Privacy Policy

Effective 18 October 2026. Applies to the CallFlow extension for VS Code and compatible editors (Cursor, Windsurf, VSCodium and others).

The short version

Your requests, responses, collections, environments, history and captured traffic stay on your machine. CallFlow has no account and no sync. From version 0.2.4, the extension sends one anonymous ping a day so we can count how many installs are actually in use, and in which editors. It contains four fields and nothing that identifies you, and you can turn it off.

What stays on your machine

• Requests and collections: plain .http files in .callflow/ in your workspace (or in CallFlow's own storage folder when no folder is open).
• History and captures: in your editor's global storage for CallFlow, on your machine.
• Environment secrets and your licence key: in your editor's secret storage.
• The capture proxy listens only on 127.0.0.1; its CA private key is generated locally and never leaves your storage folder.

CallFlow sends requests only to the URLs you send them to. Request scripts (Pro) run in a sandbox with no network access.

The daily install ping

At most once per day (UTC), CallFlow sends one HTTPS request to https://smallhours.works/api/ping with exactly these fields:

• p: the product, always callflow.
• v: the CallFlow version, such as 0.2.4.
• e: your editor's name as it reports itself, such as Visual Studio Code, Cursor, Windsurf or VSCodium.
• d: a random install id that CallFlow generates once and keeps in its own storage. It is not your editor's machine id and is not derived from your hardware, account or anything else about you.

It does not include your machine id, user name, email, workspace or file names, paths, settings, licence details, or anything about the requests you send or the traffic you capture.

What we keep: one record per install id per day, holding the version and editor name, which expires automatically after 60 days. We use it only to count daily active installs and to see the split by editor and version. Our server does not store your IP address or user agent. Cloudflare, which hosts the endpoint, processes connection data such as IP addresses to deliver any request, under Cloudflare's privacy policy; we do not log or receive it.

Why: the extension stores only report download counts, which include updates and installs that are never opened. Knowing how many installs are used, and in which editors, tells us where to test and what to fix.

How to turn it off: CallFlow sends nothing when your editor's telemetry is off (in VS Code, set telemetry.telemetryLevel to off), or when you set callflow.telemetry.enabled to false. Either one is enough, and the change takes effect immediately. A failed ping is not retried until the next day and never shows a message.

Buying a Pro licence

Pro licences are sold through Paddle.com, Inc. as Merchant of Record. Paddle collects and processes your payment details, billing address and the email address you check out with, and is the data controller for that checkout under Paddle's privacy policy. From Paddle we receive only what is needed to issue your licence: your email address and an order identifier. The licence key is signed data that CallFlow verifies offline; activating it makes no network request, so we do not learn when, how often or on how many machines it is used. When you click Buy Pro, the link carries the name of the feature you clicked it from (for example ext-diff) to the site and on to Paddle; it holds no personal data.

This website

smallhours.works is a static site hosted on Cloudflare. We add no analytics, advertising or tracking scripts and set no cookies of our own. Paddle's checkout script loads on product pages to sell Pro. Cloudflare processes standard connection information to serve pages; that is Cloudflare's infrastructure, not something we receive a copy of.

Your rights

The ping data is pseudonymous: we cannot link an install id to a person. If you are in the EU, UK or another place with data-protection law, our basis for it is our legitimate interest in knowing whether CallFlow is used, balanced by its minimal content, short retention and the off switches above. If you want the records for your install id removed, email us the id (it is in CallFlow's global state as callflow.telemetry.installId) and we will delete them; turning the ping off stops new ones.

Changes to this policy

If this policy changes, we will update the date at the top of this page and call out any change that reduces your privacy in the extension's changelog.

Contact

CallFlow and this website are operated by Small Hours, the data controller for the data described above. Email hello@smallhours.works. Postal address:
Small Hours
11 Apex Drive, Suite 300A #393
Marlborough, MA 01752, United States

This policy is governed by the laws of the Commonwealth of Massachusetts, United States. Rights that your local data-protection law gives you apply in addition.