Privacy Policy

Fluxora is two separate things, and they hold completely different data.

Your Fluxora account — run by us. We hold your email address and a little about your profiles and devices. Part One.
The Fluxora server — software running on a computer you own. It holds your files and your viewing history. We never see any of it. Part Two.

Part One — your Fluxora account

This is the only part where we hold anything about you. You reach it from three places: the mobile app, the desktop control panel, and this website.

1. What we collect

Your email address and password, when you create an account. Sign-in is handled by Firebase Authentication, operated by Google on our behalf. An account is required to use the app.
Your profiles — the name and picture you choose for each, and whether it has a PIN. Pictures come from a built-in set; you can't upload a photo, so we never hold one.
Your devices and servers — an identifier for each copy of the app, which servers you've linked, and any invitations or share links you create or accept. This is what lets a phone find your server, and lets you take access back later.
Purchases, if you buy a paid plan. Payment is handled by Polar, who collect your email, billing address and payment details, and send us the invoice and which plan you bought. Card details never reach us.

2. What we don't collect

Your files, or anything about what's in your library.
What you watch or open, or how far through you got.
Analytics of any kind. The apps contain no analytics, crash-reporting or advertising code.
Your location, contacts, messages or calendar.

We don't sell, rent or share any of it for someone else's purposes, and we don't use it to train anything.

3. This website

These pages set no cookies, store nothing in your browser, and carry no analytics of any kind.

Two pages do handle your details, both reached from a link we email you: resetting your password, where the link carries a one-time code and you choose a new one, and confirming your email address. Managing or cancelling a subscription sends you to Polar's own portal, where their privacy policy applies.

4. Why we collect it

To sign you in, to keep separate people separate, to let your devices find your server, and — for purchases — to give you the plan you paid for and to meet tax law. There's no other purpose. We don't profile you, and send no marketing unless you ask for it.

5. Who else sees it

Only the companies that run parts of this for us: Google (Firebase — sign-in, the server registry, update notices) and Polar (payments, if you buy a plan). Each handles it on our instructions and for nothing else. Nobody else receives anything.

6. How long we keep it

Account, profiles, device and server records — until you delete your account, then within 30 days.
Invoices — as long as tax law requires, currently eight years in India, even after you delete your account.

7. Your controls

Delete your account at any time — how to do that.
Remove a device or a server from your account, in the app.
Revoke a share link or invitation you created, in the app.
Ask what we hold about you. Email us and we'll tell you.

Part Two — the Fluxora server

The Fluxora server runs on somebody's own computer — yours, or the computer of whoever invited you. It isn't a service we host, and nothing in this part reaches us.

8. What it stores

Your library index, how far through each file you got, the devices you've connected, and the server's own settings. All of it lives in a database on that machine. Uninstalling the server removes it. Your files themselves are never touched.

9. Where your files travel

Your device connects to your server directly, over an encrypted connection — on your own network at home, and directly between the two when you're away from it.

You can put your own relay in front of your server to reach it from outside. That's between you and whichever provider you choose.

Your files never pass through Firebase, or through any system we run.

10. If you use someone else's server

When someone invites you to their server, the record of what you opened there sits on their computer and they control it — not us. Deleting your Fluxora account takes away your access, but anything already on their machine is theirs to remove. Ask them if you want it gone.

The reverse is true too: if you invite people to your server, what they watch is recorded on your machine, and that's yours to look after.

Both parts

11. Security

Connections between your devices and your server are encrypted.
Access tokens are stored on the server as one-way hashes, never in a form that can be read back.
Tokens, passwords and file paths are stripped from logs before they are written.

12. Changes

Changes to what we collect will be announced in the app.

13. Contact

Fluxora is made and run by Marshalx, an independent developer in India. For anything about this policy or the data we hold, email privacy@fluxora.marshalx.dev. A person reads it.