Privacy Policy — Flots

Last updated: October 1, 2026

Data controller : Micro-entreprise Sinyx Studio, represented by Killian Vincent (reachable via the contact tab on our site). Full identification details in the Legal Notice.

1. Types of data collected, linked to the user or used to track you

Data potentially collected (linked or not to you)

Device identifiers (device ID), usage and diagnostics (crash logs, performance) — to ensure proper functioning, statistical analysis and service maintenance.
Account information (name, e-mail) — if the user registers an account; used for authentication, profile management and multi-device synchronization.
User content (notes, projects, attachments) — managed for the app's functionality (stored locally or in a synchronized space depending on your infrastructure).
Anonymous traffic statistics of the website (see section 3.1) — no cookie and no identifier.
Website session identifier (see section 3.2) — subject to your consent.
Origin of your sign-up (see section 3.3) — the site or campaign you came from, stored with your account.

Sensitive or optional data

Access to camera or microphone — only if the user uses a feature that requires it (e.g. adding a photo to a note). These accesses are clearly requested and optional.
Location — No location collection (precise or approximate) is planned for Flots.

2. Purposes of collection and use

Identifiers, usage, diagnostics — improvement of stability, bug detection, anonymous analytics to understand general usage.
Account information (name, email) — authentication, account recovery, synchronization between devices.
User content — create, modify, synchronize your notes, projects, reminders.
Traffic statistics and sign-up origin — knowing which pages and which channels (search engines, social networks, campaigns) bring us visitors and users, to improve the site and focus our efforts.

3. Tracking on the marketing website

Our marketing website (flots.app) measures its traffic with tools we operate ourselves, without any third-party service. No data is sold or used for advertising.

3.1 Anonymous audience measurement (no consent required)

Each page view increments a daily counter. We only store totals per day, page, origin (referring site or campaign named in the link), device type (mobile, tablet, desktop), language, whether the page starts the visit, and your choice on the cookie banner. We also count the clicks on the banner's "Accept" and "Reject" buttons.

No cookie is set and no identifier is created: we cannot tell that two page views came from the same person.
Your IP address and browser details are not stored.
These statistics are not combined with any other data and are used by Flots only. They cannot track you across other sites, nor from the website to the application: that link only exists if you accept cookies (section 3.2).
They are kept for at most 25 months.

In line with the CNIL (French data protection authority) guidelines, this strictly limited audience measurement is exempt from consent. You can still object at any time, and we automatically honour your browser's "Global Privacy Control" and "Do Not Track" signals:

Your browser is counted in the anonymous audience measurement.

References

3.2 Detailed measurement of your visit (with consent)

If you accept cookies via the banner, a session identifier is created in your browser; it disappears when the tab is closed. It allows us to:

Understand the journey on the site: pages viewed, sections reached, scroll depth, buttons clicked.
Ensure continuity between your visit to the website and your first use of the Flots application: the identifier is then added to the link that opens the web application.

Without your consent, no identifier is created or sent. You can change your choice at any time via the "Manage cookies" link in the footer. We do not share this identifier with any third party.

3.3 Origin of your sign-up

The site's links to the application and to the app stores state where you came from (for example "Google search" or a campaign name), the landing page and the button used — with no identifier if you did not accept cookies. When you create an account, this information is stored with it so we can measure which channels bring users who stay. It is deleted with your account.

4. Legal basis for processing

Contract performance — account information and user content, necessary to provide the service (GDPR art. 6.1.b).
Consent — website session identifier and detailed measurement of the visit (GDPR art. 6.1.a); withdrawable at any time via "Manage cookies".
Legitimate interest — diagnostic logs, security and fraud prevention, strictly necessary for the proper functioning of the service (GDPR art. 6.1.f).
Legitimate interest — anonymous audience measurement of the website, exempt from consent under article 82 of the French Data Protection Act within the conditions set by the CNIL, and sign-up origin stored with the account (GDPR art. 6.1.f). You can object (section 3.1, or by contacting us for the sign-up origin).

5. Subprocessors

Flots deliberately limits its reliance on third-party providers. Only two subprocessors are involved in the processing of your data, for essential technical needs:

Hetzner Online GmbH (Germany) — hosting of our servers and of all the application's data.
Paddle.com Market Ltd ("Paddle") — payment and billing processing for subscriptions purchased on our website.

Outside of these two providers, all infrastructure and processing (application, synchronization, support) is operated in-house by the Flots team. No other data is shared with a third party.

6. Data retention

Account and user content — retained as long as your account is active, then deleted within 30 days after account deletion.
Session identifier — erased when the tab is closed; cookie choice — kept for at most 13 months; related visit events — deleted after 13 months, in accordance with CNIL recommendations.
Anonymous traffic statistics — kept for at most 25 months.
Sign-up origin — kept with the account and deleted with it.
Technical and diagnostic logs — retained for as long as necessary to resolve incidents, then deleted or anonymized.

7. Security and storage

Encryption in transit (SSL/TLS) — all communications with servers are secure.
Secure storage — your data is stored on secure servers, with encryption measures at rest and access control.
Deletion requests — possibility for the user to request the deletion of their data (account, content) at any time, in accordance with transparency obligations.

8. User rights and transparency

Full access to the privacy policy — via a visible link in the application or on the site.
Data management possibility — the user can consult, export or request the deletion of their personal data, in accordance with the GDPR (right of access, rectification, erasure and portability).
Right to lodge a complaint — if you believe your rights are not being respected, French residents may lodge a complaint with the CNIL.

9. Links and transparency

Link to the privacy policy — available at any time from the application and on the official website: https://flots.app/privacy/en
Review of the privacy policy — any change to the application affecting this privacy policy will result in an update to this policy, and will be notified to users.