Privacy policy.

FlareX (we, us, or our) operates a managed service that assesses and helps launch AI-built web applications. You import an existing application that you own by public GitHub repository URL or by ZIP upload, and we fetch it, index it, run deterministic security and configuration scans, execute it in an isolated throwaway sandbox to assess it, and generate an AI-written production readiness report with a score from 0 to 100 and findings. After an application passes readiness, we also offer managed hosting plans. We separately operate a legacy AI app and Discord bot builder that some existing accounts still use; the same Terms of Service and this same Privacy Policy cover both products.

FlareX operates from Australia. For the purposes of the Privacy Act 1988 (Cth), FlareX is the entity responsible for the personal information described in this policy. For the personal information we collect from EU and UK users, FlareX is the data controller under the GDPR, except in relation to the source code you import: for that imported content we generally act as a processor on your behalf, handling it under your instructions to produce your readiness report and, where applicable, to host your application. The governing law for our Terms of Service is the law of Australia. If you have any questions about this policy or how we handle your information, you can contact us using the details at the end of this document.

We collect the following categories of personal information and content in order to provide and operate our services:

• OAuth identity information. When you sign in using Discord, Google, or GitHub, we receive identity details from that provider, including your provider account id, username, email address, and avatar. We do not receive or store your password for these providers.
• Imported project source code. When you import an application by public GitHub repository URL or by ZIP upload, we fetch, store, index, execute, and analyse the source code of that project. Imported source code may contain personal information and may contain secrets or credentials that you or others have committed to the project, such as API keys, access tokens, database connection strings, or passwords. We treat all imported source code as sensitive and handle it as described in this policy.
• Scan results, findings, and readiness reports. We generate and store the outputs of our processing of your imported project, including deterministic scan results, identified findings, sandbox execution results, and the AI-written production readiness report and score.
• Stored secrets and environment values. If you choose to store secrets or environment variables with us (for example, to enable hosting or assessment of your application), we store those values encrypted at rest using AES-256-GCM and decrypt them only at runtime on the runner host.
• Legacy builder content. For accounts that use our legacy builder features, we collect and store the content you create through those features, including chat messages, generated code, and deployment details.
• Billing information. When you purchase a one-time offer or subscribe to a monthly hosting plan, we store a Stripe customer id and the state of your subscriptions and one-time offers. Payments are processed by Stripe. FlareX never receives or stores your card numbers.
• Usage, audit, and analytics events. We collect events about how the services are used, including audit records of significant actions, technical logs, device and browser information, IP address, and analytics events.
• Support communications. When you contact us for support, we collect the information contained in your support tickets and related correspondence.

We use the personal information and content described above for the following purposes:

• To provide the service. To authenticate you, fetch and store your imported project, index it, run deterministic security and configuration scans, execute it in an isolated sandbox, and operate hosting where you have subscribed to a hosting plan.
• To generate the readiness report. To produce the AI-written production readiness report, score, and findings from your imported project, as described in the section on AI processing below.
• For billing and payments. To process your purchases and subscriptions, manage your offer and subscription state, and maintain financial records.
• For support. To respond to your enquiries, resolve issues, and communicate with you about your account and our services.
• For security and integrity. To protect FlareX, our users, and the public from fraud, abuse, security incidents, and misuse, and to maintain audit records.
• For product improvement. To understand how our services are used, diagnose errors, and improve the reliability, performance, and features of our products.

By importing a repository or project, you represent that you own it or are otherwise authorised to have it scanned, and you authorise FlareX to fetch, store, execute, and analyse it in order to produce the readiness report and, where applicable, to host it.

To write the production readiness report, a bounded extract of your imported source code is sent to our AI subprocessor, Anthropic, which processes it server-side to generate the report and findings. The extract is limited to what is needed to produce the report. Anthropic does not use this content to train its models.

The readiness report is informational and best-effort only. It is not a security audit, certification, guarantee, or warranty that an application is safe, secure, or compliant, and we make no such representation. The report and scans are limited by their nature: they can miss issues and can produce false positives and false negatives. You remain solely responsible for the security and compliance of your own application, and you should not rely on the report as your only assessment of your application's readiness. Further detail on the limits of the report, and on liability, is set out in our Terms of Service; nothing in this policy or those Terms is intended to exclude any rights or guarantees you have under the Australian Consumer Law or other laws that cannot lawfully be excluded.

We do not sell your personal information. We disclose personal information and content to the service providers (subprocessors) we rely on to operate FlareX, each only to the extent needed for their function, and under contractual obligations to protect your information. Our subprocessors are:

• Cloudflare. Object storage via R2 for imported source code and artifacts, and CDN, DNS, WAF, and Turnstile services.
• Anthropic. The AI that writes the readiness report from a bounded extract of your imported code, processed server-side and not used to train models.
• Stripe. Payment processing and management of subscription and offer state.
• Sentry. Error monitoring and diagnostics.
• Resend. Delivery of transactional email.
• Discord, Google, and GitHub. OAuth identity providers for sign-in.
• Cloud VPS hosting provider. Compute infrastructure, located in the Singapore region.

We may also disclose personal information where required or permitted by law, to respond to lawful requests from authorities, to enforce our Terms of Service, to protect the rights, property, or safety of FlareX, our users, or others, or in connection with a business transfer such as a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

FlareX operates from Australia, our compute infrastructure is located in the Singapore region, and several of our subprocessors are based in the United States. As a result, your personal information may be transferred to, stored in, and processed in countries other than your own, including Singapore and the United States.

Where we transfer personal information internationally, we take reasonable steps to ensure it is handled consistently with this policy and applicable law. For transfers subject to the GDPR, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) with our subprocessors. For transfers from Australia, we take reasonable steps to ensure overseas recipients handle your information in a manner consistent with the Australian Privacy Principles.

We take the security of your information seriously, particularly because imported source code may contain your own committed secrets and credentials. Our key safeguards include:

• Workspace-scoped storage. Imported source code is stored in Cloudflare R2 scoped to your workspace, so that it is isolated from other tenants.
• Raw archive deletion after scan. As a data minimisation measure, the raw imported archive is deleted immediately after each scan completes.
• Sandbox isolation. The scan sandbox in which your application is executed is network-isolated and capability-dropped, and cannot reach FlareX's databases or any other tenant's data.
• Encryption at rest. Secrets and environment values you store are encrypted at rest using AES-256-GCM and are decrypted only at runtime on the runner host.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We encourage you to avoid committing live production secrets to repositories you import where it is not necessary, and to rotate any credentials you no longer need.

We retain personal information and content for as long as it is needed to provide our services to you, to comply with our legal, accounting, and reporting obligations, to resolve disputes, and to enforce our agreements.

• The raw imported archive is deleted immediately after each scan completes.
• Account information, scan results, findings, readiness reports, stored secrets, and legacy builder content are retained while your account is active or as needed to provide the services, and are deleted or de-identified within a reasonable period after they are no longer required.
• Billing records are retained for as long as required to meet our financial and legal obligations.
• When you close your account or request deletion, we delete or de-identify your personal information, except where we are required or permitted to retain it by law.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the service, and understand how it is used. Some cookies are strictly necessary for the service to function, including for authentication and for security tools such as Cloudflare Turnstile. We also collect analytics and usage events to help us improve our products.

You can control cookies through your browser settings, although disabling some cookies may affect how the service works. Where required by law, we will seek your consent for non-essential cookies and analytics.

Your rights depend on where you are located. The rights below apply in addition to one another where more than one framework is relevant to you.

Australian Privacy Principles (all users)

Under the Australian Privacy Principles, you may request access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading. To make a request, contact us using the details below. If you are not satisfied with how we have handled your personal information or your request, you may make a complaint to us first, and if you remain unsatisfied you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

GDPR rights (EU and UK users)

If you are in the EU or UK, you have the right to access, rectify, erase, and restrict the processing of your personal information, the right to object to certain processing, the right to data portability, and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.

We rely on the following legal bases to process your personal information: performance of our contract with you, to provide the services you request; our legitimate interests, in operating, securing, and improving our services; compliance with legal obligations; and your consent, where we ask for it, such as for certain non-essential cookies.

CCPA and CPRA rights (California users)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; the right to access and delete your personal information; the right to correct inaccurate personal information; and the right not to be discriminated against for exercising your rights. FlareX does not sell your personal information and does not share it for cross-context behavioural advertising. To exercise your rights, contact us using the details below.

We will verify your identity before acting on a request and will respond within the timeframes required by applicable law. You may use an authorised agent to make a request on your behalf where the law permits.

Our services are not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

We maintain procedures to detect, assess, and respond to data security incidents. If a data breach occurs that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). Where other laws apply, such as the GDPR, we will also comply with the notification obligations those laws impose.

We may update this Privacy Policy from time to time to reflect changes in our services, our practices, or the law. When we make material changes, we will take reasonable steps to notify you, such as by posting the updated policy on our website or contacting you directly. Your continued use of the services after an update takes effect indicates your acceptance of the revised policy.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to make a privacy-related request or complaint, please contact us using the details below. Privacy matters and data requests are handled by our privacy team, questions about our Terms of Service or other legal matters by our legal team, and everything else by general support.

Privacy and data requests: [email protected]
Legal and Terms of Service: [email protected]
General support: [email protected]