Privacy policy

1. Who we are

This policy applies to the official Fluxer instance, apps, APIs, and websites run by Fluxer Platform AB. Fluxer is open source, so if you use an instance hosted by someone else, that operator is the data controller for it and publishes its own privacy notice.

For the official service, Fluxer Platform AB is the controller of your personal data under the General Data Protection Regulation, supervised in Sweden by the Swedish Authority for Privacy Protection (IMY). Our legal identity, registered address, representative, and every contact route are on our company information page.

We have not appointed a data protection officer under GDPR Article 37 or a representative in the United Kingdom under UK GDPR Article 27. We keep both decisions under review and will update this section if that changes.

2. What we process

2.1 What you give us

To sign up, you give us an email address or a display name, and an account started with only a display name can add an email later. Every account has a username, and we pick one if you don't. Right after sign-up, the app asks for your date of birth.

A password and other profile details, such as an avatar and a bio, are optional. Passwords are hashed with Argon2id, so even we cannot read them.

Your content is what you create and share: messages, files, images, reactions, communities, and profile information. Calls need connection information to work, and call media is encrypted in transit (section 9). Sharing your screen also creates a small preview thumbnail by default, so that people permitted to join the call can see what is being shared. You can turn the preview off when you start sharing.

If our anti-abuse checks restrict an account, we may ask you to verify a phone number to lift the restriction. We email you a one-time code, and you text it from your phone to our verification number. Section 7.2 explains the little that is kept afterwards.

If you are in the United Kingdom, age-restricted content stays locked, as our regional restrictions page describes. We no longer offer the credit card check that unlocked it, and accounts that passed it before keep a record that they are 18 or older. We have removed the cards that were saved only for this check from Stripe.

Our support team handles support messages and attachments in helpdesk software we host ourselves, so no third-party support provider processes them.

Stripe processes payments, and we never get full card numbers. We get only what is needed to record and manage a purchase, such as billing country, partial card details, payment status, and dates. If you donate, we keep your email address, your Stripe customer and subscription details, and any business name and tax ID you provide, so you can manage your donation and we can keep accounting records.

If you buy Plutonium through the App Store or Google Play, Apple or Google handles the payment, as section 4.2 describes, and we don't receive your card or other payment details. The app gives Apple or Google a random identifier that links the purchase to your account, and we get back what we need to give you Plutonium and manage the purchase, such as the product, store country, purchase status, and dates.

If you buy for a business, we keep the company name, address, and VAT ID you give at checkout, so that we can issue an invoice and keep accounting records.

When we check a VAT ID with the European Commission's VAT Information Exchange System (VIES), it goes to the Commission and the issuing country's tax authority. We keep the answer, which may list the registered name and address and a consultation number, and record the result with the payment at Stripe. This rests on our VAT and bookkeeping duties (section 3.1), and section 7.4 says how long we keep it.

When someone redeems a gift code that was paid for, VAT on it is due in the country where it is redeemed, so we record which country that is. We work it out from the approximate location described in section 3.2 and the billing and card country on the account that redeems it, and we keep it with the payment records for that gift (section 7.4). This rests on our legal duty to account for VAT (section 3.1).

We do not ask for special category data such as health, religion, ethnicity, sexual orientation, or political views. If you choose to include something like that in a message or profile, we will not use it to profile you, target you, or treat you differently.

2.2 What we collect through use

Technical information includes the IP address you connect from, device and browser details, operating system, language, and similar connection data.

To keep the service reliable, we keep server-side request metrics, error logs and aggregate performance measurements, which we build from request and error information and not from the content of any messages or files.

Apart from the peer-to-peer call reports described below, the web and desktop apps send us no usage analytics, screen tracking, or crash reports.

The iOS and Android apps send us crash and performance reports only if you turn on "Send crash and performance reports" under "Advanced" in settings. The setting is off by default, and the app may ask you to turn it on after it crashes.

A report includes crash and error details, the screens you opened, moments when the app stuttered, how long network requests took, and your device and app version. Reports leave out instance addresses, IDs, and message content. With the setting on, they come to us even if you are signed in to an instance we do not operate.

When a peer-to-peer call connects or fails to connect, the app sends us a report for each person you connect to. It says whether the connection worked, how long it took, what kind of network route it used, and which channel the call was in and how many people were in it, but not who they are or their IP addresses.

We add the IP address and country you connected from, your app platform and your operating system to each report, and we delete it after 180 days.

To understand how Fluxer is used, we look at counts drawn from our own service records, such as sign-ups and active accounts, alongside the aggregate service metrics above. Message content is never read to produce any of this.

Security records include sign-in attempts, account changes, rate limit events, service errors, and signals used to spot spam, fraud, abuse, or unusual activity. We record the connecting IP address against security-relevant events such as sign-ins and file uploads and keep those records for the periods in section 7.

Some security records are kept as long as you have your account. They are your most recent IP address, the IP address, country, and browser details from account creation, and the IP addresses you have approved for sign-in. The IP address and country of each signed-in session are kept while the session lasts and for 30 days after it ends.

If a community bans you, the ban stores your account's email address and your last-used IP address to enforce it, until the ban is lifted or your account is deleted. Nobody in the community can see your email address or your IP address.

Fluxer uses no third-party analytics or advertising services, no cross-site tracking pixels, and no browser fingerprinting, and we do not build behavioral profiles or track which other sites you visit. Crash and performance reports go only to servers we run.

2.3 What we receive from others

Other users create data involving you when they mention, message, add, report, or otherwise interact with you. Service providers send back limited operational information, such as email delivery status, the verification texts you send to our number, payment and fraud signals, and infrastructure alerts. Public sources occasionally supply narrow security signals, such as the reputation of an IP address.

We combine this with what we collect only to run, secure, and support Fluxer.

2.4 Operator Pass

If you join the Operator Pass waitlist, choose to appear on the Operators' wall or are listed in a yearly Operators list, the separate Operator Pass privacy notice says what personal data we keep about you, why we keep it and for how long.

2.5 Fluxer Feedback

If you use Fluxer Feedback, or something you wrote on GitHub or sent to our old bug report bot was copied there, the separate Fluxer Feedback privacy notice says what personal data we keep about you, why we keep it and for how long.

3. How we use information

We use personal data to run accounts and communications, provide support, process payments, prevent abuse, enforce our rules, keep the service reliable, comply with the law that applies to us, and protect users, the public, and Fluxer.

We do not use your content for advertising, behavioral profiling, AI training or commercial research. Fluxer shows no ads and has no advertising partnerships, and section 4 of this policy explains who receives your personal data.

3.1 Legal bases

Where the GDPR or similar law applies, we rely on these legal bases.

Contract necessity, under Article 6(1)(b), applies to delivering messages, running communities, managing your account, processing purchases and giving you support, which is what we need to provide the service you signed up for.

Legitimate interests, under Article 6(1)(f), apply to security, fraud prevention, service reliability, limited analysis of how the service is used, and messages about changes to the service or these policies. Each activity has a documented assessment of its purpose, its necessity, and the balance against your rights, and none of it is used for advertising. You can object at any time, as described in section 10.

Legal obligations, under Article 6(1)(c), apply to our accounting and tax duties under Swedish law, valid requests that we receive from public authorities, and compliance with data protection, security, and consumer protection law.

Consent, under Article 6(1)(a), applies to the small set of processing that needs consent, such as optional communications. You can withdraw your consent at any time, and doing so does not affect the lawfulness of earlier processing.

3.2 Approximate location

We derive an approximate city, region, and country from your IP address for sign-in alerts, session information, fraud prevention, regional age rules, sanctions compliance, for working out where VAT is due, and for other legal duties.

Some countries demand age-verification methods we do not offer, such as government ID uploads or biometric scans, and access there may be restricted. Because we never check age with documents, selfies or face scans (section 11), some regional access decisions are automated and rely on approximate location, such as IP geolocation. Travel, VPNs and unusual network setups can give the wrong outcome.

If you think a restriction is wrong, use the privacy route on our company information page. We acknowledge it promptly and have a person review it while your access stays as it is. You can share your point of view at any stage, and we send you the outcome with our reasoning. Our regional restrictions page lists current restrictions.

4. Who receives data

We do not sell, rent, trade, broker or license your content or other personal data to anyone, and we never share it with anyone for their own advertising or marketing. We only share it in the situations described in the rest of this section.

4.1 Sharing you choose

Messages and files go to the people and communities you select, your profile is visible according to your choices, and integrations you connect receive only the access you grant. Remember that the people who receive what you share can save it or pass it on to others, so be deliberate about what you send and to whom.

The optional stream preview is visible only to people permitted to join the call. If you agree to join a peer-to-peer call, your audio and video go directly between you and the other people in the call, and they can see your IP address. The app asks for your agreement before you join one, unless you have chosen to always agree.

4.2 Our service providers

We use a small number of service providers that process data on our behalf. Each one is reviewed for privacy and security before we use it, acts only on our instructions and is bound by a data processing agreement under GDPR Article 28.

We use these kinds of service providers.

• Hosting providers run the service and relay call traffic, which is encrypted in transit. The servers that receive and store crash and performance reports from the iOS and Android apps are in Finland, in the European Union. Section 6 says where your data is stored and how we protect it when it is processed outside the EU.
• Payment processors like Stripe handle your payments, create our invoices and credit notes and send some payment emails on our behalf.
• An email provider hosted in the European Union sends transactional email, including receipts and other billing emails with their invoices attached.
• A text messaging provider receives texts sent to our verification number.
• If you turn on push notifications, push services from Apple, Google or your browser vendor wake your device. They get device push tokens and message, call or event identifiers, but never notification content. Our push relay notice also applies when the official app gets notifications from an instance we do not operate.

Error monitoring and observability run on infrastructure we control, and no application errors or crash data go to any third-party monitoring service.

Google provides YouTube embeds and Klipy provides GIF search, as section 13 describes. Some providers are independent controllers when you use them directly, such as Google when you play a YouTube video or Apple and Google when you buy Plutonium in their app stores. Their own policies then apply alongside ours.

We keep this section current and note material changes in our changelog.

4.3 Law, safety, and business changes

Beyond that, personal data leaves Fluxer only to comply with a valid legal obligation, legal process, or enforceable governmental request, to enforce our terms of service and other agreements, to protect the safety, rights, or property of users, the public, or Fluxer, or to detect and deal with fraud, security, or technical issues.

If Fluxer Platform AB is reorganized, acquired, or sold, personal data may transfer with it. Where legally permitted, affected users get at least 30 days' advance notice and a chance to delete their account and request deletion of their data first. Any recipient must keep honoring this policy unless you affirmatively agree to a replacement, and data will not go to any entity that refuses those protections.

5. Content safety

We run no generative AI or LLM inference over your messages, files, or calls.

For explicit content preferences we use OpenNSFW2, a small pretrained image classifier running on Fluxer-operated infrastructure. It is not generative AI or an LLM. Given an image, it returns a single probability that the image is explicit, and it cannot recognize text, remember, or learn. It runs on unmodified published weights with no external API call, and nothing it sees or produces enters any training pipeline.

The result is used only to respect explicit content preferences and to restrict flagged media to users 18 or over. It does not punish accounts, and no report is filed.

Other automated protections look for patterns in messages and accounts to spot spam, coordinated abuse, and account compromise, using signals such as message frequency, link structure, account age, IP reputation, email domain, and client details. These automated protections feed no advertising or behavioral profiles.

Authorized staff may review specific stored content when needed to investigate a report, enforce policy, or respond to a credible safety issue. Access is restricted by role and recorded in an audit log, so every access is attributable and reviewable.

Where processing may create a high risk to people's rights, we conduct a data protection impact assessment, as Article 35 of the GDPR requires.

We have completed two, for the explicit content classifier and for the automated regional access decisions in section 3.2. Each examines necessity and proportionality, identifies risks, and records the measures that reduce them. We revisit them when processing materially changes or on a regular schedule, whichever comes first.

6. Where data is kept

We host most stored account information, messages, communities, files, and other content with Vultr in Piscataway, New Jersey. Call traffic may go through Vultr locations worldwide so calls route near participants, and is encrypted in transit.

Crash and performance reports from the iOS and Android apps are stored separately, on our own servers at Hetzner in Finland, in the European Union. Encrypted disaster recovery copies are kept separately, and only Fluxer holds the keys.

Data that we host in the United States can be subject to lawful access requests under US law, including the Clarifying Lawful Overseas Use of Data Act (the CLOUD Act), under which a provider subject to US jurisdiction can be required to produce data in its possession, custody or control even if the data is stored elsewhere.

We treat that as a real privacy issue, factor it into our transfer assessments, provider reviews and legal request procedures, and keep looking at ways to rely less on US-hosted infrastructure. If regional hosting launches, we will explain what it changes, what it does not change and which legal regimes would still apply.

Personal data may be processed outside your country, including in the United States and Canada. Our data processing agreements include standard contractual clauses approved by the European Commission or UK authorities, and we keep these clauses in place even where another transfer mechanism would apply.

These agreements are also backed by transfer impact assessments for each destination, by encryption in transit and at rest, by access controls and audit logging, and by contractual limits on how our providers may use the data.

These measures reduce the risk, but for data that our servers must be able to process to run Fluxer, they cannot make lawful access to it impossible.

7. Retention

We keep personal data only as long as it is needed for the purposes in this policy, legal obligations, disputes, and enforcement, then delete or anonymize it.

7.1 Active accounts and content

Account information, messages, communities, and other content are kept while your active account needs them. Attachments may expire based on factors such as size, age, and use, and items in saved media are not subject to ordinary expiration. Details are in the attachment expiration guide. Optional stream previews stay available for at most 24 hours after the latest upload, and only to people permitted to join the call.

7.2 Phone verification

Phone numbers used for verification are not stored on your account. The text message you send us, including your number, is deleted from our own systems within 24 hours, and your account records only the fact that verification happened.

To stop one phone number from lifting restrictions on many accounts, we keep a one-way record of the number together with the account it verified for about a month at most. This record is never used for SMS two-factor authentication, account recovery, advertising, profiling, contact discovery, or linking accounts.

7.3 Deletion

Deleted messages and account data normally leave active use within minutes. Encrypted disaster recovery copies may still contain them for up to 30 days, without any active processing or use for any purpose, until scheduled deletion.

Deleted media normally leaves active use within hours, though we may keep a hidden copy of each deleted attachment for up to 24 hours before final erasure.

Users cannot see that copy. Only authorized Fluxer staff can restore it, and only in a genuine disaster recovery situation. Deleted media is not included in longer-term backups, and CDN-cached copies are purged as soon as possible after deletion, though rate limits and global propagation can add short delays. An erasure request under GDPR Article 17 is complete once data has left active systems and backup cycles.

Longer retention applies only where the law requires it, for example under bookkeeping and tax rules or under a legal duty to preserve evidence. Even then, we keep the data only to the extent and for as long as that legal obligation requires.

Deleting a community or channel removes it and everything in it (messages, attachments, roles, settings, and other associated data) right away, and it cannot be restored. Its data then leaves our systems through the procedures above.

Accounts that have had no sign-ins or other meaningful activity for 2 years may be scheduled for deletion, with advance notice to the account's registered email address. Visionary accounts are never deleted for inactivity, and section 5 of the Operator Pass terms says the same for accounts that have an Operator Pass.

Messages you previously shared with others may stay visible unless you delete them first. The account deletion guide has the current criteria and timelines. Deleting your Fluxer account doesn't delete your Fluxer Feedback account, and section 10 of the Fluxer Feedback privacy notice says how you can delete it.

7.4 Other retention periods

Payment and transaction records are kept for at least 7 years, as Swedish bookkeeping law (Bokföringslag 1999:1078) requires, and longer only where needed for legal compliance, disputes, or fraud prevention. Full card numbers are never stored.

Payment records include invoices, credit notes, the result of any VAT ID check, and records of the billing emails we send you, such as receipts and withdrawal confirmations. A record of a billing email shows what kind of email it was, when we sent it, and whether it arrived, and it does not include the email itself.

We delete records of billing emails sooner, 3 years after we have sent them, or 1 year after the subscription that they belong to ends, if that is later.

Crash and performance reports from the iOS and Android apps are kept for 30 days, and a cleanup that runs once a day deletes them from our servers after that. Security and usage logs are kept for up to 90 days in normal conditions, then deleted or anonymized. Specific records may be kept longer only for an active security investigation, a binding legal obligation, or an ongoing dispute, and are deleted once that reason ends.

Section 2.2 says how long we keep reports about peer-to-peer calls.

Administrative audit records of enforcement decisions and account changes are kept as long as accountability, appeals, disputes, and legal compliance require, and are reviewed periodically. When content is reported, we may preserve a snapshot of the reported item, relevant surrounding context, attachments, and report details, even if the original is later deleted, so that investigation and appeal remain possible.

Snapshots are stored separately from ordinary user content, are never served to users, indexed, or exported, and are readable only by authorized Fluxer staff, and every access to them is recorded. We delete these snapshots, the context and attachments we copied, and any extra details written in the report no later than 1 year after the report was filed, even if we haven't finished handling the report by then.

Only a binding legal obligation can make us keep specific material for longer than that. We keep the record of the report itself, which says what kind of report it was, which accounts and items the report was about, and what we decided, as one of the administrative audit records of enforcement decisions described above.

The Operator Pass privacy notice says how long we keep Operator Pass waitlist entries and the copies of names and avatars for the Operators' wall.

The Fluxer Feedback privacy notice says how long we keep what you post on Fluxer Feedback, your account there and the records we keep about them.

Content removed or disabled under a valid order under Regulation (EU) 2021/784 on terrorist content, and related data, is preserved for 6 months, or longer where applicable law requires. Generated self-service export files are kept for up to 7 days.

8. Your controls

The Privacy section in User settings lets you request an export and delete messages at any time. You can schedule account deletion in the Account section.

An export is a ZIP archive of machine-readable JSON with your account, message, payment, relationship, session, security, preference, and profile information, with download links for any attachments that are still available.

Download anything you want to keep before deleting it or letting it expire.

Deleting a message also deletes its attachments. Bulk message deletion runs in the background and can take a while for large accounts. Scheduled account deletion can be canceled by signing back in during the grace period in section 6.1 of the terms. Current instructions are in our data export, data deletion, and account deletion guides.

For anything you cannot do in the app, use the privacy route on our company information page, writing from the email address on your account where possible. We may ask for the information needed to verify your identity.

9. Security

Technical and organizational measures protect your personal data against accidental or unlawful destruction, loss, alteration, disclosure and unauthorized access.

These measures include encryption in transit and at rest, access controls, security monitoring, physically secure data centers, patching and hardening, rate limiting, encrypted backups, and audit logging of access to user data.

Nothing on Fluxer is currently end-to-end encrypted. Your data is encrypted in transit between your device and our servers and at rest on our servers and backups. The service needs server-side processing to work, so our own systems can technically access the message content and call media while they handle them.

You are trusting Fluxer and our hosting providers to protect that traffic.

Our roadmap has our plans for end-to-end encryption of calls, personal notes, direct messages and group DMs. End-to-end encryption protects a call or your content only once its feature has launched, and we will announce each one when it ships.

Security vulnerabilities can be reported through our security page.

If a personal data breach happens, we investigate and take remedial steps.

As GDPR Articles 33 and 34 require, we notify IMY within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people's rights and freedoms, and we explain why if we notify later. We notify affected users without undue delay where the risk to them is high. Notifications explain what happened, what data is likely affected, the probable consequences, and what you can do to protect yourself.

10. Your rights

Depending on where you live, you may have the right to:

• access your personal data and receive a copy of it
• correct data that is inaccurate or incomplete
• have your data erased
• restrict processing in certain situations
• object to processing based on legitimate interests
• receive a copy of your data in a structured, commonly used, machine-readable format so you can move it to another service (data portability)
• withdraw consent at any time without affecting earlier lawful processing
• ask for a person to review any automated decision that significantly affects you, share your point of view on it, and contest that decision

If you object to legitimate-interest processing, it stops unless compelling legitimate grounds override your interests, rights, and freedoms, or legal claims need it.

You can exercise these rights through your account controls or the privacy route on our company information page. We may need to verify your identity, and an authorized agent can act for you where the law permits. We respond within the period applicable law requires, usually within 30 days, or up to 45 where permitted.

If we cannot fully comply, for example because of a legal obligation or another person's rights, we explain why and what options remain open to you.

You can also complain to your data protection authority. In Sweden that is the Swedish Authority for Privacy Protection at imy.se, and in the UK the Information Commissioner's Office at ico.org.uk. The authority where you live is always an option too, and you are welcome to raise the issue with us first so we can try to fix it directly.

11. Children and age requirements

Section 1 of the terms sets the minimum age for using Fluxer and says when a parent or guardian must review the terms and agree to them for you.

Users under 18 may get stricter privacy and safety defaults and limits on age-restricted features. Nobody on Fluxer is profiled for advertising, including minors.

We never ask for or accept ID documents, selfies, videos of your face, facial age estimation, biometric scans, or any other document to check anyone's age, and we cannot change a date of birth after sign-up. Where a legal framework demands methods we do not support, access is restricted as described in section 3.2.

We do not knowingly collect personal information from children below the minimum age for their region, which in the United States means children under 13, in line with COPPA. If we learn that an account belongs to someone below the minimum age, we schedule the account for deletion, which deletes its personal data with it.

A parent or guardian can contact us through the privacy route on our company information page, and we may ask them for proof of guardianship.

12. Cookies and browser storage

The Fluxer app sets no first-party cookies. Authentication and recent identity checks use request and response headers. Our marketing site sets one strictly necessary cookie, locale, which remembers your language for 1 year. Strictly necessary cookies need no consent under the ePrivacy rules, and if we ever introduce a non-essential cookie we will update this section and ask for consent before setting it.

Fluxer Feedback, our site for bug reports and feature requests, sets its own cookies, which the Fluxer Feedback privacy notice lists with what each one does.

The app uses your browser's local storage for account switching, interface state, and preferences. Some preferences sync to your account so they follow you between devices, and everything else stays on your device. Embedded YouTube content may set its own cookies when you interact with it, under Google's privacy policy.

We treat a Global Privacy Control signal as a request to opt out of the sale and sharing of your personal information. Because Fluxer does not sell or share personal information for advertising, the signal changes nothing. We do not treat Do Not Track signals differently, because Fluxer does not track anyone across other sites.

13. Third-party content and links

We relay GIF searches, so Klipy never sees your IP address or device identifiers.

When a message contains a link, Fluxer may fetch the linked site from our servers to build a preview, so the site sees a request from Fluxer, not from your device. Those requests have a User-Agent containing Fluxerbot, and a site operator can block them, which stops previews and embedded media for that site in Fluxer.

YouTube previews are fetched server-side, so that your device does not contact YouTube until you press play. Playing an embedded video connects your device to Google, which may then process information under its own privacy policy, and other embedded content behaves the same way when you interact with it.

14. Legal requests

We review every request for user information carefully and put the privacy and security of the people involved first. We narrow or reject requests that are invalid or overbroad. Authorities should use the legal route on our company information page and identify the requesting authority, the legal basis, and the specific information sought.

We notify affected users before we disclose their information, so that they have a chance to object, unless the law forbids doing so. If the law forbids telling them at the time, we tell them as soon as that legal restriction has ended.

The only other exception is a genuine emergency, where we may disclose without prior notice if that is necessary to prevent death or serious physical harm. We then tell the affected users as soon as doing so no longer puts anyone at risk.

For call-related requests, connection information and, where one exists, the stream preview may be available, as the rest of this policy describes.

15. Changes to this policy

We may update this policy as our service, practices, or legal duties change. We record every update in our changelog and update the effective date at the top.

A change is material when it is adverse to you, meaning it reduces your rights or protections, expands what we collect or how long we keep it, adds recipients or uses in ways that increase your risk, or otherwise leaves you worse off than before. Where it is genuinely unclear whether a change is adverse, we treat it as material.

Material changes take effect no earlier than 30 days after we notify you by email, in the app, or both, so that before they apply you can review them, export your data, delete your messages, or delete your account using the tools in section 8. A change may take effect sooner only where the law requires it or it is urgently needed for security, and we then notify you as soon as we reasonably can and explain why.

Changes that are neutral or in your favor, such as new protections, stronger encryption, or clearer descriptions of existing practice, take effect when published. If such a change is significant, we also tell you about it in the app or by email.

16. Contact

All privacy, support, legal, postal, and telephone contact routes are on our company information page. For account requests, write from your account's email address where possible, as it makes verifying your identity easier and protects the account.

17. California disclosures

This section adds the disclosures the California Consumer Privacy Act requires and applies only to California residents, alongside the rest of this policy.

The personal information we collect falls into these categories:

• Identifiers: username, email address, user ID, IP address, device identifiers, and the phone number you send a text from during phone verification, which come from you, from automatic collection, and from our service providers.
• Customer records under Cal. Civ. Code § 1798.80(e): billing country, partial card details, payment records, and any business name, address, and VAT ID or tax ID you give us, which come from you, from our payment provider, Stripe, from Apple or Google when you buy through their stores, and from the European Commission's VIES system when we check a VAT ID, as section 2.1 describes.
• Internet or network activity: sign-in and session records, request logs, and browser and operating system details, from automatic collection.
• Geolocation: the approximate city, region, and country derived from the IP address you connect from, which all come from automatic collection.
• Audio, electronic, or visual information: the files you upload, your stream previews, and your call traffic, all of which come directly from you.
• Inferences: the results of regional eligibility checks and signals of spam or abuse risk, which we derive from information we collect automatically.

We collect no biometric, employment, or education information. The only sensitive personal information we collect is your account login credentials, meaning an email address with a password, used to run and secure the service. California law also treats the personal information of consumers under 16 as sensitive, and we use it only to provide and secure the service, never for advertising or unrelated profiling.

We disclose identifiers, payment records, network and location information, push tokens, call traffic, previews and uploaded files to the providers in section 4, for hosting, delivery, payments, communications, push notifications and security.

We do not sell anyone's personal information, including the personal information of users under 16, and do not share it for cross-context behavioral advertising.

California residents can request access, deletion, or correction, can limit the use and disclosure of sensitive personal information, can opt out of sale or advertising sharing, neither of which happens, and can act through an authorized agent where the law permits, all without being discriminated against for it. Requests go through your account controls or the privacy route on our company information page.

Retention follows section 7, and Global Privacy Control follows section 12.