Privacy Policy

1. Introduction

FluxEngine ("we," "us," or "our") operates the FluxEngine platform at fluxengine.app (the "Service"). This Privacy Policy describes how we collect, use, store, share, and delete your information when you use our Service, including through integrations with third-party social media platforms.

By using the Service, you consent to the practices described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Account Information

• Email address, name, and authentication identity (Google OAuth identity, or short-lived sign-in codes/links delivered to your email — we do NOT store passwords)
• Account preferences and settings

2.1.1 Authentication & Account Identity

Your email address is your primary account identifier. We offer two ways to sign in: a short-lived 8-digit code (or matching one-click link) we email you on request, and Google OAuth. We do not use passwords. The following behaviors follow from this design:

• Identity linking by email: If you sign in with an email code and later sign in with Google using the same email address (or vice versa), both methods attach to the same FluxEngine account. You can sign in with either method going forward.
• Different emails = separate accounts: If you sign up with one email and later use a different email, you create two independent FluxEngine accounts. Data is not shared between them. When making a data-subject access or erasure request, please list every email address you have used.
• Inbox control = account control: Because sign-in codes and links are delivered to your inbox, anyone with access to your inbox can sign in to your FluxEngine account. We recommend enabling two-factor authentication on your email account — that is the single most important control you have over the security of your FluxEngine account.
• PKCE protection on email links: Email sign-in links are bound to the browser session that requested them, so the link only works in the same browser you started the flow in. This prevents inbox-scanner prefetchers (used by some mail providers) from accidentally consuming your sign-in token before you click. If you need to sign in from a different device, use the 8-digit code in the email instead.

2.2 Platform Data (via OAuth)

When you connect a social media account, we collect and process:

• OAuth access tokens and refresh tokens (encrypted at rest)
• Platform user identifiers (open ID, channel ID, page ID)
• Public profile information (display name, avatar URL)
• Account statistics (follower count, engagement metrics, video/post counts)
• Video and content metadata (titles, descriptions, view counts, like counts)

2.3 Content You Upload

• Video files and media uploaded through the Service
• Captions, descriptions, and metadata you provide
• Content fingerprints (SHA-256 hashes) for duplicate detection

2.4 Usage and Technical Data

• IP address, browser type, device information
• Pages visited, features used, and timestamps
• Error logs, stack traces, and performance data (via Sentry)
• Product usage events such as sign-ups, platform connections, and publish actions, tied to your internal account identifier (via PostHog)

Our product analytics tool (PostHog) operates in cookieless mode — it does not set cookies, use local storage, or persist identifiers across browser sessions. Events are linked to your internal account identifier (a UUID) so we can analyze usage patterns per user; your email, name, and other personal details are not sent to PostHog. We do not enable automatic pageview or click tracking; only the specific events listed above are captured. Our error tracking tool (Sentry) captures technical error data only and is configured to minimize personally identifiable information (PII) collection. Both tools process data exclusively in the European Union (see Section 11).

3. How We Use Your Information

We use your information solely to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Execute publishing, scheduling, and analytics features you initiate
• Display your social media metrics and growth history within the dashboard
• Detect duplicate content and prevent accidental re-posting
• Communicate with you about your account, security alerts, and policy changes
• Monitor errors, diagnose issues, and improve Service reliability (via Sentry)
• Understand aggregate product usage patterns to improve features (via PostHog)
• Comply with legal obligations

We do not use your data for advertising, profiling, or any purpose unrelated to providing the Service.

4. Legal Basis for Processing

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing conducted prior to withdrawal. Where we rely on legitimate interest, you have the right to object (see Section 8).

5. Third-Party Platform Integrations

The Service integrates with third-party social media platforms. Your use of each integration is also governed by that platform's own terms and privacy policies. We encourage you to review them:

6. How We Share Your Information

We do not sell, rent, lease, or trade your personal data.

We may share your information only in these circumstances:

• Platform APIs: We transmit data to and from the third-party platforms you connect (e.g., publishing a video to TikTok) solely to execute actions you initiate.
• Infrastructure providers: We use third-party hosting, storage, database, analytics, and error monitoring services that process data on our behalf under contractual obligations to protect your information:
  • Vercel — hosting and serverless compute (EU region: Dublin)
  • Supabase — database, authentication, and storage (EU region: Frankfurt)
  • Sentry — error tracking and performance monitoring (EU region: Frankfurt). Captures stack traces and request metadata; configured to minimize PII collection.
  • PostHog — product analytics (EU region: Frankfurt). Operates in cookieless mode with no session replay. Collects usage events (e.g., sign-ins, publishes, feature interactions) tied to your internal account identifier and post identifiers. Your email, name, and platform credentials are never sent to PostHog.
  • Resend — transactional email delivery (EU region: Frankfurt). Receives recipient email address, sender metadata, message subject and body, and a per-message tag. Used to send service-related email such as sign-in codes/links (via Supabase Auth), connector health notifications, and post-failure alerts. Resend uses Amazon Web Services (AWS) Simple Email Service as its underlying email-transport provider in the same EU region (Frankfurt, eu-west-1) as a sub-sub-processor.
• Legal compliance: We may disclose data if required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred. We will notify you via email and/or prominent notice on the Service before any transfer and before your data becomes subject to a different privacy policy.

7. Data Retention & Deletion

We retain your data only as long as necessary to provide the Service and fulfill the purposes described in this policy. When you disconnect a platform or delete your account, we delete the associated data immediately. The timelines listed below are maximum bounds required by each platform's API terms — in practice, deletion is typically instant.

Deletion includes: OAuth tokens, platform profile data, analytics and growth history, content fingerprints, uploaded media files, scheduled posts, delivery records, account-change audit history (e.g. records of past tier changes or email changes), and associated analytics events in PostHog. Anonymized, aggregated data that cannot identify you may be retained for service improvement.

Automatic Activity-Log Pruning by Tier

Distinct from the user-initiated deletion timelines above, FluxEngine automatically prunes activity-log entries — the audit-trail records that power your dashboard /activity page (records of posts published, accounts connected, comments received, and similar actions) — on the following schedule, even while your account remains active. Pruning is calculated from the timestamp the entry was created:

Grandfather rule: each activity-log entry is stamped with your tier at the moment it was written. If you later move to a lower tier, entries written while you were on a higher tier keep the higher-tier retention. New entries after the tier change get the new tier's retention. Your actual content (scheduled and published posts), connected social accounts, and billing records are NOT covered by this policy — they are retained until you delete them or terminate your account (subject to the legal-hold exceptions below).

Effective date: this tier-based activity-log retention takes effect 2026-07-18. Before that date, the previous uniform 90-day retention introduced for the activity feature continues to apply. The 30-day delay satisfies our Section 13 notice commitment for material policy changes.

Billing & Subscription Records — Limited Retention Exception

If you ever subscribe to a paid plan, the following billing-related records are retained in anonymized form after you delete your account, for the limited purposes listed below:

• Subscription state (plan, price, currency, billing cycle, status, period dates, cancellation timestamps)
• Audit log of subscription state changes (status transitions, plan changes, price changes)
• Payment-provider event log (webhook events from our payment processor, with personally-identifying fields redacted)

On account deletion, your user identifier is removed from all of the above records (they become structurally anonymous — we no longer have a way to associate them back to you). We retain them under GDPR Art. 17(3)(b) (legal obligation — Estonian accounting law requires retention of business records for 7 years) and Art. 17(3)(e) (establishment, exercise, or defense of legal claims — to defend against chargeback disputes initiated by your bank after account deletion).

The lawful basis for this retention is Art. 6(1)(c)(compliance with legal obligation) for the tax/accounting portion, and Art. 6(1)(f) (legitimate interests — chargeback defense + fraud prevention) for the dispute-resolution portion. We performed a balancing test concluding our interests in defending against chargebacks and meeting tax obligations do not override your interests, since the retained records are anonymized and cannot be used to re-identify you.

You may object to the legitimate-interest portion of this retention under Art. 21 GDPR by contacting privacy@fluxengine.app. The tax-obligation portion cannot be objected to (legal obligation overrides). California residents have an equivalent right via CCPA §1798.105(d) exception (tax records + legal claims defense).

8. Your Rights

All users have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data. You can disconnect individual platforms from your dashboard, or delete your entire account.
• Revocation: Revoke OAuth access to any connected platform at any time, either through the FluxEngine dashboard or through the platform's own settings (e.g., Google Security Settings, TikTok authorized apps, Meta app settings).
• Portability: Request your data in a structured, machine-readable format.
• Withdraw consent: Withdraw consent for data processing at any time, without affecting the lawfulness of processing conducted prior to withdrawal.

Additional Rights for EEA, UK, and Swiss Residents

Under the GDPR and UK GDPR, you additionally have the right to:

• Object: Object to processing of your personal data based on legitimate interest (GDPR Art. 21). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Restrict processing: Request that we restrict processing of your personal data in certain circumstances (GDPR Art. 18), such as while we verify the accuracy of your data or assess an objection.
• Automated decision-making: FluxEngine does not make automated decisions that produce legal or similarly significant effects on you. All publishing and scheduling actions require your explicit initiation.
• Lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority. For the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. For EU member states, find your authority at edpb.europa.eu.

Additional Rights for California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Opt out of sale or sharing: We do not sell or share your personal information as defined by the CCPA/CPRA. We do not sell personal information to third parties, data brokers, or information resellers. We do not share personal information for cross-context behavioral advertising.
• Non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of personal information collected in the past 12 months: identifiers (email, name), internet activity (usage logs), professional information (social media account data), and sensory data (video content you upload). See Section 2 for details.

Additional US State Privacy Rights

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana have similar rights under their respective state privacy laws, including rights to access, delete, correct, and opt out of certain processing. We honor these rights for all users regardless of location. We do not process sensitive personal data (as defined by these laws) without your explicit consent.

9. Security

We implement industry-standard administrative, organizational, and technical safeguards to protect your data, including:

• Encryption of OAuth tokens at rest using server-side encryption keys
• All data transmitted over HTTPS (TLS 1.2+)
• Row-level security policies ensuring users can only access their own data
• Secure environment variable management for all secrets and API credentials
• No password storage. FluxEngine does not collect, hash, or store passwords. Sign-in uses short-lived 8-digit codes (also delivered as one-click links bound to the requesting browser via PKCE) or Google OAuth — meaning we have no password-hash database that could be exposed in a credential leak.
• Regular access control reviews and monitoring

Account-access model: FluxEngine uses email-based authentication (short-lived 8-digit sign-in codes / one-click links) and Google OAuth. This is the onlynon-Google path to your account — there is no separate password, so there is also no "password reset" flow that could be abused. Anyone with access to the email inbox associated with a FluxEngine account can request a sign-in code and gain access. Securing your email account with two-factor authentication is the single most important step you can take to protect your FluxEngine account. If you use Google OAuth, the same applies to the Google account itself.

No system is completely secure. If we become aware of a security breach affecting your personal data, we will notify you and any applicable regulator as follows: EEA/UK residents within 72 hours of becoming aware (per GDPR Art. 33), and all other users without unreasonable delay in accordance with applicable law.

10. Children's Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal data from children under 16 (or under 13 where applicable under local law). If you believe a child has provided us with personal data, please contact us at privacy@fluxengine.app and we will promptly delete it.

11. International Data Transfers

Your data may be processed in countries other than your country of residence, including the United States. When we transfer personal data outside the EEA, UK, or Switzerland, we ensure it is protected by appropriate safeguards:

• EU data residency: Our analytics (PostHog) and error monitoring (Sentry) services are configured to process and store data exclusively within the European Union (Frankfurt, Germany). No analytics or error data is transferred outside the EU.
• Standard Contractual Clauses (SCCs): Our infrastructure providers (Supabase and Vercel) maintain EU Standard Contractual Clauses approved by the European Commission for data transfers to the United States.
• Adequacy decisions: Where the European Commission has determined that a country provides an adequate level of data protection, we may rely on that adequacy decision.
• EU-U.S. Data Privacy Framework: Where applicable, our providers participate in and have certified compliance with the EU-U.S. Data Privacy Framework.

You may request a copy of the safeguards we rely on by contacting privacy@fluxengine.app.

12. Cookies & Local Storage

We use essential cookies and browser local storage to maintain your authenticated session and remember your preferences. We do not use tracking cookies or advertising cookies.

During sign-in we set a short-lived sb-…-auth-token-code-verifier cookie. This holds the PKCE code-verifier required to complete the email sign-in flow and is essential for the user-requested service of signing in; it is single-use, expires within minutes, and qualifies as "strictly necessary" under ePrivacy Directive Art. 5(3) so no consent banner is required.

If you arrive at sign-up by clicking a paid-tier call-to-action on our pricing page, we set a short-lived pricing_intent cookie (lifetime: 30 minutes) recording which tier you expressed interest in. After authentication we store that single value ("pro" or "business") on your account so we can show you the corresponding plan once paid checkout is available and surface a one-click way to join the launch waitlist. The value is cleared from the cookie on first use and from your account record when you join the waitlist or dismiss the prompt. We do not use this signal for advertising, third-party profiling, or any purpose other than continuing the sign-up flow you started.

Our product analytics tool (PostHog) operates in cookieless mode — it uses in-memory persistence only and does not set cookies, write to local storage, or track users across sessions. Our error monitoring tool (Sentry) does not set any cookies. As we use only strictly necessary cookies, no consent banner is required under the ePrivacy Directive; we provide this disclosure for transparency.

14. Contact & Data Protection

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

• Privacy inquiries: privacy@fluxengine.app
• Security incidents: security@fluxengine.app
• General legal: legal@fluxengine.app

For EEA/UK data protection matters, our designated point of contact for data protection inquiries is reachable at privacy@fluxengine.app. We will respond to all data protection requests within 30 days.