A diagnostics email contains the log as a file, and the app version in its subject. The log holds error messages and where in the app they happened, with the app version and the Android version. An error message can include the title of a book or the address of a server you connected and, rarely, a web address that carries a server's key. You can read the whole log on the Diagnostics screen before you send it, and clear it there.

Because they arrive as email, we also receive your email address and whatever your email app adds to a message, such as your name.

What we do with them. Reports are used only to improve panel detection, and diagnostics only to find and fix errors. Pages from reports, with the details that came with them, are kept privately as test pages, so that later versions of the app can be checked against them. We do not publish them, sell them, or use them for anything else. We write back only if you ask us something. The emails are kept in our Gmail mailbox, which Google runs for us, and Google may store them outside your country. We keep a report or a diagnostics email for as long as it helps us fix a problem or test panel detection, and delete it sooner if you ask: write to nunninatorapps@gmail.com from the address you sent it from.

3. Google ML Kit

Flows uses Google's ML Kit text recognition to find the lines of text on a page, for example to fit panels to their speech balloons in panel mode, and to find the words for Read aloud. It runs on your device, with a model built into the app.

Google says that ML Kit processes images entirely on the device, and does not send the images, or what it finds in them, to Google's servers.

Google also says that ML Kit:

• may contact Google's servers from time to time to receive bug fixes, updated models and information about which hardware accelerators work;
• sends Google metrics about how ML Kit performs and is used. For text recognition built into an app, as in Flows, these are: the device's maker and model, its Android version and build, and its machine learning hardware; the app's package name and version; identifiers for each installation, which Google says are not intended to uniquely identify a user or a physical device; how long recognition took; the format and resolution of the image; the size of the input and the output; the ML Kit version; the kind of event, such as starting up or recognising text; and error codes.

Google says that this data is encrypted in transit with HTTPS, that ML Kit does not pass it to third parties, and that Google uses it to measure performance, debug, maintain and improve the APIs, and detect misuse or abuse, as its privacy policy (https://policies.google.com/privacy) describes. Flows has no setting that stops these metrics, and we never receive them.

Sources, both from Google and last updated 14 May 2025: "Terms & Privacy", https://developers.google.com/ml-kit/terms, and "Prepare for Google Play's data disclosure requirements", https://developers.google.com/ml-kit/android-data-disclosure.

4. Google Play

• Flows Pro is bought through Google Play. Google handles the payment, and we never see your payment details. Whether you own Pro is recorded on your device and checked with Google Play.
• Rate Flows opens Google Play's own rating card or the app's Play page. What you write there is between you and Google Play.

Google's privacy policy covers both.

5. Things you share yourself

When you share a panel or a page, save a panel to your gallery, share your backup file or your download history, or report a page through the share sheet, it goes to the app you pick and nowhere else.

6. Read aloud

Read aloud hands the words it found on the page to the text to speech engine chosen in your device's settings. That engine is a separate app, on many devices Speech Services by Google. Flows does not send the words anywhere itself. What the engine does with them is set by its maker's privacy policy.

7. Ebooks

An ebook can point to pictures or fonts on the web. If one does, the ebook reader may fetch them, as a web browser would.

On iPhone and iPad

Flows on an iPhone or iPad keeps the same things on your device and sends the same things to your servers and, when you choose, to us. These parts are different:

• No Google ML Kit. The text on a page is found by Apple's Vision, which is part of iOS and iPadOS and works on your device. Section 3 does not apply: nothing about it is sent to Google or to us.
• The App Store, not Google Play. Flows Pro is bought through the App Store. Apple handles the payment, and we never see your payment details. Whether you own Pro is recorded on your device and checked with the App Store, and Restore purchase asks the App Store what your Apple Account owns. Rate Flows opens Apple's rating card or the App Store page. Apple's privacy policy covers both. Pro bought on one store does not carry over to the other, because Flows has no account to connect them.
• iCloud Backup. If iCloud Backup is turned on, iOS backs up the Flows library database, its settings and the comics you imported into Flows, as it does for other apps. Covers, downloaded books and the app's working files are left out. That backup is made and kept by Apple under its own terms, and we cannot see it.
• Sign ins. The key, token or password for a server is kept in the iOS keychain on your device.
• Read aloud uses the voices that come with iOS and iPadOS, on your device.
• The diagnostics log names the iOS or iPadOS version instead of the Android version.
• Permissions. iOS asks you before Flows can use any of these, and only when you first use the feature that needs it: Face ID for the app lock (Pro; iOS tells Flows only whether it matched), adding to Photos to save a panel (Flows cannot see your photos), the local network to reach a server on your home network, and notifications for the reading reminder (Pro) and downloads. You choose files and folders with Apple's own picker, and Flows can reach only those, and files another app hands to it through Open in or Share.

What is never collected

• No analytics or usage tracking of our own.
• No advertising, and no advertising identifier.
• No crash reporting service.
• No account.
• No location, contacts, phone number, camera, microphone or call log.

Permissions

On iPhone and iPad, see On iPhone and iPad above. Flows asks for these Android permissions. Only notifications need you to say yes, and only on Android 13 and later:

• Full network access (INTERNET): your servers, and the Google services above.
• View network connections (ACCESS_NETWORK_STATE): added by a Google library that ML Kit uses to send its metrics when there is a connection.
• Use biometric hardware (USE_BIOMETRIC): the app lock (Pro). Android checks your fingerprint, face or screen lock and tells Flows only whether it matched.
• Show notifications (POST_NOTIFICATIONS): the reading reminder (Pro) and download progress.
• Control vibration (VIBRATE): for those notifications.
• Run foreground service (FOREGROUND_SERVICE and FOREGROUND_SERVICE_DATA_SYNC): to keep downloads from your server going, with their notification, while you use another app. It runs only while a download you started is in progress.
• Run at startup (RECEIVE_BOOT_COMPLETED): to set the reading reminder again after the device restarts.
• Google Play billing service (com.android.vending.BILLING): to buy Flows Pro.
• A permission that Android's support library adds (DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION), which only lets the app's own parts talk to each other.

Flows does not ask for storage, phone, location, contacts, camera or microphone permissions. You choose files and folders with Android's own picker, and Flows can reach only the files and folders you chose, and files another app hands to it through Open with or Share.

Software from others that works on your device

• Google ML Kit text recognition reads the text on a page. See above for what it sends Google.
• TensorFlow Lite, Google's open source library for running machine learning models, runs the panel detection model built into Flows. It works on your device and sends nothing.
• PDF pages are drawn by PDFium, comic archives are opened by libarchive, and ebooks are shown by epub.js. All of them work on your device.

Settings > Help and about > Open source licences lists every one.

Children

Flows is not directed at children under 13, and we do not knowingly receive information from them. If a child has sent us a report, write to us and we will delete it. Flows shows whatever files or servers someone gives it, so the content itself is for whoever looks after the device.

Your rights

Everything Flows keeps about you is on your own device, where you can see it and delete it. The only personal data we receive is in the emails you choose to send us. We handle those because you chose to send them, and you can ask us at any time to show you, correct or delete what we hold. Write to nunninatorapps@gmail.com. If you are in the United Kingdom or the European Union, you can also complain to your data protection authority; in the United Kingdom that is the Information Commissioner's Office (https://ico.org.uk).

Changes

If this policy changes, the new version is published at the same address and the date at the top changes. Changes that matter are also noted in the app's release notes.

Contact

Nunninator Apps, nunninatorapps@gmail.com