Privacy Policy

Last updated: 4 November 2026

This policy explains what personal data Flint collects, why we collect it, how long we keep it, and the rights you have over it. It is written in plain English on purpose. If anything is unclear, email us at support@useflint.work and we will clarify.

1. Who we are

Flint is operated by Tommaso Giubilei, the data controller for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

Flint is a solo-maintained product. There is no formal Data Protection Officer; the operator above handles every privacy request personally.

2. What data we collect

We only collect what we need to run the service. We do not use third-party analytics or advertising trackers. Specifically:

Account data (from Google)

When you sign in with Google, we receive from Google the following profile fields, covered by the openid, email and profile scopes:

  • Your Google user id (the sub claim) — used as your Flint account id.
  • Your email address.
  • Your display name and profile picture URL.

We never see your Google password. We do not request calendar, contacts, drive or any other Google scope.

Content you create

  • Drafts (your capture inbox).
  • Notes you organize (next actions, events, waiting, someday) and their fields: descriptions, contexts, dates, persons, locations you enter.
  • Weekly review completions (one row per closed review).

Technical and usage data

  • A last_seen_at timestamp, updated roughly every 15 minutes while you use the app.
  • A small, server-side funnel log recording a few product milestones per user: account signup, first capture, first organize and first review. They are stored against your account id (so they are pseudonymous, not anonymous) and deleted with it.
  • Where you came from (signup_source): a short label such as a campaign name, direct or android, saved once with your account when you sign up.
  • Daily counts of main page visits and sign-in starts. They are totals only and hold no personal data.
  • API performance records: route, method, status, response time and the time of each request. They hold no user ID, IP address or user agent, and are not linked to any person.
  • Daily totals of active users (how many people used the app that day). They hold no personal data.
  • Standard web-server access logs (IP address, request path, timestamp) kept for up to 30 days for security and debugging.

No payment data

Flint is free. We do not ask for, receive or store any card, bank or billing details.

3. How we use your data and the legal basis

Purpose Legal basis (GDPR Art. 6)
Provide the Flint service (store drafts and notes, show your dashboard, run the weekly review). Performance of a contract — Art. 6(1)(b).
Authenticate you via Google OAuth. Performance of a contract — Art. 6(1)(b).
Operate the service securely: keep short-lived access logs, prevent abuse. Legitimate interest — Art. 6(1)(f).
Measure product KPIs through the milestones and aggregate counts listed above. Legitimate interest — Art. 6(1)(f).

4. Who we share data with

We only share data with the service providers we need to run Flint. We do not sell, rent or trade personal data with anyone, ever.

  • Google Ireland Ltd. — authentication. When you click "Sign in with Google", Google processes the authentication and sends us the profile fields listed in section 2. Google's own privacy policy applies to that step.
  • Hetzner Online GmbH — hosting. Flint runs on a Hetzner server in the European Union. All your data is stored there in a single SQLite database file.

No data is transferred outside the European Economic Area by Flint directly. Google operates globally and may transfer data under its own GDPR-compliant mechanisms (standard contractual clauses).

5. How long we keep your data

  • Account and content. For as long as your account exists. If you ask us to delete it (section 7), everything is removed within 30 days.
  • Funnel events. Same as account — deleted when your account is deleted.
  • Signup source. Same as account — deleted when your account is deleted.
  • Access logs. Up to 30 days.
  • API performance records. Up to 30 days.
  • Daily totals of active users. Kept without a time limit, because they hold no personal data.
  • Daily counts of page visits and sign-in starts. Kept without a time limit, because they hold no personal data.

6. Cookies

Flint uses exactly one cookie: a session cookie named session that keeps you logged in. It is marked HttpOnly (not readable from JavaScript), SameSite=Lax, and Secure in production. It contains a random opaque identifier — not your email, name or any personal data.

We do not use Google Analytics, Facebook Pixel, Hotjar or any other third-party tracker. There are no advertising cookies, because we show no ads.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Correct inaccurate data (Art. 16).
  • Delete your data (Art. 17).
  • Restrict processing (Art. 18).
  • Port your data to another service in a machine-readable format (Art. 20).
  • Object to processing based on our legitimate interests (Art. 21).
  • Lodge a complaint with your national supervisory authority — in Italy, the Garante per la protezione dei dati personali.

To exercise any of these rights, email support@useflint.work from the address linked to your Google account. We will respond within 30 days.

Account deletion

Automated in-app deletion is on the roadmap. Until then, deletion is manual:

  1. Email support@useflint.work from your Google account's email, asking for account deletion.
  2. We confirm the request from the same address.
  3. Within 30 days we delete your account, drafts, notes, reviews and funnel events.

8. Security

Traffic to Flint is served over HTTPS (TLS, managed by Caddy). Session cookies are HttpOnly and SameSite=Lax. Access to the production server is restricted to the operator over SSH with key authentication. We follow a least-privilege model for third-party API keys and rotate them when we suspect compromise. No system is unbreakable; if we discover a personal-data breach, we will notify affected users and the Garante as required by GDPR Art. 33–34.

9. Children

Flint is not directed at children under 16, and we do not knowingly process their personal data. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

If we change this policy materially, we will update the "Last updated" date above and, for logged-in users, show a notice in-app before the change takes effect. Minor clarifications may be made without notice.

11. Contact

Questions, requests, complaints: support@useflint.work.