Privacy Policy

Information we collect

• Account information: name, email address, organization name.
• Authentication data: hashed password, session tokens, API keys.
• Billing information: handled by Stripe; we store only customer and subscription identifiers, never card numbers.
• Usage and operational logs: requests, branch and database events, error traces, IP addresses.
• Customer data: the contents of databases you create in Flicker.
• Project content you connect: repository files, tickets and documents. We store their text and search vectors so Ask and agents can use them.
• Model provider keys you add. They are stored encrypted and used only to call your provider on your behalf. Text sent to answer a question goes to that provider under its terms.

How we use information

• To operate, secure, and improve the service.
• To bill for the service and handle support requests.
• To detect abuse and enforce our Acceptable Use Policy.
• To send transactional email (account, billing, security, incident notifications).

We do not sell personal information. We do not use customer database contents, repository content, tickets or documents for any purpose other than running the service you asked us to run. Flicker does not train models on your content; model calls use your own API keys under your provider's terms.

Subprocessors

We rely on a small number of vendors to deliver Flicker. The current list is maintained in our Security FAQ. We will provide reasonable notice before adding a new subprocessor that processes customer data.

Data retention

We retain account data while your account is active. Deletion of customer data is available on request through support until self-serve erasure ships; we do not commit to a deletion timeframe, and backups may retain data per backup retention policy. Operational logs are retained for up to 90 days.

Data location

Customer databases are hosted in the United States (Vint Hill, Virginia). Account and operational metadata (organizations, apps, secrets, and deployment records) is stored on that same hardware, in a Postgres cluster Flicker operates itself, and is served by our control plane running there too. Search data for connected projects is stored in a Postgres database Flicker operates. The Postgres proxy for customer database connections runs on Fly.io (US-East); it forwards traffic and does not store this data. Backups are stored in Tigris or Backblaze B2 S3-compatible storage. Transactional email is sent from Flicker's own in-cluster mail service (DKIM-signed); DNS by Cloudflare.

Your rights

You may request access to, correction of, or deletion of your personal information by emailing johnorlando@me.com. EU and UK customers have additional rights described in our Data Processing Addendum.

Children

Flicker is not directed to children under 18 and we do not knowingly collect personal information from them.

Changes

We will notify customers of material changes to this Policy by email and update the "Last updated" date above.

Contact

Privacy questions: johnorlando@me.com.