# Privacy Policy

Published October 27, 2026 · Effective October 27, 2026

Flaghand is made by Trellisbyte LLC, a California company ("we", "us"). This policy covers flaghand.com, the Flaghand
app at app.flaghand.com, and Flaghand's API, CLI and MCP server.

## The short version {#summary}

- We keep what you put into Flaghand so we can post it where and when you approved: your account, your drafts and
  media, and the logins for the accounts you connect.
- Nothing is posted to X, LinkedIn, TikTok or Bluesky unless an owner of your workspace approved that exact post with
  their passkey. Agents can draft; they can't approve or post.
- We don't sell your information, show you ads or use trackers. flaghand.com sets no cookies.
- Flaghand doesn't run AI models on your content or send it to an AI provider on its own. The agents and apps you connect are yours, under
  their providers' terms.
- Export everything or delete your account in the app at any time, or email support@flaghand.com.

## What we collect and why {#collect}

| What | Why |
|---|---|
| **Waitlist:** your email, when you joined, and how you found us (the campaign tags in the link you followed, the domain of the site that sent you, the flaghand.com page you joined from) | To invite you when early access opens and to learn which channels bring people |
| **Account:** your email, an optional name, your time zone, and your passkey's public key. Your fingerprint or face stays on your device; we never receive it. When you or your agent start a sign-up, we also keep the plan picked and how you found us: whether it started on the web or through an agent; the name the agent gives itself and how it says it found Flaghand; the name and version the agent's app reports and the kind of software it runs on (such as Claude Code or Node.js, not its full browser details); the directory named in the Flaghand address it used; the name and web address of the app you were connecting, if any; the campaign tags in the link you followed, the domain of the site that sent you and the page you started from | To sign you in, help you recover access, show times in your time zone, send account and billing email, and learn which channels bring people |
| **Notification devices:** if an owner turns on notifications on a device, its name (such as "Chrome on Mac" or "iPhone") and the push address and keys its browser gives us, which we store encrypted | To tell you when drafts wait for your approval or a post failed or is on hold. A notification carries counts and a link, never post text |
| **Billing:** Stripe takes your card (or your Apple Pay or Google Pay payment). We receive your plan, trial and renewal dates, payment status and amounts, the card's brand and last four digits, Stripe's fingerprint of the card (a code that tells cards apart, not the card number), and Stripe's customer and subscription IDs. We also keep a record of the automatic-renewal terms you agreed to | To run your subscription, give each card free days only once, and keep the records the law requires |
| **Connected accounts** (X, LinkedIn, TikTok, Bluesky): the account's ID, name, handle and profile picture (for Bluesky, also the server that hosts it), the permissions you granted, and the login tokens the platform issues, which we store encrypted | To post as that account, only what you approve, and to show which account each post goes to |
| **What we read from the platforms:** on X, the posts we published for you, your own recent posts when a thread waits for a post you make by hand, and the posts you reply to. If you turn on best times for an X account, we also read its original posts (up to the latest 800), their public numbers (views, likes, reposts, replies, quotes, bookmarks) and its follower count, every hour; we keep the numbers, the times and what kind of post each was, not its text. If you use suggestions on X, we also read, through X's API, the posts you or your agent want a reply to and who wrote them; if you turn on replies, the replies to your recent X posts and who wrote them; if you ask Flaghand to learn your voice from your X account, its recent original posts with their text and public numbers; and, if you choose X accounts or topics to watch, their recent public posts, with who wrote them and their public numbers. On TikTok, your posting options (who can view, comments) and each post's status. On Bluesky, the posts we published for you | To check a post before it goes out and that what went live matches what you approved, to suggest the best times to post, and, if an X post carries a plug (a reply you approved with it), to tell from best times' numbers when the post reaches the likes or views you set. To show you and your agents replies to your posts and posts worth a reply, and to help your agents suggest posts and replies in your voice and learn what works in your space |
| **Your content:** drafts, threads, images, videos, alt text, schedules, and notes your agents attach | To preview, check, schedule and publish it, to show your scheduled and posted posts in a calendar feed if you turn one on, to show drafts to the people you share a preview link with, and to send updates to the Slack or Discord channels and webhooks you add |
| **Suggestions and your voice profile:** the posts and replies your agents suggest and what happened to each (picked, edited, dismissed, sent back, approved, posted, or opened in X with Reply on X), your voice note, the lessons you and your agents record from your posts and choices, each with the posts, picks and edits behind it, and, if your agent sends them, style numbers it worked out from your X archive on your own computer (numbers and emoji only, never the archive or its posts) | So your agents can suggest posts and replies in your voice and get better at it. You can read, change or remove any lesson in Settings; one you remove isn't learned again |
| **Approvals:** the exact snapshot you approved, its fingerprint (hash), who approved it, with which passkey, and when | To prove each post was approved, and to post exactly that |
| **Posting records:** post IDs and links, status, errors, and the result of the live check | To show what happened and catch mismatches |
| **Agents and activity:** each API token's name, permissions and last use (we store only a hash of the token), the name and web address of each app you connect by signing in (such as Claude or ChatGPT), the name and version an app first reports, the kind of software it runs on and the directory named in the address it used, a log of who did what in your workspace (a person or an agent), and counts of posts, links and reads per workspace | Security, your audit trail, knowing what X charges us, and learning which agents and directories bring people |
| **Support:** what you send us | To help you |
| **Technical:** Cloudflare, our host, handles your IP address and browser details to deliver and protect Flaghand. We count visits to flaghand.com by page and by the campaign tags or site that sent them; the counts hold no IP address or cookie. We also count, per day, the apps that contact our MCP server before signing in (by the name they report) and the reads of our docs by AI services' crawlers and assistants (by page and by which one, such as ChatGPT or Claude); these counts hold no IP address, cookie or account. When the app hits an error in your browser, it sends us the page, the browser type, the app's version, whether the error came from our code, a browser extension or elsewhere, and a fingerprint (hash) of the error message instead of the message itself, and we count them; those counts hold no IP address, cookie, account or content. A cookie keeps you signed in to the app for up to 30 days | Delivery, security, fixing problems, and learning which channels bring people |

We don't collect your followers or contacts, your direct messages, or other people's private information. The posts of
accounts and topics you watch are there for you and your agents to find posts worth a reply and learn what works in
your space, such as formats, topics and timing. Flaghand doesn't build profiles of the people who wrote them, and it
never infers anyone's health, finances, politics, religion or beliefs, ethnicity, sex life, union membership or
criminal record.

## What we never do {#never}

- Sell or rent personal information, or share it for advertising.
- Post, reply, repost, like, follow, send messages or change your profile as you or your accounts on any platform,
  except publishing the posts you approved and, on X, reposting one of them once, after the delay you approved with it.
- Add your location to a post.
- Use your content, or posts we read from X, to train AI models.

## Who else handles it {#sharing}

| Who | What for |
|---|---|
| Cloudflare | Hosts flaghand.com and the app; stores the database, media and logs; routes our email and sends account recovery email |
| Vercel | Hosts ss-content.com, our other domain. When you connect TikTok, TikTok sends you back to Flaghand through it, so it handles your IP address and browser details as a host does. TikTok also downloads photo-post images through it |
| Stripe | Payments, invoices and fraud checks. Stripe's own privacy policy covers the card details you give it |
| Apple, Google | If you pay with Apple Pay or Google Pay, Apple or Google handles that payment under its own terms and privacy policy. Google may also use information from Google Pay payments for its own analytics |
| Resend | Sends our other email, such as waitlist invitations, billing email and alerts when an approved post fails or is held |
| Browser push services | If you turn on notifications on a device, we send each one through the push service its browser uses, such as Apple's for Safari, iPhone and iPad, Google's for Chrome, Mozilla's for Firefox or Microsoft's for Edge. Each notification is encrypted, so the service can't read it; it sees the device's push address, when we send and how big the message is, and holds it until the device receives it, for up to four weeks |
| Calendar services | An owner, or an agent you gave the calendar permission, can turn on a calendar feed: your workspace's name and, for each scheduled, held or posted post, its platform, account, status, time, the first line of its text and a link to it in Flaghand. The calendar service you subscribe with, such as Apple's iCloud, Google Calendar or Microsoft Outlook, fetches the feed from its own servers and keeps the events under its own terms, and may keep them after the feed is off. Anyone who has the feed's private address can read it without signing in, so keep it private. A new address, or turning the feed off, stops the old one at once |
| Slack, Discord and your webhooks | An owner, or an agent you gave the webhooks permission, can have Flaghand send updates to a Slack or Discord channel, or to a web address they choose (a webhook). A channel gets a short message for each update chosen, by default when posts wait for approval and when a post goes out, fails or is held: what happened, the first line of the post (for an approval request, text that isn't approved or public yet) and a link to Flaghand. Slack or Discord, and everyone who can read that channel, receive it, and Slack or Discord keeps it under its own terms. A webhook receives the events chosen from your workspace's activity log, each with who did what and when, and details that can include notes and the first line of a post. Removing a channel or webhook stops new messages; what was already sent stays with Slack, Discord or whoever runs that address |
| People you share a preview link with | Anyone in your workspace, or an agent whose token can read and change drafts, can make a private link that shows one or more drafts to someone outside your workspace, such as a client. Anyone who has the link can open it without signing in. It shows each draft as it is now: its text, images, video and other details, the account it would post from (name, handle, profile picture, badges and, on LinkedIn, headline), its planned time, and whether it changed after the link was shared. It shows nothing else from your workspace, can't change or post anything, and asks search engines not to list it. Keep it private: whoever has it can pass it on. Revoking the link, or the token that made it, stops it at once, and a draft that's archived or deleted drops off it |
| Google (Gmail) | Our support inbox |
| X, LinkedIn, TikTok, Bluesky | When you connect an account, they receive the posts and media you approve, and send us the account details above. Their privacy policies cover what they do with it. On Bluesky, that's the server that hosts your account (Bluesky's own, or one you chose), and what you post there is public. To find that server, we look up your handle's DNS record (through Cloudflare) and its web address, and your account in Bluesky's public directory (plc.directory) or at the web address its ID names. Reply on X, and Open X with the text for a post you make by hand, open X's own site or app with your text filled in. The text travels in that link, so X receives it from your browser when the page opens, whether or not you post it |

We also disclose information when the law requires it or to protect people's safety or our rights. When a platform's
developer terms require it, we report to that platform a breach of our Terms or of this policy that affects its users
(what happened, which of its accounts was involved and what we did), and help with its reviews of how Flaghand uses
its API. If Trellisbyte
or Flaghand is sold or merged, this information may move with it, and this policy keeps applying to it.

## Your agents {#agents}

An agent with an API token for your workspace can read and change what that token's permissions allow, such as
drafts, media, approval requests, suggestions, your voice profile and the X posts we read for you. A token that can read and change drafts can also share them with people outside your
workspace through a preview link (see [Who else handles it](#sharing)). An app you connect by signing in, such as
Claude or ChatGPT, gets a token that can read, draft, add media, share drafts that way and ask for approval. So does
an agent you allow from a sign-up link into a workspace you already own.

If an agent starts your sign-up, it gives us your email and, if it knows it, your time zone, and gets a sign-up link
for you. Once you add your passkey on that link, the agent gets a token with every permission a token can have.
Besides the above, it can see your plan, its price and dates, your payment status, your invoices and your card's brand
and last four digits; open Checkout or your Stripe billing page for you; cancel or keep your plan; start connecting an
account; cancel a post that hasn't gone out or pause posting; and turn on alerts, webhooks or a calendar feed. It
never sees your card number or your passkey: you give your card to Stripe, and your passkey stays with you. You
can see and revoke the token in Settings › Agents.

No token can approve, schedule or publish, whatever its permissions. What your agent's provider does with what your
agent reads is between you and that provider.

## TikTok photo posts {#tiktok-media}

To publish a photo post, TikTok downloads the images from a web address on our domain. The address is unlisted and
hard to guess, but anyone who has it can open the images until we take them down, which we do once TikTok has them.
Videos are uploaded straight to TikTok. More detail: [Flaghand and TikTok](/tiktok).

## How long we keep it {#retention}

| Information | How long |
|---|---|
| Waitlist entry | Until you create an account (then it's linked to it), ask us to remove it, or we close the waitlist |
| Account and workspace content | While your account exists. If your plan ends, we keep everything so you can come back, export it or delete it. If a workspace has had no plan for 12 months, we may delete it, after emailing its owners at least 30 days before |
| A sign-up that was started but not finished: its email, time zone and plan, and how you found us | Its email: until 30 days after its sign-up link expires. The rest, without the email: until you ask us to remove it. Before the email is cleared, asking us or deleting a Flaghand account with that email removes all of it |
| Connected-account logins | Until you disconnect the account or delete your Flaghand account. We then delete them and ask the platform to revoke them, where it lets us. If the platform doesn't answer, ours are deleted anyway |
| Billing records | As long as tax and accounting law requires |
| Automatic-renewal consent records | At least 3 years, or 1 year after your subscription ends, whichever is later (California law), even if you delete your account |
| Card check for free days: a coded copy of the fingerprint of each card that had free days, the date they began and a coded reference to that subscription, kept apart from your account | 3 years after those free days began, even if you delete your account |
| Other people's X posts and replies we read for you (posts you reply to, replies to your posts, posts from accounts and topics you watch), and your own X posts read to learn your voice | Only while Flaghand needs them: while they're in your inbox (replies to your posts, and watched posts you or your agents haven't decided on yet), while a suggestion or a lesson uses them, and, for your own posts, while your agents learn your voice from them. Never after your workspace is deleted. We keep our copy in step with X: when a post is deleted, made private or changed there, we delete or update it as soon as we can, and within 24 hours of a request from X or the post's author |
| Request logs | 7 days, at Cloudflare |
| Support email | As long as needed to help you and keep a record of it |

Deleted records and files can remain in our backups for up to 30 days, and then they're gone. If our daily backup
cleanup fails, a deleted file's 30 days count from the day it next succeeds.

## Export, disconnect, delete {#your-data}

- **Export:** download your drafts and voice profile (as Markdown), media and records (as JSON) in the app or through the API, whether
  or not your plan is active.
- **Disconnect** an account in Settings, or remove Flaghand in X's, LinkedIn's or TikTok's own settings.
  Disconnecting stops our access. It doesn't remove posts already published; manage those on the platform.
- **Delete your account** in Settings (an owner, with their passkey). This cancels your plan at once, disconnects
  your accounts and deletes your workspace, except the billing, consent and card-check records described above.
- Or email support@flaghand.com and we'll do any of this for you.

## Your rights {#rights}

Depending on where you live, you can ask us for a copy of your information, to correct or delete it, to move it
elsewhere, or to restrict or object to how we use it, and you can withdraw consent you gave. Email
support@flaghand.com. We'll confirm it's you, usually by email from the address on the account, and answer within the
time the law sets. We won't treat you differently for using these rights. If you disagree with our answer, reply and
we'll review it; you can also complain to your data protection authority.

If you're in the EU or UK: we use your information to provide the service you signed up for (contract), to email
waitlist members who asked to hear about early access (consent), to keep Flaghand secure, prevent fraud and abuse, learn which
channels bring people and improve Flaghand (legitimate interests), to read public posts on X that an owner chooses
to reply to or watch, so they and their agents can reply and learn what works (legitimate interests, theirs and ours), and to keep
billing records (legal obligation). Trellisbyte LLC is the controller.

If you're on X and a Flaghand customer had us read your public posts, we show them only in that customer's workspace,
to its people and the agents they connect. You can ask us to delete our copy: email support@flaghand.com with the
posts or the account. Deleting your posts on X or making them private has the same effect.

We don't track you across other sites, so Do Not Track and Global Privacy Control signals have nothing to switch off
here; every browser is treated the same.

## Where it's processed {#transfers}

Trellisbyte is in the United States. Information is processed in the United States and other countries where our
providers operate, which may have different data-protection laws. Email us for details of the safeguards for your
information.

## Children {#children}

Flaghand is for people 18 and older. We don't knowingly collect information from children. If you think a child gave
us information, email us and we'll delete it.

## Security {#security}

We encrypt connections and the platform logins we store, store only hashes of API tokens, and use passkeys instead of
passwords. No system is perfectly secure. If a breach affects you, we'll tell you as the law requires.

## Changes {#changes}

We post changes here with a new date. If a change affects how we use information we already have, we'll email
account holders before it applies.

## Contact {#contact}

support@flaghand.com · Trellisbyte LLC, c/o Northwest Registered Agent, Inc., 2108 N St Ste N, Sacramento, CA 95816,
USA · [Business information](https://trellisbyte.com/company)