Privacy Policy

Flayel ("Flayel", "we", "us") provides a project-memory web application and an optional Chrome browser extension. For any privacy question or request you can reach us at privacy@flayel.dev.

We collect only what is needed to operate the product:

• Account data — your email address and display name, provided when you sign up via our authentication provider (Supabase Auth).
• Project content you create — projects, the six Project Brain memory slots (vision, architecture, progress, decisions, user feedback, monetization), tasks, notes, AI-tool entries, content-calendar items, and uploaded launch assets.
• Draft ideas before you have an account — when you start a project without signing in, what you enter is saved after the first step, with your IP address, under a random identifier kept only in your browser. It is attached to your account when you sign up or sign in from that browser, so you can continue it. Drafts are never matched to you by IP address. Ask us to delete one any time (section 10).
• AI workflow context (extension) — when you explicitly click the Flayel bird to capture an AI chat, ask for an Insight on a page, or scan & save a page, we collect the text you captured (for Insight, the page's text), the page title, and the page URL. Every one of these is initiated by you; the extension does not silently read or stream your pages in the background. API keys, tokens and passwords found in captured text are redacted before it is stored.
• Operational metadata — timestamps, the AI tool a session came from, a computed "Ship Score", and audit-log entries (action, time, IP address, and user agent) used for security and abuse prevention.

We do not collect passwords (handled by Supabase Auth), payment card numbers (handled by our payment processor if/when paid plans are enabled), or any special categories of personal data.

Sign-in is handled by Supabase Auth. When you log in, Supabase issues a session (access + refresh token). In the web app these tokens are stored in cookies. In the Chrome extension, the same tokens are passed from a signed-in Flayel tab into the extension and stored in chrome.storage.local on your own device so the extension can talk to your account. We never see or store your password.

The core purpose of Flayel is to remember your project and re-inject it into AI tools. Content you capture or type — chat excerpts, brain slots, decisions, saved articles — is user-generated content that belongs to you. We process it only to: store it in your project, generate a formatted context block you can paste into AI tools, and compute your Ship Score. We do not sell this content and we do not use it to train any model.

Application data is stored in Supabase (PostgreSQL database plus object storage for uploaded files). Row-Level Security policies restrict every row to its owner, so one user cannot read another user's projects, sessions, memory, or files. Uploaded launch assets are kept in an owner-scoped storage bucket.

• Stored in Supabase: account profile, projects, Project Brain memory, sessions/captures, saved resources, tasks, AI-tool entries, uploaded files, audit logs.
• Stored locally on your device (chrome.storage.local): your Supabase session tokens, the selected project, the app and API addresses, your extension settings, your last few page insights per site, and a cached copy of your project's formatted context so the extension works offline. This never leaves your machine except when the tokens are used to authenticate calls to our API.

The extension transmits data to the Flayel API (over HTTPS) only when you take an action:

• Capture a chat → sends the captured summary, excerpt, and the AI tool it came from to /v1/sessions/auto-log.
• Insight → sends the page URL, title, and text to /v1/ext/insight. The text is sent, with your Project Brain, to our AI provider to write the answer, and is not stored.
• Scan & save → sends the page URL, title, and a short excerpt to /v1/ext/resources.
• Inject / copy context → reads your project context (from the local cache or a signed, time-limited URL) — this is data flowing to you, not new data we collect.
• Token refresh → sends your refresh token to /v1/ext/refresh-token to mint a new session when the old one expires.

The web app uses strictly necessary cookies to keep you signed in (Supabase auth cookies) and short-lived activity cookies used for session timeout. We do not use third-party advertising or cross-site tracking cookies. The extension does not set cookies; it uses local extension storage as described above.

We share data only with infrastructure providers that process it on our behalf:

• Supabase — authentication, database, and file storage.
• Vercel — web application hosting and delivery.
• Cloud hosting provider — runs the Flayel API, which is the only service that reads or writes your data.
• AI/LLM provider — when you use an AI feature, the relevant project text is sent to our model provider to generate the result; it is not used to train their models per their API terms.
• Email provider (Resend) — sends account and product emails such as return reminders and the weekly digest. You can switch each of these off in Settings.
• Razorpay — processes payments if you subscribe to a paid plan. We never see or store your card details.

You can access and edit your data inside the app at any time, and download a copy of it from Settings → Export all data. You may also request correction of inaccurate data, or deletion of your account and all associated data. To exercise these rights, use the data deletion page or email privacy@flayel.dev.

You can delete individual projects from within the app. To delete your entire account and all associated data, submit a request on the Data Deletion page. We process verified deletion requests within 30 days. Deletion is permanent and removes your profile, projects, memory, sessions, saved resources, and uploaded files. Minimal audit records required for security and legal compliance may be retained for a limited period.

We keep your data for as long as your account is active. When you delete your account, we remove your content as described above. Backups are rotated on a rolling basis.

Flayel is not directed to children under 13 and we do not knowingly collect their data.

We may update this policy as the product evolves. Material changes will be reflected by updating the "Last updated" date above.

Privacy requests: privacy@flayel.dev. General support: support@flayel.dev.