Privacy

Last updated: 18 October 2026. This policy describes Flekta as it works today — an invitation-only browser editor with accounts and projects stored on your device.

Who we are

The controller is Sebastian Grochocki, operating Flekta at https://flekta.app.

Contact for privacy, access, correction, or deletion: flektaapp@gmail.com.

What this covers

This policy covers:

  • the marketing site at https://flekta.app;
  • the editor at /app;
  • related static pages we publish (for example Learn).

If you join a separate waitlist or survey form, that form’s own notice also applies for the data you type there.

Data we process

Accounts. For invited beta users, we process your email address, username, account identifier, access status, plan designation, and account/authentication timestamps. Supabase stores password hashes and verification/session records; Flekta does not store plaintext passwords. We also record the Terms version you accepted and your declaration that you are at least 16. Your email is used for invitations, recovery, email verification, and security-related account messages.

Authentication and security. Supabase and Netlify may process IP addresses, request paths, account requests, and authentication/security events. Netlify applies per-IP rate limits to account endpoints. Invitation and password-recovery abuse controls retain a hash of the recipient address and send timestamps only for delivery limits, not marketing. A scheduled database job removes those hashes and mail-budget records older than 30 days.

Projects and artwork. Animation projects (SVG, timeline data, names you give files) are stored in your browser (IndexedDB / local storage on that device). We do not receive or host those files on Flekta servers today.

Technical hosting data. When you visit the site, our host (Netlify) may process standard request data such as IP address, user agent, timestamps, and requested URLs, for delivery, security, and abuse prevention.

Emails you send us. If you write to flektaapp@gmail.com, we process the address and content of that message so we can reply and honour rights requests.

Optional forms. If we publish a waitlist or research form, we only collect what that form states (typically an email and optional answers you choose to give), under the consent you give on that form.

What we do not collect

  • No cloud project library. Project files remain on your device.
  • No payment or billing data.
  • No advertising pixels or third-party marketing analytics in the product as shipped.
  • No product telemetry unless a future build explicitly enables an endpoint — and then this policy will be updated first.

Why we process data

Account provision and necessary transactional messages are processed to provide the service you request (Art. 6(1)(b) GDPR). Security and abuse prevention are based on our legitimate interest in protecting the service (Art. 6(1)(f)). Account access does not subscribe you to marketing; any separate waitlist uses its own notice and consent.

  • Provide the site and editor (legitimate interest / necessary for the service you request).
  • Security and reliability of hosting (legitimate interest).
  • Respond to you when you email us (legitimate interest / contract steps you ask for).
  • Waitlist or similar forms, only with your consent (Art. 6(1)(a) GDPR), for the purpose stated on that form.

Where data lives

Account and authentication data are processed by Supabase, with the production database configured in Frankfurt, Germany. Resend delivers transactional email and processes recipient addresses, message content, and delivery metadata. Netlify hosts the website and account endpoints. Processing by these providers may involve international transfers under their contractual safeguards. See our service providers.

Account records are retained while the account exists. Deleting the account removes the active Auth record and associated profile; provider backups may remain for the provider's applicable backup-retention period. Resend states that email and log data is retained for 30 days. Netlify and Supabase technical logs follow their applicable provider and plan retention schedules. Rights requests also cover personal data held in support correspondence and any separately managed waitlist.

Your projects stay on your device unless you export or copy them yourself.

If you allow the editor to list your installed fonts (a browser permission prompt, Chromium only) or pick a font file for “Flatten all fonts”, the font names and bytes are read in your browser only to draw and outline your text. They are never uploaded and are discarded when the export dialog closes.

The public site and editor are hosted by Netlify. Netlify may process hosting logs in the United States or other regions under its terms; we rely on Netlify’s published safeguards (including Standard Contractual Clauses / Data Privacy Framework where applicable).

Optional Google Forms (waitlist / research), if used, are processed by Google as described in that form’s notice and Google’s terms.

Cookies and local storage

Essential first-party cookies maintain login, refresh, restricted invitation/recovery flows, and request-forgery protection. Production authentication cookies are Secure, HttpOnly, and SameSite=Lax. Editor access expires within one hour; the absolute account session limit is seven days. Refresh does not extend that absolute limit. These cookies are needed to provide the account service and are not advertising trackers.

Projects, recovery drafts, scripts, and preferences are separated by account identifier in this browser. Logging out keeps those local copies and does not encrypt them. Account deletion also attempts to remove that account's local copy on the current browser. We cannot remotely erase other devices or files you have exported.

We do not use non-essential tracking cookies for ads. The editor uses browser storage (including IndexedDB and localStorage) so your projects, preferences, and recovery drafts can work offline on that device. Clearing site data in the browser deletes that local copy.

Third-party open-source notices for software we ship with the app are at /licenses.txt.

Your rights

Account settings let you correct your username, request a verified email change, download account data, and delete your account. Download project backups before deletion. If you cannot access your account, contact us to exercise your rights; we may need to verify your identity.

If you are in the EEA/UK (and where similar laws apply), you may have rights to access, correct, delete, restrict, or object to certain processing, and to withdraw consent where processing is consent-based. To exercise these rights, email flektaapp@gmail.com.

For data that exists only in your browser, delete it by clearing this site’s storage, or by deleting projects inside the editor. For emails or form rows we hold, we will delete or correct them when you ask.

You may complain to a supervisory authority. For Germany, that is typically your state data protection authority, or you can find contacts via the European Data Protection Board.

Children

Flekta is aimed at people 16 or older. Do not use the service or submit forms if you are under 16. We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will delete it.

Changes

We will update this page when our data practices change. The “Last updated” date at the top will change.

Governing organisation and contact details may change if Flekta later operates from another country; this page will say so.

Contact

Sebastian Grochocki · Flekta
flektaapp@gmail.com
Terms of use