Privacy Policy
Flapp ("the app") is an app for reading and taking part in forums that run the Flarum software. It is published by Molecorp Esports Sociedad Limitada under the ForumCopilot name ("we"), the controller of any personal data described here. You can reach us at [email protected].
The short version
- There are no Flapp accounts, no analytics, no crash reports, no ads and no tracking.
- The app talks directly to the forums you open. What you do in a forum, including signing in, posting and messaging, goes to that forum, under that forum's own privacy policy.
- What the app keeps stays on your phone, and uninstalling the app deletes it.
- Push notifications come from forums that have installed the Flapp extension, through our notification server. It knows your phone's push token and which of those forums you get notifications from, but not your name or your account there. Signing out of a forum stops them and deletes its link to your phone.
What the app keeps on your phone
- The forums you have opened, with their address, name, logo and colours, so they appear on Home. Removing a forum from Home deletes this.
- A sign-in token for each forum you log in to. You log in on the forum's own page, shown inside the app; the forum issues the token, and the app keeps it in the phone's secure storage (the Keychain on iPhone, encrypted storage on Android). The app does not read or keep your password. Logging out ends the token on the forum and deletes it from the phone.
- Your settings, such as light or dark mode, and whether you have seen the welcome pages.
- For push notifications: an identifier and a secret the app makes for this installation, and, for each forum that sends you notifications, the handle our notification server gave your phone for it. They are kept in the phone's secure storage.
- Caches of images and forum pages, to make the app fast. Your phone's settings can clear them.
What the app sends, and to whom
- To the forums you use. Reading, searching, posting, reacting, voting and messaging are requests to that forum's server, as a web browser would make. Photos you attach are uploaded only to the forum you post them in. The app asks for access to your camera or photos only when you choose to add a picture, and saves a picture to your photos only when you tap Save Image.
- To Google, when the app starts. The app uses Firebase Cloud Messaging for push notifications. Its software registers the app installation with Google to get a push token. The app uses no other Google service, and no Firebase Analytics.
- To our notification server, only when you sign in to a forum that has installed the Flapp extension. The next section says what it receives and keeps.
- To nobody else. The directory of forums is built into the app, so browsing it sends no request to us. Forum logos are loaded from the forums' own servers. The app contains no advertising and no advertising identifiers.
Each forum is run by its own owners, not by us. Their privacy policies govern what you post and the account you hold there; deleting that account is done on the forum's website.
Notifications
While the app is open, it shows each forum's notifications by asking the forum. Push notifications, which reach you when the app is closed, come from forums whose administrators have installed the Flapp extension.
When you sign in to such a forum, the app asks once whether it may show notifications, and registers your phone:
- It sends our notification server, at push.flarumapp.com, your phone's push token and platform (iPhone or Android), whether notifications are allowed in the phone's settings, the app's version and the phone's language, with the installation's identifier and secret. The server keeps only a hash of the secret. In return it gives the phone a handle for that forum: a random code, different for each forum.
- It gives the forum that handle, with the platform and language. The forum keeps it with your account, so it knows where to send your notifications. The forum never sees your push token.
When something happens that the forum would notify you about, the forum writes the notification (who did what, and the discussion's title and the start of the post) and sends it, with the handle, to our server. The server sends it on through Firebase Cloud Messaging and, for iPhones, Apple Push Notification service. It does not keep the notification, only your number of unread notifications on that forum, for the badge on the app's icon.
The server knows which forum each handle belongs to, but not who you are on it: no username, user id, email address or sign-in token reaches it. Only the forum can tie a handle to your account.
What the server keeps, and for how long:
- The installation's identifier, the secret's hash, the push token, platform, whether notifications are allowed, app version and language; and for each forum, the handle and your unread count. Signing out of a forum deletes that forum's handle, on the server and on the forum. If you uninstall the app, Google tells us the push token no longer works: we stop sending at once, and delete the installation and its handles 30 days later.
- Server logs (IP address, time, the request and any errors), deleted after 14 days.
The server runs on Amazon Web Services in the United States (Oregon). Push messages pass through Google and, for iPhones, Apple; their handling of push tokens and messages is governed by their own policies. What a forum keeps is governed by that forum's privacy policy.
This website
The server that hosts this page keeps standard web server logs (IP address, time, the page requested) to run and secure the site. They are deleted after about two weeks. The site sets no cookies and uses no analytics.
Children
The app is not directed at children under 13. Each forum sets its own minimum age for its members.
Your choices and rights
- Log out of a forum to end its sign-in token.
- Remove a forum from Home to forget it.
- Turn off Flapp's notifications in the phone's settings: the app tells our notification server, which then sends you nothing. In a forum's notification settings, the Push column chooses which kinds of notification it pushes. Sign out of a forum to stop its notifications and delete its handle.
- Uninstall the app to delete everything it kept on your phone.
- For your posts and your account on a forum, contact that forum's administrators.
We process notification data to deliver the notifications you asked for, and keep server logs to run and secure the service. Depending on where you live, for example in the European Union or the United Kingdom, you have the right to access, correct, delete or export personal data we hold, to object to its processing, and to complain to your data protection authority. As our server doesn't know who you are, signing out and uninstalling are the quickest ways to delete what it holds; you can also email us. Our providers (Amazon Web Services and Google) process data in the United States under the safeguards the law requires for international transfers.
Changes
We will post any change to this policy on this page and update the date at the top.