1. Who we are
This policy covers the official Fluxer instance, apps, APIs, and websites operated by Fluxer Platform AB. Fluxer is open source, so if you use an instance hosted by someone else, that operator is the data controller for it and publishes its own privacy notice.
For the official service, Fluxer Platform AB is the controller of your personal data under the General Data Protection Regulation, supervised in Sweden by the Swedish Authority for Privacy Protection (IMY). Our legal identity, registered address, representative, and every contact route are on our company information page.
We have not appointed a formal data protection officer under GDPR Article 37 or a UK representative under UK GDPR Article 27. We keep both under review and will update this section if that changes.
2. What we process
2.1 What you give us
Creating an account requires an email address, a username, a password, and your date of birth. Profile details such as an avatar, display name, and bio are optional. Passwords are hashed with Argon2id, so even we cannot read them.
Your content is what you create and share: messages, files, images, reactions, communities, and profile information. Calls need connection information to work, and call media is encrypted in transit (section 9). Sharing your screen also creates a small preview thumbnail by default, so that people permitted to join the call can see what is being shared. You can turn the preview off when you start sharing.
If our anti-abuse checks restrict an account, we may ask you to verify a phone number to lift the restriction. We email you a one-time code, and you text it from your phone to our verification number. Section 7.2 explains the little that is kept afterwards.
Our support team handles support messages and their attachments in helpdesk software we host on our own infrastructure, so no third-party support provider processes them. Stripe processes payments, so full card numbers never reach us. We receive only what is needed to record and manage a purchase, such as billing country, partial card details, payment status, and dates. If you donate, we keep your email address, your Stripe customer and subscription details, and any business name and tax ID you provide, so you can manage your donation and we can keep accounting records.
We do not ask for special category data such as health, religion, ethnicity, sexual orientation, or political views. If you choose to include something like that in a message or profile, we will not use it to profile you, target you, or treat you differently.
2.2 What we collect through use
Technical information covers the IP address you connect from, device and browser details, operating system, language, and similar connection data. We keep server-side request metrics, error logs, and aggregate performance measurements so the service stays reliable. They are built from request and error information, not from message or file content.
The apps send no usage analytics, screen tracking, or crash reports. To understand how Fluxer is used, we look at counts drawn from our own service records, such as sign-ups and active accounts, alongside the aggregate service metrics above. Message content is never read to produce any of this.
Security records cover sign-in attempts, account changes, rate limit events, service errors, and signals used to spot spam, fraud, abuse, or unusual activity. We record the connecting IP address against security-relevant events such as sign-ins and file uploads and keep those records for the periods in section 7. Some security records last as long as your account: your most recent IP address, the IP address, country, and browser details from when you created the account, and the IP addresses you have approved for sign-in. The IP address and country of each signed-in session are kept while the session lasts and for 30 days after it ends. If a community bans you, the ban stores the email address on your account and the IP address you last used so it can be enforced, until the ban is lifted or your account is deleted.
Fluxer has no advertising trackers, no third-party analytics SDKs, no cross-site tracking pixels, and no browser fingerprinting, and we do not build behavioral profiles or track which other sites you visit.
2.3 What we receive from others
Other users create data involving you when they mention, message, add, report, or otherwise interact with you. Service providers return limited operational information, such as email delivery status, the verification texts you send to our number, payment and fraud signals, and infrastructure alerts. Public sources occasionally supply narrow security signals, such as the reputation of an IP address. We combine all of this with what we collect directly only to run, secure, and support Fluxer.
3. How we use information
We use personal data to run accounts and communications, provide support, process payments, prevent abuse, enforce our rules, keep the service reliable, comply with the law, and protect users, the public, and Fluxer.
We do not use your content for advertising, behavioral profiling, AI training, or commercial research, and we do not sell, rent, license, or broker it. Fluxer shows no ads, has no advertising partnerships, and never sells, rents, or shares your personal data with anyone for their advertising or marketing.
3.1 Legal bases
Where the GDPR or similar law applies, our processing rests on the following grounds.
Contract necessity, under Article 6(1)(b), covers what is needed to deliver the service you signed up for: delivering messages, running communities, managing your account, processing purchases, and providing support.
Legitimate interests, under Article 6(1)(f), cover security, fraud prevention, service reliability, limited analysis of how the service is used, and messages about changes to the service or these policies. Each activity has a documented assessment of its purpose, its necessity, and the balance against your rights, and none of it is used for advertising. You can object at any time, as described in section 10.
Legal obligations, under Article 6(1)(c), cover accounting and tax duties under Swedish law, valid requests from public authorities, and compliance with data protection, security, and consumer law.
Consent, under Article 6(1)(a), covers the small set of processing that needs it, such as optional communications. You can withdraw consent at any time, and doing so does not affect earlier lawful processing.
3.2 Approximate location
We derive an approximate city, region, and country from your IP address for sign-in alerts, session information, fraud prevention, regional age rules, sanctions compliance, and other legal duties.
Some countries demand age-verification methods we do not offer, such as government ID uploads or biometric scans, and access there may be restricted. Some regional access decisions are automated and rely on approximate location, such as IP geolocation, because we never ask for or accept ID documents, selfies, videos of your face, facial age estimation, biometric scans, or any other document to check your age. Travel, VPNs, and unusual network setups can produce the wrong outcome. If you think a restriction is wrong, use the privacy route on our company information page. We acknowledge it promptly and have a person review it while your access stays as it is. You can share your point of view at any stage, and we send you the outcome with our reasoning. Current restrictions are listed on our regional restrictions page.
4. Who receives data
We do not sell, rent, trade, or license your personal data to anyone, and we share it only in the situations below.
4.1 Sharing you choose
Messages and files go to the people and communities you select, your profile is visible according to your choices, and integrations you connect receive only the access you grant. The optional stream preview is visible only to people permitted to join the call. Remember that recipients can save or pass on what you share, so be deliberate about what you send and to whom.
4.2 Our service providers
A small set of providers processes data on our behalf. Each is reviewed for privacy and security before we use it, acts only on our instructions, and is bound by a data processing agreement under GDPR Article 28.
Vultr hosts the service and relays call traffic, which is encrypted in transit. Stripe processes payments. Sweego, hosted in the EU, sends transactional email, and Twilio receives the texts sent to our phone verification number.
If you turn on push notifications, we send device push tokens and message, call, or event identifiers to the services that wake your device: Apple Push Notification service, Google's Firebase Cloud Messaging, or your browser vendor's push service. They never receive notification content. When the official app receives notifications from an instance we do not operate, our push relay notice also applies.
Google provides YouTube embeds, and Klipy provides GIF search, as section 13 describes. Error monitoring and observability run on infrastructure we control, and no application errors or crash data go to any third-party monitoring service.
We keep this list current and note material changes in our changelog. A few providers act as independent controllers when you deal with them directly, for example Google when you play a YouTube video, and their own policies then apply alongside ours.
4.3 Law, safety, and business changes
Beyond that, personal data leaves Fluxer only to comply with a valid legal obligation, legal process, or enforceable governmental request, to enforce our terms of service and other agreements, to protect the safety, rights, or property of users, the public, or Fluxer, or to detect and deal with fraud, security, or technical issues.
If Fluxer Platform AB is reorganized, acquired, or sold, personal data may transfer with it. Where legally permitted, affected users get at least 30 days' advance notice and a chance to delete their account and request deletion of their data first. Any recipient must keep honoring this policy unless you affirmatively agree to a replacement, and data will not go to any entity that refuses those protections.
5. Content safety
Fluxer runs no generative AI or LLM inference over your messages, files, or calls. For explicit content preferences we use OpenNSFW2, a small pretrained image classifier running on Fluxer-operated infrastructure. It is not a generative AI system or an LLM. Given an image, it returns a single probability that the image is explicit, and it cannot read text, remember, or learn. It runs on unmodified published weights with no external API call, and nothing it sees or produces enters any training pipeline. The result is used only to respect explicit content preferences and to restrict flagged media to users aged 18 or over. It does not punish accounts, and no report is filed.
Other automated protections work from narrow metadata and patterns, such as message frequency, link structure, account age, IP reputation, email domain, and client details, to spot spam, coordinated abuse, and account compromise. They do not use message bodies or file contents, and they feed no advertising or behavioral profiles.
Authorized staff may review specific stored content when needed to investigate a report, enforce policy, or respond to a credible safety issue. Access is restricted by role and recorded in an audit log, so every access is attributable and reviewable.
Where processing may create a high risk to people's rights, we conduct data protection impact assessments, as GDPR Article 35 requires. Two are complete: the explicit content classifier and the automated regional access decisions in section 3.2. Each examines necessity and proportionality, identifies risks, and records the measures that reduce them. We revisit them when processing materially changes or on a regular schedule, whichever comes first.
6. Where data lives
We host most stored account information, messages, communities, files, and other content with Vultr in Piscataway, New Jersey. Call traffic may pass through Vultr locations worldwide so calls route near the participants, and it is encrypted in transit. Encrypted disaster recovery copies are kept separately, and only Fluxer holds the keys to read them.
Hosting data in the United States brings it within reach of lawful access requests under US law, including the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), under which a provider subject to US jurisdiction can be required to produce data in its possession, custody, or control even if stored elsewhere. We treat that as a real privacy issue, factor it into our transfer assessments, provider reviews, and legal request procedures, and keep looking at ways to rely less on US-hosted infrastructure. If regional hosting ships, we will explain what it changes, what it does not, and which legal regimes still apply.
Personal data may be processed outside your own country, including in the United States and Canada. Our data processing agreements include standard contractual clauses approved by the European Commission or UK authorities, kept in place even where another transfer mechanism would apply, and are backed by transfer impact assessments for each destination, encryption in transit and at rest, access controls, audit logging, and contractual limits on provider use. These measures reduce risk, but for data that our servers must be able to process to run Fluxer, they cannot make lawful access impossible. Your data is never transferred to any third party for that party's own advertising or marketing.
7. Retention
We keep personal data only as long as it is needed for the purposes in this policy, legal obligations, disputes, and enforcement. Data that is no longer needed is deleted or anonymized.
7.1 Active accounts and content
Account information, messages, communities, and other content are kept while your active account needs them. Attachments may expire based on factors such as size, age, and use, and items in saved media are not subject to ordinary expiration. Details are in the attachment expiration guide. Optional stream previews stay available for at most 24 hours after the latest upload, and only to people permitted to join the call.
7.2 Phone verification
Phone numbers used for verification are not stored on your account. The text you send us, including your number, is deleted from our own systems within 24 hours, and the account records only that verification happened.
To stop one number lifting restrictions on many accounts, we keep a one-way record of the number together with the account it verified for about a month at most. It is never used for SMS two-factor authentication, recovery, advertising, profiling, contact discovery, or linking accounts.
7.3 Deletion
Deleted messages and account data normally leave active use within minutes. Encrypted disaster recovery copies may hold them for up to 30 days, without any active processing or use for any purpose, until scheduled deletion. Deleted media normally leaves active use within hours, though we may keep a hidden copy of each deleted attachment for up to 24 hours before final erasure. Users cannot see that copy. Only authorized operators can restore it, and only in a genuine disaster recovery situation. Deleted media is not included in longer-term backups, and CDN-cached copies are purged as soon as possible after deletion, though rate limits and global propagation can add short delays. An erasure request under GDPR Article 17 is complete once the data has left active systems and backup cycles. Longer retention applies only where the law requires it, for example under bookkeeping and tax rules or a legal duty to preserve evidence, and only to the extent and for as long as that obligation requires.
Deleting a community or channel removes it and everything in it (messages, attachments, roles, settings, and other associated data) right away, and it cannot be restored. Its data then leaves our systems through the procedures above.
Accounts with no sign-ins or other meaningful activity for 2 years may be scheduled for deletion, with advance notice to the registered email address. Messages you previously shared with others may stay visible unless you delete them first. The account deletion guide has the current criteria and timelines.
7.4 Other retention periods
Payment and transaction records are kept for at least 7 years, as Swedish bookkeeping law (Bokföringslag 1999:1078) requires, and longer only where needed for legal compliance, disputes, or fraud prevention. Full card numbers are never stored.
Security and usage logs are kept for up to 90 days in normal conditions, then deleted or anonymized. Specific records may be kept longer only for an active security investigation, a binding legal obligation, or an ongoing dispute, and are deleted once that reason ends. Administrative audit records of enforcement decisions and account changes are kept as long as accountability, appeals, disputes, and legal compliance require, and are reviewed periodically.
When content is reported, we may preserve a snapshot of the reported item, relevant surrounding context, attachments, and report details, even if the original is later deleted, so that investigation and appeal remain possible. Snapshots are stored separately from ordinary user content, are never served to users, indexed, or exported, and are readable only by authorized staff, with every access recorded. They are deleted after at most 1 year, unless a binding legal obligation requires specific material to be kept longer.
Content removed or disabled under a valid order under Regulation (EU) 2021/784 on terrorist content, and related data, is preserved for 6 months, or longer where applicable law requires. Generated self-service export files are kept for up to 7 days.
8. Your controls
The Privacy section in User settings lets you request an export and delete messages at any time. You can schedule account deletion in the Account section. An export is a ZIP archive of machine-readable JSON covering account, message, payment, relationship, session, security, preference, and profile information, with download links for attachments that are still available. Download anything you want to keep before deleting it or letting it expire.
Deleting a message also deletes its attachments. Bulk message deletion runs in the background and can take a while for large accounts. Scheduled account deletion can be canceled by signing back in during the grace period in section 6.1 of the terms. Current instructions are in our data export, data deletion, and account deletion guides.
For anything you cannot do in the app, use the privacy route on our company information page, writing from the email address on your account where possible. We may ask for the information needed to verify your identity.
9. Security
Technical and organizational measures protect your personal data against accidental or unlawful destruction, loss, alteration, disclosure, and unauthorized access. They include encryption in transit and at rest, access controls, security monitoring, physically secure data centers, patching and hardening, rate limiting, encrypted backups, and audit logging of access to user data.
Nothing on Fluxer is currently end-to-end encrypted. Your data is encrypted in transit between your device and our servers and at rest on our servers and backups. The service needs server-side processing to work, so our systems can technically access message content and call media while handling them. This means you are trusting Fluxer and our hosting providers to protect that traffic.
Our plans for end-to-end encryption of calls and of personal notes, direct messages, and group DMs are described in our roadmap. End-to-end encryption protects your call or content only once the feature covering it has launched, and we will announce each feature when it ships. Security vulnerabilities can be reported through our security page.
If a personal data breach happens, we investigate and take remedial steps. As GDPR Articles 33 and 34 require, we notify IMY within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people's rights and freedoms, and we explain the reasons if we notify later. We notify affected users without undue delay where the risk to them is high. Notifications explain what happened, what data is likely affected, the probable consequences, and what you can do to protect yourself.
10. Your rights
Depending on where you live, you may have the right to:
- access your personal data and receive a copy of it
- correct data that is inaccurate or incomplete
- have your data erased
- restrict processing in certain situations
- object to processing based on legitimate interests
- get your data in a structured, commonly used, machine-readable format (data portability)
- withdraw consent at any time without affecting earlier lawful processing
- get human review of automated decisions that significantly affect you, share your point of view, and contest the decision
If you object to legitimate-interest processing, it stops unless compelling legitimate grounds override your interests, rights, and freedoms, or the processing is needed for legal claims.
You can exercise these rights through your account controls or the privacy route on our company information page. We may need to verify your identity, and an authorized agent can act for you where the law permits. We respond within the period applicable law requires, usually within 30 days, or up to 45 where permitted. If we cannot fully comply, for example because of a legal obligation or another person's rights, we explain why and what options remain.
You can also complain to your data protection authority. In Sweden that is the Swedish Authority for Privacy Protection at imy.se, and in the UK the Information Commissioner's Office at ico.org.uk. The authority where you live is always an option too, and you are welcome to raise the issue with us first so we can try to fix it directly.
11. Children and age requirements
Section 1 of the terms sets the minimum age and when a parent or guardian must agree for you.
Users under 18 may get stricter privacy and safety defaults and limits on age-restricted features. Because nobody on Fluxer is profiled for advertising, minors are not either. We never ask for or accept ID documents, selfies, videos of your face, facial age estimation, biometric scans, or any other document to check anyone's age, and we cannot change a date of birth after sign-up. Where a legal framework demands methods we do not support, access is restricted as described in section 3.2 and on the regional restrictions page.
We do not knowingly collect personal information from children below the minimum age for their region, which in the United States means children under 13, in line with COPPA. If we learn that an account belongs to someone below the minimum age, we schedule the account for deletion, which deletes its personal data with it. A parent or guardian can use the privacy route on our company information page, and we may ask for proof of guardianship.
The Fluxer app sets no first-party cookies. Authentication and recent identity checks use request and response headers instead. Our marketing site sets one strictly necessary cookie, fluxer-locale, which remembers your language preference for 1 year. Strictly necessary cookies need no consent under the ePrivacy rules, and if we ever introduce a non-essential cookie we will update this section and ask for consent before setting it.
The app uses your browser's local storage for account switching, interface state, and preferences. Some preferences sync to your account so they follow you between devices, and everything else stays on your device.
Embedded YouTube content may set its own cookies when you interact with it, under Google's privacy policy.
We honor Global Privacy Control, though it changes nothing in practice because Fluxer does not sell or share personal information for advertising. We do not treat Do Not Track signals differently, because Fluxer does not track anyone across other sites in the first place.
13. Third-party content and links
GIF searches go to Klipy through our servers, so Klipy never sees your IP address or device identifiers. When a message contains a link, Fluxer may fetch the linked site from our servers to build a preview, so the site sees a request from Fluxer, not from your device. Those requests have a User-Agent containing Fluxerbot, and a site operator can block them, which stops previews and embedded media for that site appearing in Fluxer.
YouTube previews are fetched server-side, so your device does not contact YouTube until you press play. Playing an embedded video connects your device to Google, which may then process information under its own privacy policy, and other embedded content behaves the same way when you interact with it.
14. Legal requests
We review every request for user information carefully and put the privacy and security of the people involved first. We narrow or reject requests that are invalid or overbroad. Authorities should use the legal route on our company information page and identify the requesting authority, the legal basis, and the specific information sought. We notify affected users before we disclose their information, so they have a chance to object, unless the law forbids it. If the law forbids telling them at the time, we tell them as soon as that restriction ends. The only other exception is a genuine emergency, where we may disclose without prior notice if that is necessary to prevent death or serious physical harm. We then tell the affected users as soon as doing so no longer puts anyone at risk.
For call-related requests, connection information and, where one exists, the stream preview may be available, as this policy describes.
15. Changes to this policy
We may update this policy as our service, practices, or legal duties change. We record every update in our changelog and update the effective date at the top.
A change is material when it is adverse to you. That means it reduces your rights or protections, expands what we collect or how long we keep it, adds recipients or uses in ways that increase risk to you, or otherwise leaves you worse off than under the previous version. Material changes take effect no earlier than 30 days after we notify you by email, in the app, or both, so that before they apply you can review them, export your data, delete your messages, or delete your account using the tools in section 8. A change may take effect sooner only where the law requires it or it is urgently needed for security, and we then notify you as soon as we reasonably can and explain why. Where it is genuinely unclear whether a change is adverse, we treat it as material.
Changes that are neutral or in your favor, such as new protections, stronger encryption, or clearer descriptions of existing practice, take effect when published. Where such a change is significant, we tell you about it in the app or by email rather than relying on the changelog alone.
16. Contact
All privacy, support, legal, postal, and telephone contact routes are on our company information page. For account-related requests, write from the email address on your account where possible, because it makes verifying your identity easier and protects the account.
17. California disclosures
This section adds the disclosures the California Consumer Privacy Act requires and applies only to California residents, alongside the rest of this policy.
The personal information we collect falls into these categories:
- Identifiers: username, email address, user ID, IP address, device identifiers, and the phone number you text from during phone verification, which come from you, from automatic collection, and from service providers.
- Customer records under Cal. Civ. Code § 1798.80(e): billing country and partial card details, which come from you and Stripe.
- Internet or network activity: sign-in and session records, request logs, and browser and operating system details, from automatic collection.
- Geolocation: the approximate city, region, and country derived from your IP address, from automatic collection.
- Audio, electronic, or visual information: uploaded files, stream previews, and call traffic, which come from you.
- Inferences: regional eligibility results and spam or abuse risk signals, from automatic collection.
We collect no biometric, employment, or education information.
The only sensitive personal information we collect is your account login credentials, meaning an email address with a password, used to run and secure the service. California law also treats the personal information of consumers under 16 as sensitive, and we use it only to provide and secure the service, never for advertising or unrelated profiling.
We disclose identifiers, payment records, network and location information, push tokens, call traffic, previews, and uploaded files to the providers named in section 4, for hosting, delivery, payments, communications, push notifications, and security. Payment records go to Stripe. Call traffic is encrypted in transit through the relaying providers.
We do not sell personal information and do not share it for cross-context behavioral advertising. That applies to everyone, including users under 16.
California residents can request access, deletion, or correction, can limit the use and disclosure of sensitive personal information, can opt out of sale or advertising sharing, neither of which happens, and can act through an authorized agent where the law permits, all without being discriminated against for it. Requests go through your account controls or the privacy route on our company information page. Retention follows section 7, and Global Privacy Control is honored as described in section 12.