Privacy Policy

What we collect

• Account basics. Username, email address, authentication details, account settings, and support messages.
• Verification info. If you register through a third-party identity service, we receive the profile details needed to create and protect your account. We do not post as you.
• Payment records. We receive order identifiers, status, amount, currency, product or plan, subscription status, and limited billing details from payment providers. We do not receive or store full card numbers entered in a provider's checkout.
• Promotion records. We record eligible signup credit, referral relationships, cumulative successful top-ups, qualification deadlines, rewards, and reversals so we can show progress and prevent duplicate rewards.
• Technical data. IP address, browser and device details, request timestamps, security events, and service logs.
• Device and fraud-prevention data. We use FingerprintJS Pro from FingerprintJS, Inc. during registration and while you are signed in. Its agent analyzes browser and device signals to return a visitor ID and request ID. Results may include browser and version, operating system and version, device type, incognito status, bot-detection result, confidence score, IP address, and timestamps. The server-verified visitor ID is the mandatory primary device signal for GitHub signup; a signed signup cookie is only a secondary correlation signal. We store the verified visitor ID as a raw identifier for device correlation. We use these signals to limit the offer to two GitHub accounts per device, prevent duplicate rewards, and investigate security incidents. We do not use them for advertising.

What you send through the API

• We process prompts, files, request settings, and model outputs to provide the service.
• Requests are sent to the third-party AI provider or infrastructure used for the selected model. Those providers process the data under their applicable terms and privacy notices.
• We keep the service and usage records needed for billing, quotas, reliability, support, and abuse prevention.

Cookies and device recognition

We use a session cookie to keep you logged in and a preference for your theme. FingerprintJS is not a cookie. It uses browser and device signals to recognize a browser or device and returns an identifier that we link to your account for security and abuse prevention. No ad trackers, and no third-party analytics cookies.

Why we process data

• To run your account and your subscription.
• To bill correctly and detect fraud.
• To calculate signup-credit and referral progress.
• To keep the service working and secure.
• To answer you when you write to us.
• To meet legal obligations when the law asks.

Who we share with

• Creem. For purchases processed by Creem, Creem is the Merchant of Record and authorized reseller. Creem collects and uses buyer and payment data under its Privacy Notice, and sends FloodGate the order information needed to provide the purchase and support the account.
• Other payment providers. For purchases made through another provider, that provider processes payment and order data under its own privacy terms.
• Upstream AI providers — to serve your requests.
• FingerprintJS Pro — to analyze browser and device signals, return visitor and request identifiers, and verify device-recognition events. FingerprintJS processes this data under its privacy policy. We do not send your prompts or files to FingerprintJS.
• Service providers — vendors that host, secure, maintain, or support the platform, only as needed to provide their service.
• Authorities — only when the law requires it.

We do not sell personal data. We may also disclose data during a business reorganization or to protect legal rights, users, and the service, where the law allows it.

How long we keep it

• Account data: while the account is active and for a reasonable period afterward when needed for support, security, disputes, or legal obligations.
• Device, fraud-prevention, request, and usage records: for as long as reasonably needed to secure the service, calculate usage, investigate abuse, and resolve disputes.
• Billing and transaction records: for the period required by tax, accounting, payment, and consumer-protection law.

Close your account and we delete or anonymize your data, except what we must keep for legal or security reasons. FingerprintJS may retain identification requests under its own plan and policy. Its documentation describes a process for deleting data associated with a visitor ID. Contact us if you want us to delete your account-linked device records and coordinate any applicable vendor deletion request.

Your rights

• Ask for access to or a copy of your personal data.
• Correct inaccurate data or request deletion.
• Where applicable, object to or restrict processing, request portability, withdraw consent, or complain to your data-protection authority.

Write to hello@floodgate.dev. We may need to verify your identity before acting on a request.

Security

We store passwords hashed, encrypt traffic, and limit who can touch production data. No system is perfect — protect your API keys, and use a strong password.

Abuse and bans

If we detect abuse or attacks on our servers, we may restrict the IP address, device, and account involved. Purchases remain final except where a refund is required by law. We keep the technical data needed to enforce and appeal those restrictions.

International users

FloodGate, its service providers, payment providers, and upstream AI providers may process data in countries other than yours. Where required, we use contractual or other lawful safeguards for these transfers.

Children

FloodGate is not for anyone under 16. If we learn an account belongs to a child, we close it.

Changes

If this policy changes, the new version appears here with a new date. Big changes get an announcement.

Contact

Privacy questions or requests? Write to hello@floodgate.dev.