Privacy policy

1. Who we are

Flare makes the Flare desktop app for Firebase and other databases, and runs flare.tools and the Flare API. In this policy "Flare", "we" and "us" mean the people who operate Flare. You can reach us about privacy at privacy@flare.tools.

2. Connecting your Google accounts

You sign in to Flare with your email address and a password. To open Firebase projects, you connect one or more Google accounts in the desktop app, and for each the app asks Google for these permissions:

• Your name, email address and profile picture (openid, email and profile), to show which Google account is connected.
• Google Cloud access (cloud-platform), to list the Firebase projects your account can reach, and to read and change the Firebase and Google Cloud resources you choose to open and work on in the app: Firestore documents and indexes, Authentication users, Cloud Storage buckets and files, and Security Rules. It also reads your Cloud Functions and the Cloud Build runs behind them, which Google only allows under this permission.

Flare can only reach what each Google account can already reach, and only does what you ask it to do. Each Firebase project opens through the Google account you chose for it, and never through another. Flare never changes who has access to your projects in Google Cloud.

Your Google tokens are stored on your computer, encrypted with your operating system's credential storage, separately for each account. To finish connecting and to keep a connection working, the app sends the one time code, or a refresh token, to the Flare API, which passes it to Google together with the app's client credentials and returns Google's answer. The API does not store these tokens. When you reconnect an account, the app tells Google which account to suggest. Disconnecting an account deletes and revokes that account's tokens; signing out deletes all of them from your computer.

Your saved Firebase connections remember which Google account each project opens through, by the account's ID and email address, on your computer.

3. Your Firebase data and your databases

Your Firebase data travels directly between your computer and Google, and the data in the other databases you connect, such as PostgreSQL, MySQL, SQLite, Supabase, MongoDB, Cassandra, Redis and S3 compatible storage, travels directly between your computer and that database. None of it passes through or gets stored on Flare's servers. Backups you make are written to your own computer.

The connections you save, and their passwords and keys, such as a Supabase service role key, are kept on your computer. Passwords and keys are encrypted with your operating system's credential storage, or where there is none, kept in a file only your user account can read. They leave your computer only if you turn on sync or put a connection in a team folder, and then only end to end encrypted, as the next section explains.

Some of what you do does reach our servers, only when you use the feature that needs it:

• Flare Assistant. When you ask the Assistant for help, your request is sent through the Flare API to OpenAI with what it needs to answer. For Firebase that is the paths of your collections and the names and types of their fields, and in the Query Builder the query you are working on and, when you ask it to fix or explain a failed one, the error Firestore gave. For other databases it is a summary of their tables or collections, their columns or fields and types, keys and indexes, the query you are working on, and when you ask it to fix or speed one up, the error or the query plan the database gave. Values from your data are not sent unless you attach them or turn on sample values.
• Team features. Scripts, migrations and activity that you share with a team are stored on our servers so your teammates can see them. Shared activity says what was changed and where, and for SQL and Redis it includes the text of the query or command that made the change.
• Crash reports. When the app runs into an error it sends a report with technical details of the error, the app version and your operating system, with tokens, keys and other secrets removed first. Reports are on by default and you can turn them off in Settings.

4. Sync and team folders

Sync is off until you turn it on, and team folders hold only what someone puts in them. Both are end to end encrypted: your saved connections and saved queries are encrypted on your own devices before they are sent, with keys that never leave your devices, and our servers store only the encrypted copies.

• What we cannot read: the names, addresses, users, passwords and keys of your connections, the text of your queries, and the names of your folders. We cannot decrypt them, and no one at Flare can.
• What our servers do see, because they need it to deliver your items: how many items you have in each place, their size rounded up to a block, when each changes and from which account, whether each is a connection, a query or a folder, the name and platform of each device you add, the public keys your devices use, and who belongs to which team.
• For Firebase connections, the encrypted copy carries only the project and database IDs you chose, your own names, tags and colours for them, which of your Google accounts each opens through, by Google's account ID alone, and in a team folder the Flare account ID of whoever shared it. Your Google tokens and your Google email addresses are never synced, and connections in a team folder never carry whose account the sharer used; each device connects to Google itself.
• A team folder's key is shared among its members through each member's own keys. A connection in a team folder also carries, encrypted like the rest, the Flare account ID of whoever shared it, so members see who to ask for anything held back. A teammate's password, or a storage secret key, travels with a connection only when whoever shares it chooses so; a member who enters their own keeps it on their own device. When someone leaves a team, the folder's key is replaced, but what their devices already had stays with them.
• If you lose every device and your recovery key, your synced copies cannot be recovered, by you or by us.
• Turning sync off stops it and offers to delete the encrypted copies from our servers.

5. Plugins

Flare can run plugins: add ons, made by Flare or by other people, that add widgets, table features, commands and views to the app. Flare installs plugins only from the Flare store. You choose which ones to install, and before one is installed Flare shows you what it asks to do.

• A plugin runs on your computer, inside the app, in a sandbox of its own. It has no access to your files, your saved connections and their passwords, or your Google tokens, and no network of its own.
• A plugin reads or changes your data only through Flare, only in the database you have open, and only as far as you allowed when you installed it. Changes it makes go through the same confirmation on production as your own, and are recorded in your activity.
• Flare does not receive what a plugin reads or shows. It stays on your computer unless the plugin sends it on.
• A plugin can send data only to the internet hosts it names, which Flare shows you before you install it. What those hosts do with it is between you and the plugin's author, under the author's own terms and privacy policy.
• A plugin's settings, and the small store it keeps for itself, are kept on your computer. Passwords you give a plugin are encrypted with your operating system's credential storage. Uninstalling a plugin deletes them.
• Every plugin in the Flare store passes automatic checks before it is listed, and one that can read or change your data, or reach the internet, is also reviewed by a person at Flare first. Flare does not install plugins from anywhere else, and does not run plugins that an older version installed from a file, a folder or npm. If you turn on Developer mode to build a plugin, Flare also runs the one you serve from your own computer, which Flare does not check. Plugins made by other people are their authors' work, not Flare's, so install only plugins you trust.

6. The plugin store

The plugin store lists plugins on flare.tools and in the app. Browsing it needs no account.

• Downloads. Each plugin shows how many times it was installed or updated, counted once per plugin per day for each person or internet address. To count it, we keep a one way keyed hash made from your Flare account ID if you are signed in, or from your IP address if you are not, together with the plugin and the day. We never store your IP address or your account ID for this. The hash cannot be turned back into either, and it cannot link your downloads of different plugins or on different days. Each day, the hashes of the days before are deleted, and only the totals are kept.
• Publishing. When you publish a plugin, the store shows it with your Flare account's name, never your email address. We keep each version you send: the package and its files, its manifest and README, the results of our automatic checks, where it stands in review, and when you sent it. Packages are stored by Supabase in the European Union (Frankfurt), and anyone can download a plugin once it is listed.
• Review. The people who review plugins for Flare see the versions sent for review, including every file in them. Their decision and any note they write are kept with the version, shown to you, and emailed to your Flare account's address. If Flare takes a version or a plugin off the store, its package and the reason are kept for the record, and the reason is shown to you and emailed to you the same way. We do not email you about what the automatic checks decide when you publish, since the command line shows it then.
• Publishing tokens. A token you make to publish from the command line is stored only as a one way hash, with its name, its first few characters so you can tell your tokens apart, and when it was made and last used. We show you the token once, when you make it, and cannot show it again. The command line keeps it on your computer in a file only your user account can read. Revoking a token stops it at once.

7. How we use Google user data

Flare's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data means what we receive through Google APIs: your Google name, email address and profile picture, your Google sign in tokens, and the Firebase and Google Cloud data Flare reads for you, such as documents, collection and field names, Authentication users, Storage files, Security Rules and Cloud Functions details.
• We use Google user data only to provide and improve the features you use in Flare.
• We do not sell Google user data or use it for advertising. We share, transfer or disclose it only to the recipients listed in the next section, and only for the reasons given there.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.
• No one at Flare reads your Google user data unless you ask us to for support, it is needed for security or to comply with the law.

8. Who we share Google user data with

These are the only parties that receive Google user data from Flare, what each one receives and why:

• Google. Changes you make in the app, such as editing a document, deploying Security Rules or uploading a file, are sent to your own Firebase and Google Cloud projects. Sign in codes and refresh tokens are sent to Google to get access for the app.
• Railway, which runs the Flare API in the European Union (Amsterdam). Your sign in code or refresh token passes through the API on its way to Google and is not stored. The API also handles your name and email address to run your Flare account, and passes on Flare Assistant requests.
• Cloudflare, which carries encrypted traffic between the app, flare.tools and the Flare API. It does not store Google user data.
• Supabase, which stores our account database in the European Union (Frankfurt). It holds your Google name and email address (for an account first made by signing in with Google, its sign in record also keeps the profile picture address Google gave then, which Flare no longer shows or uses), what you share with a team (see Your teammates below) and crash reports, which have tokens, keys and other secrets removed before they are sent. If you use sync or team folders, it also holds the encrypted copies of your saved connections, which for a Firebase connection contain the project and database IDs you chose and the ID of the Google account each opens through; we cannot read them.
• OpenAI, only when you use Flare Assistant. It receives your request, the Firebase project ID and name, the collection paths and field names and types of your Firestore database, the query you ask about in the Query Builder with the error it failed with, and anything you choose to attach: a query, Security Rules, Cloud Functions details, a Storage listing or document values. OpenAI uses this only to return a suggestion and, under its API terms, does not use it to train its models.
• Stripe, only when you start a checkout or manage billing. It receives your Google email address to create your customer record and send receipts.
• Resend, which sends Flare's emails: confirming your address or choosing a new password, an invitation when you invite someone to a team, and Flare's decision on a plugin you publish. The invitation email it sends includes your name as the person inviting. An email about your plugin goes to your own address, with the plugin's name, the version and the reviewer's note or the reason it was removed.
• Anyone who views the plugin store, only if you publish a plugin. The store shows your plugins with your Flare account's name, which for an account made with Google before Flare had passwords is the name Google provided, unless you change it. It never shows your email address.
• Plugins you install, only if you install one and allow it to read your data. It can read your Firebase data on your computer, through Flare, as the Plugins section above describes, and can pass it on only to the internet hosts it names, which Flare shows you before you install it. It never receives your Google tokens, and Flare itself sends nothing to a plugin's author.
• Your teammates, only when you use team features. People in your team see your Google name and email address, and whatever you share with them: Security Rules, index and schema versions, scripts, and the activity log, which records each change you make: the Firebase project, the operation, the document path, file name or user ID it touched, and whether it worked. Connections you put in a team folder, with the Firebase project and database IDs they carry, are shared with the members of that folder, end to end encrypted.

We may also disclose Google user data when the law requires it, to protect the safety or security of our users or of Flare, or to a company that acquires Flare, in which case we will tell you first and the acquirer must keep to this policy.

The contents of your Firestore documents, the details of your Authentication users and the contents of your Storage files go only to Google, unless you attach them to a Flare Assistant request or allow a plugin you install to read them. We do not share Google user data with any other party.

9. Your Flare account

You make an account on flare.tools or in the desktop app, with your email address and a password. We email you a link to confirm the address, and the account cannot be used until you open it. If someone tries to make an account with an address that already has one, the owner of the address gets an email saying so, and whoever tried is told nothing either way.

To run your account we store:

• Your email address and name, whether the address is confirmed, and a password that we store only as a secure hash, never as the password itself.
• Your avatar, if you choose one, as the next section describes. Flare no longer keeps or shows the picture from a Google account.
• The teams you belong to, your role in each, any permissions granted or taken away for you alone, and the invitations you send, including the email address of each person you invite.
• Your plan and its billing status.
• Whether your account is suspended, and if you publish plugins, whether Flare has marked you a verified author.
• A small number of product events, such as a migration being run or checkout being started, each recorded with your plan, the time and the app version, so we can see which features are used.
• If you use sync: your devices, by the name and platform you give them, their public keys, and the encrypted copies of your items described above.
• If you publish plugins: the plugins and versions you send, and your publishing tokens, kept as The plugin store section above describes.

10. Your avatar

You can choose a picture to show beside your name, on flare.tools or in the desktop app. Adding one is up to you; without one, your initials are shown.

• What we keep. The picture you choose, cropped to a square. The app redraws it before sending it, and the Flare API keeps only the parts of the file that draw the picture, so nothing else in the original file is kept: not where or when a photo was taken, not the camera, not any text or comments in it. We keep it as a PNG, JPEG or WebP of up to 1MB.
• Where. In Supabase Storage in the European Union (Frankfurt), in a private store that only the Flare API can read. The API serves the picture itself; Supabase never shows it to anyone directly.
• Who sees it. You, the people in your teams, and people at Flare whose role lets them see accounts for support. The picture is served at an address that includes a long random part, which cannot be worked out from your account and changes every time you change the picture. Anyone who has that address can load the picture without signing in, as with most avatars on the web, so someone you or your teammates pass it to could see it too.
• Removing it. Remove or replace your picture in Settings on flare.tools, or under Account and connections in the desktop app. The old picture is deleted at once and its address stops working. A browser that already showed it may keep its own copy for up to a day. Your avatar is also deleted with your account.

11. Roles, support and the audit log

We keep an audit log of changes to roles and permissions, in teams and among Flare's staff, and to an account's status, such as a suspension, and of decisions on plugins in the store. Each entry says what changed, from what to what, when, and which account made the change. Entries are never edited or deleted. If an account is deleted, its entries keep only its account ID, not its name or email address.

People at Flare whose role allows it can see accounts and teams to help with support: an account's email address, name, avatar, teams and roles, plan and status, and a team's members, roles and plan. They see nothing of your databases, your saved connections or your synced items.

12. The waitlist

If you join the waitlist on flare.tools, we store your email address, which part of the site you joined from (such as the home page or the waitlist page) and when. You do not need an account, and we store nothing else about you.

We use your address only to tell you when Flare opens to you. We do not use it for anything else, sell it or use it for advertising. It is stored by Supabase, in the European Union (Frankfurt), with the rest of our account database, where only the Flare API and the people who run Flare can read it.

We keep your address until Flare opens to you or you ask us to remove it, whichever comes first. To be taken off the waitlist, email privacy@flare.tools from that address and we will delete it.

13. Payments and email

Payments are handled by Stripe. We never see or store your card details; we keep the Stripe identifiers for your customer record and subscription so we can show your plan and invoices.

Emails about your account, such as the link to confirm your address or to choose a new password, are sent through Resend to your address. Invitation emails are sent through Resend to the address the person inviting you enters.

If you publish a plugin, Flare's decisions on it (a version approved or not approved, or taken off the store) are emailed through Resend to your Flare account's address, with the plugin's name, the version and the note or reason. Nobody else is sent them.

14. Who helps us run Flare

We use these providers, each only for the part of Flare it serves:

• Supabase, for the account database, the waitlist, sign in, avatars and the plugin store, hosted in the European Union (Frankfurt).
• Railway, which runs the Flare API in the European Union (Amsterdam).
• Vercel, which hosts flare.tools.
• Cloudflare, for our domain, network and the storage the desktop app is downloaded from.
• Stripe, for payments.
• Resend, for account and invitation emails, and emails about plugins you publish.
• OpenAI, for Flare Assistant.
• Google, for the Firebase and Google Cloud services you connect and use through Flare.

15. Cookies and your browser

flare.tools does not use advertising or cross site tracking cookies. It keeps your sign in session and your light or dark theme choice in your browser.

16. Keeping and deleting data

We keep your account data for as long as you have a Flare account, and team activity for as long as your team's plan keeps it. Your avatar is kept until you remove or replace it, or delete your account. Encrypted sync copies are kept until you delete them, turn sync off and choose to delete them, or delete your account. A waitlist address is kept until Flare opens to you or you ask us to remove it. A plugin you publish is kept, with its versions, while it is in the store or until you delete your account, and the hashes that count downloads only for the day they are made. The audit log is kept as its section above describes. Other records are kept only as long as we need them to run and improve Flare.

You can ask us to show you, correct, export or delete your data by emailing privacy@flare.tools. You can remove Flare's access to any of your Google accounts at any time at myaccount.google.com/permissions, signed in as that account.

17. Security

Everything between the app, flare.tools and the Flare API travels over encrypted connections. Google tokens, database passwords and keys are encrypted on your computer, synced items are encrypted end to end before they leave it, and access to our systems is limited to the people who need it to run Flare.

18. Children

Flare is not meant for anyone under 16, and we do not knowingly collect their data.

19. Changes to this policy

When we change this policy we update the date at the top of this page, and for changes that matter we tell you in the app or by email before they take effect.