Last updated 14 October 2026. Aha (formerly Flow Key) is operated by Justus Huneke. Contact hunekejustus@gmail.com with privacy questions or requests to access or delete account data.
On your Mac
Text corrections run locally. Settings and the user dictionary are stored on your Mac. Account sessions, your own API key, and saved personal details use the macOS Keychain. Flow Key uses Accessibility access to work with text fields and input permissions for its shortcuts.
When you use Field Assist
Invoking Field Assist sends the focused field or selection, instructions, and field labels to an AI service. When surrounding context is enabled, this can include the app name, window title, website origin and nearby labels or headings. You can disable surrounding context and inspect the most recent outgoing payload in Settings → Privacy. Saved personal details are replaced with placeholders before sending. Automated redaction is not a guarantee that every sensitive value will be detected.
With a Flow Key account, requests pass through our Cloudflare-hosted service to OpenRouter and its selected model provider. With your own OpenRouter key, requests go directly to OpenRouter. The service requests routing that disallows provider data collection; provider processing and retention are also governed by their policies. Flow Key's service does not store the request or response text in its usage database.
Accounts and usage
Clerk handles authentication. Google sign-in shares basic account identity, such as your email address and profile, with Clerk to sign you in. Flow Key does not request access to Gmail, Drive or Calendar. The service records account identifiers, email, product-update preference, and usage metadata such as model, token counts, cost, status, timestamps and app version to operate accounts and enforce usage limits.
Service providers
Vercel hosts the website; Cloudflare hosts the API, usage database and downloads; Clerk and Google support authentication; OpenRouter and model providers process AI requests; Resend supports service emails and optional product updates. These providers may process connection and security information under their own policies. Processing may occur outside your country.
Your choices
You can stop using Field Assist, turn off surrounding context, remove saved personal details, revoke macOS permissions, or uninstall the app. Product updates are opt-in. Contact the address above to request account deletion or help with your data. Local settings remain on your Mac until removed. No fixed automatic retention period is currently configured for service usage records.