Privacy policy

Who we are and how to contact us

Flitten operates flitten.com, Flitten Prompts at prompts.flitten.com, Flitten Pages at pages.flitten.com, and Flitten Resources at resources.flitten.com. This is the privacy policy for the Flitten application named on the Google consent screen. Prompts and Pages have separate accounts, databases, access grants and sign-in sessions.

For privacy questions, access or correction requests, account closure, or deletion of your information, email support@flitten.com from the Google email associated with your account. Tell us which product your request concerns. We may verify account ownership before acting. For subscription and payment arrangements, contact +880 1810-529413 on WhatsApp.

Google account information we access

Prompts and Pages request the openid, email and profile sign-in permissions. Google provides your unique account identifier, email address and its verification status, display name, and available profile picture. We use the verified email and identifier to recognize your account and check its access grant. We use your name and available picture to identify your session or display your profile; account records store the fields needed by each product.

Flitten does not receive your Google password. These sign-in permissions do not give us access to your Gmail messages, Google Drive files, contacts, calendar, photos library or payment details. Flitten does not request Google Workspace content permissions. A Google account and an active grant for the selected product are required for its private workspace. The marketing homepage, this policy, and Resources can be viewed without signing in.

Optional Google AI authorization in Prompts

Signing in and connecting AI are separate actions. When you choose Connect AI in Prompts, we request the https://www.googleapis.com/auth/generative-language.retriever permission to authorize supported Google generative-language functionality. We receive OAuth access credentials and, when Google issues one, a refresh token that keeps your requested connection working. This connection is used for Gemini model discovery and generating the planning responses you request; it is not used to read Gmail or Drive content.

For an AI request we send Google the relevant idea, answers, project requirements, revision instructions and context needed to suggest questions or features or generate your build prompt. Avoid placing sensitive personal information, passwords or private credentials in that content. Your Google profile is used for authentication, not automatically added to planning content. Information you deliberately include in your idea or answers can be part of the AI request.

Google processes those requests under its applicable Gemini service terms and privacy practices. Connecting AI is optional; without it, AI planning functions are unavailable. Pages does not use the Prompts AI permission and does not send uploaded website files to AI for inspection or building.

Other information we collect

Prompts stores the ideas, answers, project decisions, features, generated prompts, saved versions, settings and usage records needed to operate your workspace. It also stores subscription expiry and administrative access records.

Pages stores account and access records, website names and globally unique addresses, uploaded HTML or ZIP drafts, inspection results, finished website files, publication state, storage totals and upload-check counters. Website files you publish at sites.flitten.com are public and can be copied by visitors. Unpublished drafts are private to your account and authorized service administration.

Support and manual payment verification can involve your contact details, correspondence, payment reference and transaction confirmation. We do not operate a card checkout on this website. Do not send payment PINs, passwords, card security codes or one-time verification codes.

Our servers and infrastructure providers can process IP addresses, request URLs, browser headers, timestamps, security events and diagnostic information when you visit or use the services. These support delivery, troubleshooting, rate limiting and abuse protection.

How and why we use information

We use Google account information to authenticate you, create or recognize your product account, enforce its subscription and permissions, identify your session, and respond to support requests. We use your submitted content to save and resume your work, generate the AI output you request, or publish and manage your selected website files.

We use account, upload and operational records to verify manually arranged payments, administer access, enforce storage and upload bounds, diagnose faults and protect users and the platform. We do not sell or rent personal information, build advertising profiles from Google user data, or use Google user data for credit or lending decisions. No advertising or analytics trackers are installed on the marketing website.

Where applicable law requires a lawful basis, we process information as needed to provide the requested service, protect its security, meet legal obligations or follow your consent for optional processing. If we introduce a materially different use of Google data, we will update this policy and obtain any consent required before that new use.

Who receives information

Google receives sign-in and authorization requests and the planning content sent for your requested AI functions. Cloudflare provides public website hosting, R2 object storage, network routing and traffic protection, and can process stored website objects and ordinary network request information. Our hosting server and PostgreSQL databases store account, project, access and publication records. These providers receive information necessary to deliver the relevant service, rather than permission from Flitten to use Google user data for unrelated advertising.

Authorized Flitten administration can manage access grants and review service information necessary for support or security. Time-limited support impersonation allows administration to view an account workspace, including its saved content. Pages support impersonation is read-only; support access is restricted to authorized administration.

We may disclose information when legally required, to address fraud or security incidents, or to protect the rights and safety of users or Flitten. We do not share Google user data with data brokers or advertising networks. Public website files are disclosed to visitors because the publisher chose to publish them.

WhatsApp handles communications sent through its links under its own privacy practices. Website publishers can include third-party scripts, forms or embeds; those integrations may collect visitor data independently and the publisher must provide the appropriate notices and permissions.

Google user data and Limited Use

Flitten follows the Google API Services User Data Policy, including its Limited Use requirements, for data received from Google APIs. We use that data to provide and improve the user-facing features described here. Transfers are limited to delivering those features, an applicable legal obligation or necessary security protection; we do not transfer it for advertising or unrelated profiling.

Flitten does not use Google account data to develop, improve or train generalized or non-personalized AI or machine-learning models. We do not access Google Workspace content APIs or use their data for model training. Sending your supplied planning content to Gemini to fulfill your requested response is separate from training an AI model with your Google account data.

The applicable Google policy is available at https://developers.google.com/terms/api-services-user-data-policy. Google’s privacy policy is available at https://policies.google.com/privacy.

How we store and protect information

Public service connections use HTTPS. Product authentication uses encrypted, host-scoped session cookies, with Secure and HttpOnly attributes in production, and state and PKCE checks for Google OAuth. Sign-in sessions have a maximum configured lifetime of seven days, and authenticated actions also check access and subscription status on the server.

The separate Prompts AI authorization is stored on the server encrypted with AES-256-GCM. OAuth credentials and R2 write credentials are not included in frontend bundles. Access to private records and administration is restricted, and uploaded archives are checked for unsafe paths, file bounds and unsupported content before publication. Public delivery is isolated from management sessions.

These measures reduce risk but cannot guarantee absolute security. Hosting and service providers may process information in countries other than your own, depending on their infrastructure. Contact support@flitten.com if you suspect unauthorized access and revoke affected Google permissions promptly.

Retention, expiry and deletion

We retain account, access, saved project and website records while needed to operate your account and fulfill the purposes above. Subscription expiry blocks access but does not automatically erase saved data. We retain payment, audit, security or dispute records when reasonably needed for those purposes or applicable legal requirements; they are not retained for unrelated advertising.

Private Pages upload drafts expire after 24 hours and are cleaned when their owner opens the workspace; publication or discard removes the corresponding draft. Deleting a website removes its address and hosted release, and updating it replaces the old release. Project deletion removes that project from the active Prompts workspace.

Stored AI authorization is retained while the AI connection remains enabled. Disconnecting it removes Flitten’s stored authorization and attempts to revoke its refresh token with Google. Deleting browser cookies or signing out does not delete server records.

To request deletion of an account and its Google-linked data, email support@flitten.com from its registered email, identifying Prompts, Pages, or both. After verifying ownership we remove the relevant active account data and stored authorization, except records we must retain for a legitimate legal, security or dispute purpose, which we explain when applicable. Copies in provider logs, backups or browser caches can remain until those systems replace or expire them; Google and other providers handle their own records under their policies. No automatic account-deletion timer or fixed backup-erasure deadline is offered.

Your choices and control

You can disconnect AI in Prompts, delete projects or websites using product controls, sign out, and request access, correction, export or deletion through support@flitten.com. To withdraw Google authorization, visit https://myaccount.google.com/connections and remove Flitten. Revoking Google authorization does not itself erase previously saved Flitten content; contact us for account deletion.

You can manage cookies and local storage in your browser, and use Cookie settings on this website to change optional preferences. Blocking essential session cookies can prevent sign-in. A request for privacy support does not require purchasing additional access.

Cookies, Resources and third-party links

Prompts and Pages use separate essential authentication and security cookies. The marketing site uses local storage to remember cookie choices for up to 180 days and stores optional motion preferences only when permitted. See the Cookie policy at https://flitten.com/legal/cookies/ for details.

Many Resources tools process selected files locally in your browser. Tools using external APIs transmit their requested inputs to those providers. Books and covers load from cdn.flitten.com through Cloudflare R2. Reader preferences, progress and saved tool selections can remain in local browser storage until reset or cleared. Resources does not require a Google or paid product account and has no advertising scripts.

External links and customer-published websites follow their own privacy notices. This policy covers Flitten’s operation of the platform, not every publisher’s use of visitor data.

Children and policy updates

Flitten is not intended to collect personal information from children. Do not submit sensitive information about children in ideas, files or support messages. If you believe a child’s information has been provided improperly, contact support@flitten.com so we can investigate and take appropriate action.

We publish the current policy and its updated date on this public page. Material changes in how we use Google user data will be disclosed here and, where required, through an in-product notice or renewed consent before the changed processing.

Operator and contact

Flitten

Privacy and support: support@flitten.com