Privacy policy

This policy explains what personal data we handle to run Floot, why, who else receives it, how long it is kept and what you can ask of us.

Who is responsible

The controller of your personal data is Boring Software OÜ, a private limited company registered in the Estonian Commercial Register under registry code 17627654, with its registered address at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, trading as Floot ("we", "us").

Write to hello@floot.dev about anything in this policy. Our full company details are on the legal notice.

What this policy covers

The website at floot.dev.
The documentation at docs.floot.dev.
The waitlist, reached at waitlist.floot.dev.
The companion app at app.floot.dev and the backend behind it at api.floot.dev.
The Floot CLI's calls to that backend.
Emails you exchange with us.

It does not cover the apps you build with the Floot starter kit. For those, you decide what data they collect, and you are their controller.

The website

The website sets no cookies and loads nothing from any other site: every page, font and image comes from floot.dev itself. It runs no analytics. It keeps your theme choice in your browser's local storage, which never leaves your browser.

Our server logs each request: your IP address, the time, the page asked for and your browser's user agent. We use these logs to keep the site running and secure, which is our legitimate interest.

floot.dev/install.sh and floot.dev/install.ps1 redirect to the CLI's install scripts on GitHub, so fetching them also reaches GitHub (see Other services).

Cloudflare carries every request to the website, and its security checks may set a strictly necessary cookie on the rare request it decides to challenge.

The documentation

The documentation sets no cookies and runs no analytics. It keeps your theme and the tabs you choose (for instance an operating system in an install guide) in your browser's local storage, which never leaves your browser.

Its server logs requests in the same way as the website's, for the same purpose.

Each page offers to open it in an AI assistant (ChatGPT, Claude, Scira or t3.chat). That sends the page's address to the service you pick, and only when you click it.

The waitlist

The waitlist form, hosted by Tally, asks for your email address only. We use it to tell you when Floot launches and to invite you to early access, on the basis of your consent, which you give by signing up. We keep the list in Tally and in a spreadsheet in our Google Workspace.

You can withdraw your consent at any time by writing to hello@floot.dev or replying to any of our emails. We then remove your address from the list.

The companion app

You need an account in the companion app to buy seats and to use the Floot CLI. We process the following to provide the app and the license you bought, which is the performance of our contract with you, unless another basis is named.

Your account: your email address, your password (stored only as a hash), your name and your profile picture. If you sign in with Google, Apple or GitHub, that provider gives us your name, your email address and the address of your profile picture.
Two-factor authentication: the authenticator apps you register and your recovery codes, stored only as hashes, with a record of each time you reset your factors.
Your settings: your language and the organization you last opened.
Organizations: each organization's name, picture and description, and each member's display name, picture and role.
Invitations: the email address and name of each person a member invites, which the member enters. When an invitation is sent to someone without an account, an account is created for their address so they can accept it. We also keep a record of each invitation email sent, with its address, to enforce the limits on how many invitations an account may send, which is our legitimate interest in preventing abuse.
Ownership transfers: the names and email addresses of both members, as they were when the transfer was made.
Purchases: what each organization bought, the amount, the currency and the payment's references and receipt at Stripe. When your organization first buys, we create a customer at Stripe with your email address and a description naming you and the organization. Stripe collects your card, your billing address and any tax ID on its own checkout page; we never see your card number.
Seats and devices: which member is bound to each seat, and for each device you register with the CLI: its name (your computer's hostname), its operating system, its public keys and when it was last seen. We record each license lease and each download of a release, with the CLI's version and, for a download, your IP address. We use these to enforce the three-device limit of a seat and to detect shared seats, which is part of our contract with you and our legitimate interest in protecting the kit.
Feedback: the message and screenshots you send us, with the app's version, your platform, your operating system's version (your browser's user agent in a browser) and your device model.
Security records: the sign-in service records sign-ins and other account events with your IP address and user agent, and our server logs every request to the app and the backend with your IP address. This is our legitimate interest in keeping accounts secure.

In a browser, the app keeps your sign-in session and your settings in your browser's storage so that you stay signed in. It runs no analytics and no advertising. Two things in it reach Google or GitHub directly from your browser: Google's sign-in script, which the app loads when it starts, and the profile picture of a person who signed in with Google or GitHub, which is loaded from that provider.

Emails we send

We send emails only about your account and your organizations, never marketing:

confirming your email address, signing in by link, resetting or changing your password, and adding or removing a two-factor factor;
an invitation to an organization, and the steps of an ownership transfer;
a reset of your two-factor authentication;
a device of yours reported lost;
the confirmation that your account was deleted;
the confirmation of a purchase, recording what you bought and the consent you gave at checkout.

The Floot CLI

The CLI is free to use without an account. Once you sign in, it calls our backend to register your device, renew its license lease and download releases. Each call carries your session, and most carry the CLI's version; registering a device also sends its name (your computer's hostname), its operating system and its public keys. Device calls are signed with the device's own key.

On your computer, the CLI keeps your email address, your user ID and your session in its configuration folder, and your refresh token in your operating system's keychain where there is one. It sends no telemetry. A project it generates records which release produced it and never who you are.

After each command, unless you run it with --offline, the CLI asks pub.dev whether a newer version exists. floot update asks GitHub. Installing the CLI downloads it from GitHub, or from pub.dev, Homebrew or Scoop if you use those. These services see your IP address (see Other services).

When you write to us

Our mailboxes (hello@floot.dev, support@floot.dev and hello@boringsoftware.xyz) are hosted by Google Workspace. We use what you write, and your address, to answer you, which is our legitimate interest or a step you ask for before or under a contract.

Who receives your data

These processors handle personal data for us, under our instructions:

Hetzner (Germany) hosts our servers in Falkenstein, Germany, and so stores all the data described above.
netcup (Germany) hosts a test server in Nuremberg, Germany. A copy of the production data is restored there only to prove our backups work, and the server is wiped when the test ends.
Cloudflare carries every request to our sites (DNS and proxy), and so sees your IP address and the requests you make. Its R2 storage keeps our backups in its EU jurisdiction, encrypted with a key Cloudflare does not hold.
Stripe processes payments and receives what you enter on its checkout page, the customer we create for your organization and your IP address.
Resend sends our emails, so it receives each recipient's address and the email's content. It sends them through Amazon Web Services in the United States.
Google hosts our mailboxes and the waitlist spreadsheet in Google Workspace.
Tally hosts the waitlist form.

Other services

Some services you reach through Floot handle your data under their own privacy policies, as controllers:

Google, Apple and GitHub, when you choose to sign in with them, and Google's sign-in script in the companion app.
Google and GitHub, which serve profile pictures of people who signed in with them.
GitHub, which hosts the CLI's downloads and install scripts, and pub.dev (Google), which the CLI asks for updates.

Transfers outside the EU

Stripe, Resend (through Amazon Web Services), Cloudflare, Google, Apple and GitHub may process data in the United States or other countries outside the European Economic Area. Where they do, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework for a certified recipient, or on the European Commission's standard contractual clauses.

How long we keep it

Your account and what it holds are kept until you delete it. Deleting your account deletes it at once, together with your settings, memberships, devices and their license leases and download records, feedback and the record of the invitation emails you sent, and your profile picture and screenshots within the hour. Your name and address are removed from invitations and ownership transfers. Your personal customer at Stripe, if you had one, is deleted at Stripe; the customer of an organization whose first purchase you made may still name you in its description.
What we keep after you delete your account: a keyed hash of your email address, with your former user ID and the date of deletion, which lets us recognise the address if it signs up again without storing it, to prevent abuse of new accounts; the record of an invitation email another member sent you; and the sign-in service's security records, which have no fixed limit.
An organization's data, including its seats and purchases, is kept until its owner deletes the organization, which also deletes its customer at Stripe. Invitations expire after seven days but stay in the organization's records.
Payment records stay at Stripe, and in our accounts for seven years as the Estonian Accounting Act requires, even after an account or organization is deleted. This is our legal obligation.
Server logs are kept in a fixed amount of space per service and overwritten by newer entries, so how long an entry lasts depends on traffic.
Backups are kept for 90 days, then deleted. Data you delete therefore leaves our backups about 90 days later.
The waitlist is kept until you ask to leave it.
Emails you send us are kept as long as we need them to answer you and keep a record of what was agreed.

Your rights

You may ask us for a copy of your data, to correct it, to delete it, to restrict its use, to receive it in a portable format, and you may object to processing based on our legitimate interests. Where we rely on your consent, you may withdraw it at any time.

To delete your account, open your profile in the companion app and use Delete account. If you own an organization, transfer it to another member or delete it first. For anything else, write to hello@floot.dev. We answer within one month.

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority of the EU country where you live or work.

Other points

We make no decision about you by automated means that has legal or similarly significant effects.
Floot is a tool for software developers and is not meant for children under 16.
When this policy changes, we publish the new version here with its date.