// legal
Privacy policy
last updated: Nov 2, 2026
01Summary
We collect what is needed to maintain your account, deliver the APIs, and bill for plans. We do not sell your data and we do not use advertising cookies. The data controller, under Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD), is Flye Win Ltda..
02Data we process
- Account: name, email, and password, stored only as a bcrypt hash.
- Google sign-in: Google account identifier, name, email, and profile photo.
- Session: IP address and browser (user agent) of each open session.
- API keys: the name you chose, the masked start and end of the key, its hash, and the date it was last used.
- Support: the subject, category and messages of tickets, with the name and email of whoever opened them.
- Moderation: the time and IP of your last sign-in, plus ban history and blocked emails, with the reason.
- API usage: API, method, path and URL parameters (such as the search term, without credentials), status, error reason, response time, response size, IP, country when available, browser or client (user agent), source site (Origin and Referer, without the query string), plan, key used, a hash of the end-user id when one is sent, and date of each request, plus the monthly count.
- Subscriptions: plan, status, period, and payment provider identifiers. We do not store your card number.
Avoid sending third parties' personal data to the APIs when it is not necessary. Request bodies are not written to the platform's logs.
03Why and on what legal basis
- Providing the service (account, keys, quotas, logs, and billing): performance of a contract.
- Protecting the platform (attempt limits, fraud and abuse prevention, and an audit log of administrative actions, with the affected account's email and the acting admin's IP): legitimate interest.
- Sending service emails, such as password resets: performance of a contract.
- Keeping access records and tax data: compliance with a legal obligation.
04Cookies
We use only first-party cookies that the site needs in order to work. All of them are signed and inaccessible to JavaScript.
| cookie | purpose | duration |
|---|---|---|
| flye_session | Keep you signed in | up to 30 days |
| flye_csrf | Protect forms against forged submissions | 12 hours |
| flye_flash | Show a notice from one page to the next | 2 minutes |
| flye_oauth | Validate the return from Google sign-in | 10 minutes |
| flye_last_login | Remember the email and method of the last sign-in on this browser. You can delete it under "Not you?" on the sign-in screen | 1 year |
| flye_lang | Remember the language you chose | 1 year |
05Who we share it with
Only those who help provide the service, or when the law requires it:
- Google: if you use Google sign-in.
- Payment provider (Stripe): to process paid plan subscriptions, by card or Pix. Card and Pix details stay with Stripe; we only keep the plan, the amount and the payment reference.
- Cloudflare: protects the site and runs the anti-bot check (Turnstile) on sign-in and sign-up. To do so it receives your IP and technical browser data.
- Email provider: to send service messages.
- Hosting and database: the infrastructure the platform runs on.
- Google Fonts and jsDelivr: deliver the site's fonts and files, and therefore receive your IP when pages load.
Some of these providers may process data outside Brazil, under the safeguards set out in the LGPD.
06How long we keep it
- Request logs: 30 days.
- Sessions: until they expire or you end them.
- Password reset links: valid for 1 hour, then deleted.
- Account, keys, and subscriptions: for as long as the account exists.
- Administrative audit logs: 1 year.
- Tickets: while active and for up to 2 years after our team deletes them. Once deleted, only our team can access them, including if the account is erased.
- Bans and blocked emails: for as long as needed to prevent further abuse.
- After deletion: we keep what the law requires, such as tax data and access records, for the legally required period, and audit logs until they reach 1 year.
07Security
Passwords and API keys are stored only as hashes, cookies are signed, and sessions can be ended at any time. No system is completely immune: if an incident could pose a significant risk, we will notify you and Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD), as the law requires.
08Your rights
Under the LGPD, you can request confirmation of processing, access, correction, anonymization, portability, and deletion of your data, as well as information about sharing, and you can object to processing. You can also file a complaint with the ANPD.
You can change your name in Settings. For all other requests, including account deletion, write to [email protected]. We may ask you to confirm that you are the account holder.
09Contact and changes
Privacy matters: [email protected]. When this policy changes, the date at the top will be updated, and material changes will be announced by email or on the website.