Flashbag
Privacy Policy
Flashbag, by Orange Boys B.V.
Version 1.1. Effective date: 21 August 2026
Plain-language summary, and our core promise. The Flashbag app runs entirely on your Mac. It sends nothing to us: no telemetry, no analytics, no crash reports, no prompts, no files. Your content never touches our servers. We call this "Keep It Home". The only personal data we process comes from our website, our newsletter, our contact form, purchases through Paddle, and our Discord community. This policy explains that processing under the GDPR, which is the primary law that applies to us as a Dutch company.
1. Who is responsible for your data
Orange Boys B.V., Hazepad 15 A4, 4825 AV Breda, the Netherlands, Chamber of Commerce (KvK) number 11068312 ("Orange Boys", "we", "us") is the controller for the processing described in this Privacy Policy within the meaning of the EU General Data Protection Regulation (GDPR).
We are established in the European Union, so we do not need an EU representative. We have not appointed a Data Protection Officer, because the nature and scale of our processing does not require one.
Contact: hello@flashbag.io. Website: https://flashbag.io.
References to "personal data" in this policy have the meaning given in the GDPR.
2. The Flashbag app processes no data for us
Summary. This section is the most important one. The app is local-only by design.
The Flashbag desktop application runs fully locally on your computer.
- The app sends no data to Orange Boys: no telemetry, no usage analytics, no crash reports, no prompts, no files, no content of any kind.
- Your prompts and files go directly from your machine to the third-party AI providers you have accounts with (for example Anthropic or OpenAI), under those providers' own terms and privacy policies. We do not proxy, store, or process that traffic. It never passes through our systems.
- Everything the app creates stays in plain folders on your computer. We cannot see it, and we cannot delete it.
Because of this design, this Privacy Policy is almost entirely about our website and business operations, not about the app.
3. What personal data we do process, and why
We process personal data in the following situations.
| Situation | Data | Purpose | Lawful basis (Art. 6 GDPR) | Processor / recipient |
|---|---|---|---|---|
| Contact form and support email | Name, email address, message content | Answering your questions and providing support | Legitimate interests (responding to your request); performance of a contract where you are a customer | Resend (email delivery), Vercel (hosting) |
| Newsletter | Email address, name if provided, subscription status, opens and clicks | Sending our newsletter and product updates you signed up for | Consent (Art. 6(1)(a)); you can unsubscribe at any time via the link in every email | Kit (email newsletter platform) |
| Purchases and licensing | Name, email address, company details you provide, country, subscription and license status. We receive this from Paddle. We never receive your payment card data | Delivering your license, managing your subscription, support, invoicing records | Performance of a contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)) | Paddle (merchant of record, an independent controller for the payment transaction), Upstash (backend data for site and licensing features), Vercel |
| Website analytics | Page path and title, referrer, timestamp, browser, operating system, device type, screen size, language, approximate location, and a rotating anonymous session identifier via self-hosted Umami. Query strings and URL fragments are excluded. IP addresses are used transiently to derive location and the anonymous session identifier, but are not stored | Understanding overall website usage and improving the site | Legitimate interests (Art. 6(1)(f)) in measuring and improving our website with privacy-preserving, cookieless analytics | Umami and PostgreSQL self-hosted on our dedicated Mac Mini; Vercel and Tailscale transport analytics requests |
| Advertising measurement (optional) | Meta advertising pixel on the website, only loaded after you consent via the cookie banner: device and browser data, pages visited, ad interaction data | Measuring and improving our advertising on Meta platforms | Consent (Art. 6(1)(a)); you can refuse or withdraw consent at any time via the cookie banner | Meta Platforms Ireland Ltd and Meta Platforms, Inc. |
| Discord community | Your Discord profile and the messages you post in our community | Running our user community | Legitimate interests (community operation). Discord itself processes your data as an independent controller under Discord's own terms and privacy policy | Discord Inc. |
| Legal compliance and protection | Any of the above, as relevant | Complying with legal obligations, and establishing, exercising, or defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) | Professional advisors, authorities where legally required |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests and fundamental rights, in particular because the data involved is limited and the processing is what you would reasonably expect. You can object at any time; see section 10.
We do not use your personal data for purposes incompatible with the ones above. If we ever want to, we will ask for your consent first.
4. What we do not do
- We do not sell your personal data.
- We do not carry out automated decision-making or profiling that produces legal or similarly significant effects for you (Art. 22 GDPR).
- We do not knowingly collect data from anyone under 18. Our products and website are aimed at business users and are not directed at children.
- No sensitive data. We do not ask for and do not want special categories of personal data (such as data about health, racial or ethnic origin, political opinions, religion, biometrics, or trade union membership) or data such as government identification numbers. Please do not send us such data through our contact form or otherwise.
5. Cookies and similar technologies
Plain-language summary. Our website uses almost no cookies. Our analytics tool (self-hosted Umami) is cookieless and privacy-preserving. It records anonymous session-level activity but does not store IP addresses or identify people. The only optional tracker is a Meta advertising pixel, and it loads only if you say yes in the cookie banner. The Flashbag desktop app itself uses no cookies or trackers at all.
This section explains how we use cookies and similar technologies (such as pixels and browser local storage) on https://flashbag.io and its subdomains (the "Site"). Cookies are small data files placed on your device when you visit a website.
| Category | What it is | Consent needed? | How to control it |
|---|---|---|---|
| Essential | Strictly necessary cookies and local storage for the technical operation of the Site, such as remembering your cookie consent choice and enabling checkout and security features | No. These are required for the Site to work | Browser settings (blocking them may break parts of the Site) |
| Analytics (Umami, self-hosted) | Privacy-friendly analytics we host ourselves. It is cookieless, sets nothing on your device, and records page views and anonymous sessions. It does not create named profiles, track people across websites, or share analytics data with an analytics vendor | No cookie consent is requested. We rely on legitimate interests for this limited analytics processing | Enable Do Not Track in your browser; our tracker is configured to honor it. Browser privacy tools can also block the tracker |
| Advertising (Meta pixel) | A pixel from Meta that measures how our ads on Meta platforms perform. It can set cookies and share data (such as pages visited and browser data) with Meta. See Meta's privacy policy at https://www.facebook.com/privacy/policy | Yes. It loads only after you accept it in our cookie banner | Accept, refuse, or withdraw consent at any time via the cookie settings link in the Site footer. You can also block it in your browser |
That is the complete list. We do not use session replay, fingerprinting, cross-site advertising networks, social login cookies, or third-party analytics services on the Site. The Flashbag desktop application uses no cookies, pixels, or tracking technologies, and sends no data to us.
Your choices:
- Cookie banner. On your first visit we ask whether you accept the Meta pixel. Essential cookies do not require consent. You can change or withdraw your choice at any time via the cookie settings link in the Site footer.
- Browser settings. Most browsers let you block or delete cookies. If you block essential cookies, some parts of the Site may not work properly.
- Meta ad settings. You can also manage ad preferences in your Meta account settings.
Pages we link to, such as Paddle's checkout and our Discord community, set their own cookies under their own notices.
6. Sharing your personal data
We share personal data only with:
- Processors that help us run our business, listed in the table in section 3 (Vercel, Tailscale, Resend, Kit, Upstash, and, subject to your consent, Meta). They act under data processing agreements and may only process data on our instructions, except where noted as independent controllers.
- Paddle, our merchant of record, which acts as seller of record and as an independent controller for the payment transaction under its own privacy policy.
- Discord, as an independent controller for the community platform.
- Professional advisors (lawyers, accountants, auditors) where needed.
- Authorities, where we are legally required to do so.
- Business transferees. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, or if this agreement is assigned to an affiliated or successor entity, personal data may be transferred as part of that transaction. Any recipient must continue to respect this policy or give you notice of changes.
7. International data transfers
We are based in the Netherlands. Some of our processors are US companies or use US infrastructure: Vercel, Tailscale, Kit, Resend, Upstash, and Meta. Where personal data is transferred outside the European Economic Area, we rely on:
- an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the provider is certified under it; and/or
- the European Commission's Standard Contractual Clauses (SCCs), with additional safeguards where needed.
You can contact us at hello@flashbag.io for more information about the transfer mechanism used for a specific provider, or to request a copy of the relevant safeguards.
8. Retention
We keep personal data no longer than necessary for the purposes above:
- Contact and support messages: up to 2 years after our last contact, so we can follow up on related questions.
- Newsletter data: until you unsubscribe, plus a suppression record so we do not email you again.
- Purchase and licensing records: for the duration of your subscription and thereafter for 7 years, the Dutch statutory retention period for administrative and tax records.
- Analytics data: page-view and anonymous session records are kept in the live analytics database for up to 12 months, then deleted. IP addresses are not stored.
- Consent records (cookie banner): as long as needed to demonstrate consent, and refreshed periodically.
When data is no longer needed we delete or anonymize it. Where immediate deletion is not possible (for example in backups), we isolate the data from further processing until deletion is possible.
9. Security
We apply appropriate technical and organizational measures to protect the personal data we process, including encryption in transit, access controls, and minimizing the data we collect in the first place. The most effective measure is architectural: the Flashbag app keeps your content on your machine, so it cannot be breached on our side. No internet-facing system is perfectly secure, and we cannot guarantee absolute security of the website-related data we do process.
10. Your rights under the GDPR
You have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten") where there is no good reason for us to keep it;
- Restrict processing in certain circumstances;
- Data portability: receive data you provided to us in a machine-readable format;
- Object to processing based on legitimate interests, and object at any time to direct marketing;
- Withdraw consent at any time where processing is based on consent (for example the newsletter or the Meta pixel), without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, email hello@flashbag.io. We may ask for information to confirm your identity. We respond within one month, extendable by two further months for complex requests, in which case we will tell you.
Complaints. If you are unhappy with how we handle your data or your request, you can lodge a complaint with the Dutch supervisory authority:
Autoriteit Persoonsgegevens
PO Box 93374, 2509 AJ Den Haag, the Netherlands
https://www.autoriteitpersoonsgegevens.nl
If you live in another EEA country, you may also complain to your local supervisory authority. We would appreciate the chance to resolve your concern first, so please consider contacting us before filing a complaint.
11. US state privacy rights
Summary. We sell to US businesses too. Some US states give their residents privacy rights. Here is the short version, which is short because we collect very little.
This section applies to residents of US states with comprehensive privacy laws (such as California, Colorado, Connecticut, Texas, and Virginia) to the extent those laws apply to us.
- What we collect: identifiers (name, email), commercial information (subscription status received from Paddle), and, only with consent, internet activity data via the Meta pixel. Sources, purposes, and recipients are as described in section 3.
- We do not sell your personal information for money.
- Targeted advertising: if you consent to the Meta pixel, some state laws may treat that as "sharing" or processing for targeted advertising. You can opt out at any time by refusing or withdrawing consent in our cookie banner. We honor the Global Privacy Control (GPC) signal as an opt-out where required by law.
- Your rights: depending on your state, you may have rights to know, access, correct, delete, and port your personal information, to opt out of targeted advertising, and to appeal a refusal. We do not discriminate against you for exercising these rights.
- Sensitive personal information: we do not intentionally collect or process it.
- How to exercise rights: email hello@flashbag.io with enough detail for us to verify your identity and understand your request. Authorized agents may submit requests with proof of authorization. If we deny your request, you may appeal by replying to our decision, and we will have it reviewed.
12. Other websites and services
Our website links to third-party services such as Discord, Paddle's checkout, and the websites of AI providers. Their privacy practices are their own; please read their policies.
13. Changes to this Privacy Policy
We may update this policy from time to time. We will post the updated version on https://flashbag.io with a new version number and effective date, and for material changes we will notify you by email or a prominent website notice before they take effect.
14. Contact
Orange Boys B.V.
Hazepad 15 A4
4825 AV Breda, the Netherlands
KvK: 11068312
Email: hello@flashbag.io
Website: https://flashbag.io