Your AI key is yours

AI features in the extension run on a key you provide, stored in extension storage on your machine. FlowKy does not proxy those calls and does not see the traffic. If you do not add a key, those features are unavailable rather than silently degraded.

Extension tokens

Signing in to flowky.ai is what connects the extension: it reads the session cookie and exchanges it server-side for a scoped, revocable token. Only that token is stored, never the cookie. Revoke it from Settings → Security, which invalidates the extension immediately.

The local bridge

The channel between browser and editor is a WebSocket on 127.0.0.1, authenticated with a pairing code you copy across once. It is loopback only. Console output, errors, network traffic and screenshots go through it and do not leave your machine.

What is sent to FlowKy

Only what you save: tasks, flows, captures you choose to keep, and your brand kit. The extension contacts flowky.ai from the account section only, and only on an explicit action. There is no background telemetry.

OAuth scopes

Signing in asks for the minimum. Additional scopes — Search Console, private GitHub repositories — are requested at the moment you use the feature that needs them, not bundled into the sign-in. If you never import from Search Console, FlowKy never asks for it.