This page records changes to our terms of service, privacy policy, community guidelines, and related policies. Current versions are linked in the footer.
5 October 2026
The privacy policy and the terms now link to our roadmap for end-to-end encryption plans instead of describing them, since the plans changed: end-to-end encryption will be required for calls, personal notes, direct messages, and group DMs. Nothing is end-to-end encrypted yet, and both documents still say so.
The privacy policy, the terms, and the help articles no longer describe a 14-day recovery window for deleted communities and channels. We had planned one, but it does not exist yet and we are still deciding how it should work. For now, deleting a community or channel removes it right away.
The privacy policy and the data retention article now describe more accurately how phone verification works, which security records we keep and for how long, that the apps send no usage analytics or crash reports, and what we keep when you donate. The terms and the privacy policy now say we run no generative AI over your content, to match the image classifier they already described.
Smaller fixes: no help article or policy mentions a message-deletion option when closing an account, because there is none, so delete messages first if you want them gone. The privacy policy links to the push relay notice and no longer lists bot prevention as a reason to share data. The push relay notice lists exactly what the relay records. The community guidelines give the keyword for the Irish crisis text line. The company information page cites Articles 11 and 12 of the Digital Services Act. The privacy policy now says that when an account belongs to someone below the minimum age, we schedule it for deletion, as we already do.
The terms, the privacy policy, and the community guidelines no longer repeat each other, and each topic now lives in one place with links from the others, with nothing changed in substance. We also rewrote the policies in plainer language, again with nothing changed in substance.
The privacy policy now makes it a binding commitment that Fluxer shows no ads, has no advertising partnerships, and never sells, rents, or shares your personal data with anyone for their advertising or marketing, and it explains more clearly when we tell you about a legal request for your data, with a narrower emergency exception. The push relay notice now says how long the relay's records are kept, and the community guidelines now say that adult sexual exploitation is reported to law enforcement on the same conditions as other serious harm, and that copyright notices are an exception to reporter confidentiality, as the terms already said.
None of these changes reduces your rights, adds a new use of your data, or asks anything more of you. They make the documents describe what we actually do, so you can rely on them, and they leave how we handle your data unchanged. Because they are neutral or in your favor, they took effect when published, as section 9 of the terms and section 15 of the privacy policy provide.
2 October 2026
The privacy policy now says that we never ask for or accept ID documents, selfies, or biometric scans to check anyone's age. Support no longer corrects dates of birth or reviews ID for age appeals.
30 September 2026
IPinfo was removed from the privacy policy because we no longer use it.
29 September 2026
hCaptcha was removed from the privacy policy because we no longer use it. We now use ALTCHA, a privacy-preserving challenge that runs on our own servers.
27 September 2026
We published a push relay notice alongside the privacy policy. It explains what Fluxer and others can see when the official app receives notifications from an instance we do not operate, and it applies only when both you and your instance operator turn the relay on.
13 September 2026
Bunny.net was removed from the privacy policy's provider list because it no longer delivers user-generated files or processes personal data on our behalf.
12 August 2026
We rewrote our policies to be shorter and easier to read. Nothing in this update reduces a commitment we had already made to you, adds a new purpose for your personal data, or changes how long we keep it.
25 April 2026
The privacy policy was updated to explain that phone verification is used for suspicious registration checks, not as a general identity or account-linking system. Phone numbers used for verification are not linked to Fluxer accounts or user IDs, and a successful verification stores only a has_verified_phone account flag.
To prevent reuse, an encrypted marker is kept for about 30 days, allowing the same number to verify at most twice in that period, with the encryption keys rotated roughly every 30 days. SMS 2FA is not available for accounts registered on or after 25 April 2026.
18 April 2026
The privacy policy was updated to match current providers, hosting, retention, and content safety practices. None of it added a new purpose for personal data or a new category of data leaving Fluxer.
Cloudflare, OVHcloud, Hetzner, Better Stack, and Sentry were removed from the provider list because they no longer process personal data, and Porkbun because it only handles domain registration. The separate Backblaze entry went too: off-site backups are still kept for disaster recovery, but they're encrypted with keys only we hold, so the provider can't read, index, or otherwise process them and isn't a sub-processor under GDPR Article 28. IPinfo was limited to network risk checks that use only the IP address, with no account context.
The update recorded that stored data and user files are hosted with Vultr in New Jersey, that calls may be relayed through Vultr locations worldwide, and that Bunny.net delivers user content on fluxerusercontent.com. It also set the 24-hour disaster recovery window for deleted attachments and the one-year limit for reported content snapshots, and confirmed that content safety classification never trains an AI model.
2 April 2026
The terms of service were updated to say Fluxer must not be relied on for military, emergency response, healthcare, utilities, sanitation, transport, or other safety-critical or critical infrastructure use.