Privacy policy

Effective date: 2026-10-19

RoAuto Flow automates image prompts and reference-image selection in Google Flow, displays results, and optionally downloads results and moves them to Flow's trash. It is an independent extension, not a Google product.

Data used

The extension uses prompts you enter, image files you explicitly select, and image results from your active Flow project to perform these features. It reads the active tab's URL where its Flow host permissions apply to determine whether a Flow project is open. It does not build browsing-history profiles.

Language, appearance, input mode, model, aspect ratio, and download/cleanup preferences are stored locally in Chrome extension storage. Prompts you choose to save ("Save prompt", up to 100) are stored in the same local extension storage, and images you choose to save ("Save for reuse", up to 40) in this browser's IndexedDB for the extension. Both stay on your device, are never sent to a developer-operated server, and can be deleted in the app or by removing the extension. The text in the prompt box and the text of queued, unsent tasks are saved locally as you type, so they survive closing the panel (they are removed once the queue is submitted or cleared); selected image files are held in the side panel's memory only; running jobs and result previews are held in the Flow tab's memory. Closing or reloading the relevant page or clearing the queue releases that page's references to these data. This is not a secure-erasure guarantee.

Where data goes

When you start a job, selected reference images and prompts are sent through the Google Flow website using your existing Google session. Google processes and retains this information under its own terms and privacy policy. RoAuto Flow does not collect your Google password, export authentication cookies, or send your prompts or images to a developer-operated server. Authenticated result downloads may use your existing Google session in the Flow tab.

Account and plan (license)

To apply the daily prompt limit and paid plans, the extension asks you to sign in with your email address (a one-time code sent by email, no password) and talks to a developer-operated Supabase project. That project stores:

• your email address and account id;
• your current plan and its expiry date;
• how many prompts you ran per day (a count only, never the prompt text);
• a random id for each installation, with a name such as "Chrome · macOS" and its last-used time, to enforce the device limit. You can see and remove your devices in the extension's Settings tab;
• payment orders you create (order code, plan, amount, status) and the bank-transfer, card payment or USDT reference that matches them. The extension never sees your bank, card or wallet credentials;
• bug reports you choose to send: title, description, extension version and the page URL.

When the panel opens, it also reads a public settings row (a notice from the developer, if any) from the same project. This request carries no account data and is repeated at most every 30 minutes.

Services that process this data on the developer's behalf:

• Supabase hosts the database and sends sign-in codes through the developer's email account (the code email carries only your address and the code).
• SePay (sepay.vn) notifies the developer's server of bank transfers made to the developer's account, including the transfer amount and note, so a paid order can be matched automatically. The payment QR image in the upgrade dialog is loaded over HTTPS from qr.sepay.vn; that request contains the developer's receiving account, the amount and the order code, plus ordinary network information such as your IP address.
• Dodo Payments (dodopayments.com) takes card payments as the merchant of record: it runs the checkout page, charges the card, handles tax and issues the receipt. When you choose to pay by card, the developer's server sends Dodo Payments your email address and the order code, and Dodo Payments tells the server when the payment succeeds, is refunded or is disputed. Your card details go only to Dodo Payments; neither the extension nor the developer sees them.
• Paddle (paddle.com) also takes card payments as the merchant of record, in the same way: when the card checkout is run by Paddle, the developer's server sends Paddle your email address and the order code, and Paddle tells the server when the payment succeeds, is refunded or is disputed. Your card details go only to Paddle; neither the extension nor the developer sees them.
• Telegram: when you press "I sent the USDT" or send a bug report, the developer receives a private Telegram bot message with your email address and the order or report details. The wallet QR shown for USDT is generated inside the extension; no request is made to draw it.

Payments are made outside the extension, by bank transfer, card or USDT, and are handled as described in the Terms and the refund policy. These records are used only to provide and bill the plan and to give support. Email doanhoangvu20298@gmail.com to have your account data deleted.

The extension has no developer-operated analytics, advertising, or telemetry service. It does not sell user data or use it for advertising. Data access is limited to providing the user-facing automation features, consistent with the Chrome Web Store User Data Policy, including its Limited Use requirements.

The donation dialog reads the developer's public USDT wallet address from the license server and draws its QR code inside the extension. Opening it also loads a bank QR-code image over HTTPS from img.vietqr.io unless a local QR image is configured. That request includes the developer's recipient bank/account details and donation note, as well as ordinary network information such as your IP address. It does not send your prompts, selected images, bank credentials, or initiate a payment. Any payment is made separately in your banking app.

Retention and controls

You can clear the queue, remove selected images, and uninstall the extension to remove its local settings. Downloaded files remain on your device until you delete them. Uploaded reference images remain in your Flow project until you remove them there. Optional cleanup moves only a generated result identified for the current job into Flow's trash after Chrome confirms its download; it does not delete original references, old assets, or permanently empty Flow's trash. Google controls cloud retention and trash behavior.

All external service URLs used by the extension use HTTPS. The extension temporarily uses Chrome's debugger permission to send the Generate-button click to the selected Flow project and detaches afterward. It does not use this permission to collect browsing history or inspect unrelated tabs.

Contact and changes

Contact the developer at doanhoangvu20298@gmail.com for questions about this extension, or to request deletion of your account data. Future changes to data handling will be reflected in this policy.