Flash ∞ AI is operated by AI-Flash Inc. ("we"), which is responsible for the personal information described here. This policy explains what we collect when you use Flash ∞ AI, why, and the choices you have.

What we collect

Account details: your name, email address and a scrambled (hashed) version of your password.
Your content: the messages, files and memory notes you send, and what Flash makes for you, saved in your projects.
Approximate location: with each chat message, Flash reads the approximate city, country and coordinates of your internet connection, and your device's time zone, so answers can use your date, local time and weather. These aren't saved to your account.
Published apps: the apps you publish and the data their users save in them. If your app has sign-in, Flash keeps each member's email address, their name if they give one, a scrambled (hashed) version of their password and the data they save in your app. You can see your members, remove them, and download the list in My websites & apps; unpublishing an app deletes them with it. Those accounts belong to your app alone: they are not Flash accounts, and they work on no other app. Each app's owner also gets one contact list of the people who sent its forms, signed up or paid: their name, email address and phone number if they gave them, where they came from, and the owner's own stages, tags and notes. When someone ticks a box to get an app's news, Flash keeps the wording they saw, the time, the form it was on and a scrambled (hashed) version of their internet address. The owner can download or delete each contact, unpublishing an app deletes its contacts, and anyone can stop an app's news with the unsubscribe link the owner puts in their emails. After that, for as long as they're on the app's contact list, a box ticked on a form doesn't sign them up again, not even with a +tag (or, for Gmail, dots) added to their address: only the owner can record that they asked for the news again, with a note saying how. If the owner deletes them, Flash keeps no record that they unsubscribed.
Visits to published apps: Flash counts visits to the apps people publish without cookies and without storing anything on the visitor's device. For each visit it keeps the day, the website the visitor came from (only its name, like google.com), the link tags in the address (utm_source, utm_medium, utm_campaign or ref, and whether it came from a Google or Microsoft ad; tags that look like an email address (also written in base64), a phone number, or a long code such as an ID are left out), and a code made from the visitor's internet address and browser with a key that changes every day. The code and its key are deleted after 2 days, so a person is counted once a day and can't be recognised on another day or in another app. While the code exists, Flash notes which steps that person took in the app: sending a form, signing up, starting a checkout, and steps the app itself reports. What the app's owner sees are daily totals: how many people came from where and took each step, and how much was paid per source. While a checkout is open (at most 14 days, as some payments go through days later), Flash keeps where its buyer came from with it; after that, only in the day's total. An order never keeps where its buyer came from, and nothing about it goes to Stripe. On a day or range with only one or a few forms, sign-ups or orders, though, a source's or campaign's numbers can show the owner which contact, member or order came from it. Robots, and the owner's own visits while signed in to Flash or in owner view, aren't counted. To stop one connection from filling an app's daily count, each Flash server also notes, in memory only and only for that day, how many new people came through one internet connection, under a code made with the day's key. On the free plan, how many of an app's own steps one connection reported to it in the last minute is also kept in the database, under a code made with that day's key for that app, until the next daily cleanup. None of this goes on an app's contact list, where “where they came from” means the form, sign-up or order.
Shared chats: when you share a chat, a copy of it (with its pictures, videos and audio) is visible to anyone with the link until you stop sharing it.
Connected apps: when you connect Flash to another app (like Claude or ChatGPT), that app sends Flash the requests it makes for you, and Flash keeps what it makes in your account. Each file gets a hard-to-guess link that the app, and anyone it is shared with, can open. The app can't see your chats or projects, and you can disconnect it at any time.
Your connected accounts (connectors): when you connect an account of yours (like GitHub, Notion, Linear or Airtable) or a server you add yourself in Settings > Connectors, Flash keeps its address, the list of its tools and the key or token you give it. When you connect by signing in at the service, you type your password there, never in Flash, and Flash keeps the access the service gives it (its tokens, which it renews as they run out) instead of a key. For GitHub, Flash also keeps your GitHub login and account number, and the numbers of its GitHub App's installations your GitHub account can use (yours, or one an organization of yours made), which say which repositories it may use. Flash doesn't copy your repositories, but what a GitHub tool reads (a file, an issue or a pull request) is, like any tool's result, saved as described below. For Google Drive, see Google user data below. Keys and tokens are stored encrypted, are only ever sent to that service, and are never shown again, not even to you; for a key, Flash shows only its last 4 characters. Flash reads from or acts in that account only in a chat where you turned it on, and anything that sends or changes something runs only after you approve it. What a tool sent and returned is saved in the chat with the reply. An approval Flash waits on keeps what you approved and, once it ran, what the tool returned, so that Continue and Retry can use it; it is deleted 24 hours after it ends.
Voice conversations: when you talk with Flash, what you say is turned into text and saved in the chat like a typed message, and answers are read aloud by your device. In Chrome, Edge and Safari your browser turns speech into text (using its maker's speech service); in other browsers Flash sends each recorded turn to its transcription provider and keeps only the text. If you turn on “Hey Flash”, your browser listens while Flash is open, and Flash only gets what you say after “Hey Flash”.
Alerts: if you turn on alerts when Flash is closed (Settings > General > Notifications), Flash keeps the address your browser's push service gave that browser, and the keys that encrypt each alert so only that browser can read it. Your browser maker's push service carries the alerts (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge on Windows). Logging out of Flash in that browser, or out of all devices, deletes them.
Slack notes: if you connect Slack (Settings > General > Notifications) and turn it on for an automation, Flash keeps the Webhook URL Slack gave you, encrypted, and shows only its last 4 characters. Each note carries only the automation's name, what happened (a result, a failure or something it needs you for) and a link to it in Flash: never the result itself, and never credit amounts or limits. Everyone in the Slack channel you picked sees the notes, and Slack carries them. Flash keeps a record of what became of each note, which its run shows, for 90 days. Disconnect in Settings deletes the connection and turns Slack off on every automation. Logging out of all devices, or changing or resetting your password, deletes the connection too, and your automations keep their choice for when you connect again.
Usage and billing: which tools you use, credits spent, and purchases. When paid plans are available, card payments are handled by Stripe; we never see your full card number.
Technical data: sign-in cookies that keep you logged in to each account you add on a device, a random code in a cookie that tells Flash a browser you signed in on before (kept only as a scrambled copy with your account, so a sign-in on a new browser can be emailed to you), and standard server logs. If you add a passkey, Flash keeps only its public key, never your face, fingerprint or device PIN, which stay on your device.
Reports: when you report a page or an app, we keep its address, the reason, any details and email address you give, and a scrambled (hashed) version of your internet address, so our team can review the report (new reports are emailed to them through Resend), reply if you asked, and stop repeated or abusive reports; none of it is shown to the person who made the page.

How we use it

to run Flash: answer requests, save your projects, publish your apps and manage credits;
to keep the Service secure and prevent abuse;
to understand overall usage and costs so we can price and improve Flash; and
to contact you about your account or important changes.

We do not sell your personal data, and we do not use your content to train AI models.

Who we share it with

To answer a request, Flash sends it (including any attached file) to the AI provider that handles it:

Anthropic (writing, research, code, apps, slides, translation)
Groq, Google (Gemini), OpenRouter, Cloudflare and Mistral (free models, used when you are out of credits, but never for a chat that used your connected accounts: see below). Google may use messages its free Gemini models answer to improve its products, and its human reviewers may read them, so don't share personal or sensitive information in chats on free models. Free Gemini models never answer people in the European Economic Area, the UK or Switzerland. Flash's Mistral account is set so Mistral doesn't use these messages to train its models.
OpenAI (ChatGPT models, for writing, code, translation and documents when you pick one in the Intelligence menu, or on Auto when a ChatGPT model answers for far fewer credits; for writing, code, apps and slides when Claude is busy or down; and images when that feature is available)
ElevenLabs (voice, music and transcription, when those features are available)
fal.ai and the model makers it serves (image, video, music, voice and transcription models, when those features are available)
Replicate and the model makers it serves (videos, only when fal.ai can't make one)

When you buy a domain in Flash, the registrant's name, address, email and phone you give at checkout are sent to Name.com, Inc., our registrar partner, and to the registry for that ending, to register the domain in your name, as ICANN requires. Flash keeps them with the order. Name.com emails the registrant to confirm them.

With each chat request, Flash also tells the AI provider answering it (Anthropic, OpenAI or a free-model provider) your approximate city, country and time zone, taken from your internet connection and device, so the answer fits your date, time and place. Your coordinates aren't sent to them.

For a ChatGPT answer, Flash turns off OpenAI's storage of the answer, and sends OpenAI a scrambled number for your account instead of your name or email, so OpenAI can spot misuse without knowing who you are. On Auto, a ChatGPT model answers only two kinds of request: a quick question in a very long chat, which it reads for far fewer credits, and a request Claude can't take because it is busy or down. On a Flash level you pick in the Intelligence menu, a ChatGPT model answers only when Claude is busy or down. The reply's header names the model that answered.

When a chat has your connected accounts turned on, Flash sends Claude's requests (what it searches for, or what it creates or changes) to those services with your key, and sends what they return to Anthropic to write the answer. Nothing goes to an account you haven't turned on in that chat, and Anthropic doesn't use it to train its models. What they return, and the answers Claude writes with it, go to no other AI provider: a chat with a reply that used your connected accounts is never answered by the free models or by ChatGPT, even after you turn the accounts off (start a new chat for those), and Flash's companion (Ask Flash) isn't shown that chat's messages. You can turn an account off in any chat, or remove it in Settings > Connectors, which deletes the key and its tools from Flash. Removing it doesn't cancel a key at the service itself: do that in your account there if you no longer want it to work. For an account you connected by signing in, Flash also asks the service to cancel the access you gave it, where the service offers a way to; where it doesn't, Settings says so, and you cancel it in your account there. You can always check or cancel it there too.

For weather questions, Flash's server asks MET Norway (the Norwegian Meteorological Institute, api.met.no) for the forecast. It sends only the place's coordinates, rounded to about 1 km: no account, name, IP address or other personal data. Flash keeps each forecast for up to 2 days, stored by place and not by person, and anyone asking about the same place gets the same copy.

Some answers look things up in public sources, from Flash's server and without your account, name, email or IP address. For questions about current events, Flash searches the web through its own search server (SearXNG), which passes the search on to public search engines: it sends the search words written for your question, which can include words from your message, and your language. For a listed company's filings or reported figures, Flash asks the U.S. Securities and Exchange Commission's SEC EDGAR (sec.gov), sending only the company's ticker, name or SEC number. For economic data, Flash asks FRED® (the Federal Reserve Bank of St. Louis's economic data, api.stlouisfed.org), sending only the series or the words searched for. Flash keeps what they return for a short time (web results for 10 minutes, company and economic data for up to a day), stored by request and not by person, and anyone asking the same thing gets the same copy. To apply the daily limit on free web searches, Flash counts how many each account makes in a day, but not what they were. This product uses the FRED® API but is not endorsed or certified by the Federal Reserve Bank of St. Louis.

We also use Stripe for payments (when paid plans are available), Resend to send account emails (email confirmation and password reset) and the results you ask an automation to email you, Slack to carry the notes you turn on for your automations, and a database and hosting provider to store your data. Each provider processes data under its own terms and privacy policy. Some are based in the United States, so your data may be processed outside your country.

Google user data

When you connect Google Drive in Settings > Connectors, you sign in at Google, never in Flash, and Google asks whether Flash may see your email address and use the Google Drive files you pick with Flash (Google calls this the drive.file permission). Here is exactly what Flash does with it:

Only the files you pick. Flash can open only the files you choose with Google's own file picker (“Add from Drive”), and the Docs, Sheets and Slides it creates for you. It can't see, list or search anything else in your Drive. Settings > Connectors lists every file it can open.
Only when you ask. Flash reads one of these files only to answer you in a chat where you turned Google Drive on. It creates a Doc, Sheet or Slides deck, adds rows to a Sheet or adds text to a Doc, only after you approve a card that shows exactly what will be written.
Sent only to write your answer. The text of a file Flash reads is sent to Anthropic only so Claude can write the answer to your request. Anthropic doesn't use it to train its models. The answers Claude writes with it go to no other AI provider either: a chat that used Google Drive is never answered by Flash's free models, even after you turn Google Drive off, and Flash's companion isn't shown it. Flash gives it to nobody else, and nobody else sees it unless you share that chat yourself.
Never for training or ads. Flash doesn't use your Google data to develop, improve or train AI or machine-learning models, its own or anyone else's. It doesn't sell it, use it for advertising, or give it to data brokers. No person at Flash reads it, unless you ask us to look at a specific file, it's needed for security (such as investigating abuse), or the law requires it.
No copy of your Drive. Flash doesn't copy your files: it reads a file from Google each time it uses it. What it read from a file to answer you is, like any tool's result, saved in that chat with the reply, and with an approval as described under “Your connected accounts” above. Flash also keeps your Google account's email address (to show which account is connected), the name, type and ID of each file you picked or it created for you, and the access Google gave it (its tokens, stored encrypted).
Removing access. Forget a file in Settings > Connectors and Flash can't open it in chat any more. Remove Google Drive there and Flash asks Google to cancel all the access you gave it, and deletes its tokens and your list of files. You can also remove Flash AI at any time from your Google Account, under Third-party apps & services.

Flash AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace user data and developer policy.

Figma and Canva

When you connect Figma or Canva in Settings > Connectors, you sign in there, never in Flash. Flash keeps the access they give it (stored encrypted) and the account's email or name, to show which account is connected. In Figma, Flash only reads the files and frames you link to in a chat where Figma is on, and can't change anything. In Canva, Flash finds, reads and exports your designs when you ask in a chat where Canva is on, and adds a picture to your Canva uploads and starts a design with it only when you press Open in Canva. What Flash reads is sent to Anthropic only so Claude can write your answer, is never used to train AI models, and is given to nobody else. Remove Figma or Canva in Settings > Connectors to delete Flash's access (Flash also asks Canva to cancel it; in Figma, remove Flash AI from your connected apps too).

When you connect a social account in the Social hub (X, YouTube, Google Business Profile, Pinterest, Facebook, Instagram, Threads, Bluesky, Mastodon or Telegram), you sign in there, or give Flash an app password or token you made there. Flash keeps that access (stored encrypted), the account's name and picture, the posts you write or plan in Flash, and the comments, mentions, messages and reviews it reads for your Inbox. Flash posts only what you ask it to, when you ask, and answers only with the words you write. None of it is used to train AI models or given to anybody else. Remove an account in the Social hub to delete Flash's access and what it kept for it (Flash also asks the network to cancel the access where it can). If you remove Flash in your Facebook, Instagram or Threads settings, Flash stops using those accounts; if you ask Meta to have your data deleted, Flash deletes them and what it kept for them. YouTube is used under the YouTube Terms of Service and the Google Privacy Policy; you can also remove Flash's access to your Google account at Google's security settings.

How long we keep it

We keep your account and projects until you delete them or ask us to delete your account. Billing records are kept as long as tax law requires. Weather forecasts are kept for up to 2 days, web search results for 10 minutes, and company and economic data for up to a day. Visit codes, and the keys that make them, are deleted after 2 days. Daily totals of visits, steps and sales by source are kept for 100 days.

Your choices and rights

You can edit or delete projects and your memory note in the app. Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to how we use it. Email contact@flash-app.dev and we'll respond within 30 days.

Cookies

Flash uses essential cookies to keep you signed in to your accounts and to warn you by email about sign-ins on a new browser. We don't use advertising or tracking cookies. If you open a friend's referral link (one ending in ?ref=), Flash keeps their referral code in a cookie called flash_ref for up to 30 days, only so your friend gets credit if you sign up; it's deleted as soon as your account is created. Counting visits to published apps uses no cookies.

Children

Flash is only for people aged 18 and over, and we don't knowingly collect data from anyone younger.

Changes

We'll post updates here and tell you about important changes by email or in the app.

Contact

Privacy questions: contact@flash-app.dev.