The Trust Signals We Publish on Our Product Websites

Company facts a reader can check

The company section of bbmmtech.com prints the facts that appear in a public registry. A comment above that record in our code gives the reason: a company page is judged on what a reader can check, so the facts are published in full where a summary such as a founding year would have been shorter.

• Legal name: BBMM Technologies Inc.
• Incorporated on 17 June 2026 in Nova Scotia, Canada.
• Registry of Joint Stock Companies, Nova Scotia, number 4825550.
• Registered office at 1800 Argyle St, Unit 801, Halifax.
• The Chief Executive Officer and the Chief Technology Officer, each by name with a LinkedIn profile.

The same facts are in the Organization structured data. The registry number is an identifier with the registry named as its property, and the address is a PostalAddress. A test on flowoapp.com fails if that site's Organization block lacks the number, so a reader who starts from the product site reaches the same record.

Recognition is handled the same way. The site names one program, Invest Nova Scotia Accelerate, and links the name to the announcement on the program's own website.

Legal documents and who answers for them

bbmmtech.com publishes eight legal documents, and each has its own URL in the sitemap. They are the Privacy Policy, Terms of Service, Cookie Policy, Acceptable Use Policy, Refund and Purchase Policy, Copyright and Intellectual Property Policy, End User License Agreement and Disclaimer.

The documents name the governing law, which is that of Nova Scotia and the federal laws of Canada, and the courts in Halifax as the forum. They name a privacy officer and give one address for privacy requests.

The FAQ repeats the parts people ask about most. It says store purchases are refunded by the App Store or Google Play under the store's process. It gives a separate support address for each product.

security.txt on three domains

Each of our three domains serves a security.txt file at the well-known path defined by RFC 9116. The file tells a security researcher where to send a report, which matters most on a day when something is wrong.

The three files have the same four fields. Contact is a dedicated security mailbox at bbmmtech.com. Expires is set to 7 October 2027, one year after we added the file to bbmmtech.com. Preferred-Languages lists English and Ukrainian. Canonical gives the file's own address and is the one field that differs between domains.

The expiry date is a commitment. A file past its date tells a researcher that the contact may be dead, so the date has to be renewed on schedule.

Response headers

bbmmtech.com and flowoapp.com send the same five headers on every path. Anyone can inspect them with a single request, which makes them a claim we cannot overstate.

• Strict-Transport-Security with a max-age of one year and includeSubDomains.
• X-Content-Type-Options set to nosniff.
• X-Frame-Options set to DENY, so the pages cannot be framed by another site.
• Referrer-Policy set to strict-origin-when-cross-origin.
• Permissions-Policy with empty lists for camera, microphone and geolocation.

The Permissions-Policy line is the most direct of these. A marketing site has no use for a camera or a location, and the header makes the browser refuse both.

Statements of what we do not claim

Each site carries a written list of things it does not claim. The llms.txt on bbmmtech.com ends with a section that says no user counts, download figures, revenue or funding are published, so none should be attributed to the company. It also says neither app is a medical device.

The flowoapp.com record has a section called Evidence boundary. It says Flowo is a planning app, that it publishes no outcome evidence, and that a controlled study is proposed and has not been completed. A section called Scheduler limits follows. It states that placement is greedy and never undone, that a plan is abandoned after 10 seconds, and that daily rhythm is built about 90 days ahead.

The textpack.app record lists the six checks TextPack runs on a document's source, then names what it does not check: rendered overflow, remote link availability, redaction and accessible PDF validation.

Tests keep these statements in place. One fails if the evidence sentence is removed from the Flowo record. Another fails if the feature list in Flowo's structured data contains clinical vocabulary. The open roles list on bbmmtech.com is an empty array today, and the page prints that no roles are listed.

Consent before analytics

Analytics code on bbmmtech.com is downloaded only after a stored consent record passes validation. The record holds a policy version, a timestamp and one boolean. The parser rejects it if the version is old, if the timestamp is in the future, or if it is more than 180 days old. A rejected record means the visitor is asked again.

A browser that sends Do Not Track is treated as a refusal before storage is read. Choosing to decline switches the analytics client to opt-out and deletes its keys from local storage, session storage and cookies. Automatic event capture is turned off in the configuration.

flowoapp.com adds Global Privacy Control to the opt-out signals and stores separate choices for analytics and marketing. Its build fails if the home page references the analytics bundle directly, which keeps the promise enforceable.

Fonts on bbmmtech.com are downloaded at build time and served from our own origin. A page view therefore makes no request to a font provider.