Last updated 29 October 2026
Privacy policy
In short
Flitdot moves notes, links, files, notifications, texts and clipboards between your own devices. Everything you send is end-to-end encrypted on your device: our servers store and relay ciphertext they can't read. The one exception is content you choose to send from a script with an API token, which our server encrypts when it arrives and which the apps mark “sealed by server”.
No advertising, no selling or sharing of personal data, no tracking across apps or sites.
What we store, and why
| Data | Why | How long |
|---|---|---|
| Your email address | Signing in with one-time codes | Until you delete your account |
| Devices: platform (for example Android), public keys, last-seen time | Delivering to your devices, pairing | Until the device is revoked or the account deleted |
| Encrypted pushes (notes, links, texts) and their metadata: size, time, which device sent to which | Syncing your devices | Until you delete them or your account |
| Encrypted mirrored notifications and shared clipboards | Syncing your devices | Notifications up to 24 hours; clipboards 2 minutes |
| Encrypted files | Delivering them | A week after all your devices have them, and at most 30 days |
| Encrypted scheduled pushes | “Send later” | Until delivered or cancelled |
| API tokens (stored hashed) | Scripts that send to you | Until revoked or the account deleted |
| IP addresses and request logs | Security, rate limits, running the service | A few days, in our host's logs |
We cannot see the content of anything you send: titles, file names, device names, notification text, phone numbers, contact names or clipboard contents.
Your phone's texts and notifications (Android)
Both are off by default. When you turn on Texts or notification mirroring, the app reads them on your phone and sends them, encrypted, to your own devices only: never to anyone else, never for ads or analytics. You can turn either off at any time in Settings.
Legal basis
We process your data to provide the service you signed up for (performance of a contract), and IP addresses and logs to keep it secure (legitimate interest).
Who processes data for us
Cloudflare hosts Flitdot: the servers, the database, file storage and the sign-in emails. Your account data and files are stored in Western Europe; Cloudflare's network may handle requests in other countries, including the United States, under the European Commission's standard contractual clauses and the EU–US Data Privacy Framework.
No other company receives your data. If that changes, this page will say so first.
Cookies
This website sets no cookies and runs no analytics. Signing in on api.flitdot.com uses one session cookie, which is needed for sign-in to work and lasts at most an hour.
Your rights
You can export your history from any of your devices, and delete your account at any time: in Settings in the apps, with flitdot delete-account, or at api.flitdot.com/delete-account if you no longer have a device. Deleting erases your history, files, keys, devices and account on our servers straight away.
If you're in the EU or the UK, you have the rights of access, correction, erasure, restriction, portability and objection. Write to privacy@flitdot.com and we'll answer within a month. You can also complain to your data protection authority (in France, the CNIL).
Children
Flitdot isn't meant for children under 15.
Changes
If this policy changes, the new version goes on this page with a new date, and anything that changes how your data is used is announced in the apps before it applies.
Contact
Questions about privacy: privacy@flitdot.com. Security issues: security@flitdot.com.