Privacy Policy
Last updated: August 28, 2026
1. Introduction
FlutterPlaza ("Company", "we", "us", or "our") operates the FlutterPlaza Code Push service ("Service") available at https://codepush.flutterplaza.com. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Service.
By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.
2. Data We Collect
2.1 Account Information
When you create an account, we collect:
- Email address — used for authentication, account recovery, and service communications
- Name — used for display purposes within the console
Creating an account requires only an email address and a name. Additional details are collected at checkout and through our enquiry forms — see Enquiry and checkout information.
2.2 Application Data
When you use the Service to manage your apps, we collect:
- App metadata — app names, bundle identifiers, platform configurations, channel names, and release version information
- Patch files and snapshots — the compiled update artifacts you upload for distribution to end users
- Release metadata — timestamps, version numbers, channel assignments, and deployment status
2.3 Device and Usage Data
When end-user devices check for and download updates, we collect:
- Device hash — a pseudonymous, non-reversible identifier used solely for counting unique patch installations. It is stable for a given installation, so it distinguishes one device from another, but it carries no name, email, advertising id or device identifier, and we cannot use it to identify a person.
- Patch download events — timestamps and patch identifiers, used for analytics and install counting
- Platform information — operating system and app version, used for patch targeting
2.4 Enquiry and Checkout Information
When you start a paid subscription or contact us through a form on this site, we collect:
- Name and email address — to identify the account and reply to you
- Company name (optional) — for billing records and to route enquiries
- Invoice email address (optional) — where billing documents should be sent, when it differs from your account email
- Selected plan and billing period — to create the correct subscription
- Free-text message — anything you type into an enquiry form. Please do not include passwords, access tokens or other secrets. If you send an enquiry while signed in, it is associated with your account.
Name, email, company and invoice email are passed to our payment processor to create the subscription; see Third-Party Services.
2.5 Technical Data
We automatically collect standard technical data during your use of the Service:
- IP addresses (for rate limiting and security; retained as described in Data Retention)
- API request logs (retained for operational monitoring)
- Browser error reports — if a page on this website throws an unhandled JavaScript error or an unhandled promise rejection, the browser sends us the error message, a JavaScript stack trace, the script filename, the line and column, the page path or view identifier, and a timestamp, so we can fix the fault. This fires only on an error — it is not a page-view tracker, and no report is sent during normal browsing. The report contains no cookie and no account identifier, though a stack trace can incidentally include the name of a page or function you were using at the time.
3. How We Use Your Data
| Purpose | Data Used |
|---|---|
| Account authentication and authorization | Email, name, one-time verification codes |
| Patch delivery to end-user devices | App metadata, patch files, device hash, platform info |
| Usage analytics and install counting | Device hash, download events, timestamps |
| Billing and subscription management | Email, name, company name, invoice email, plan and billing period, usage metrics |
| Service communications and support | Email, name, company name, and the content of any enquiry you send |
| Diagnosing website faults | Browser error reports (message, stack trace, script filename, line and column, page path, timestamp) |
| Security, abuse prevention, and rate limiting | IP addresses, API request patterns |
4. Data Storage and Security
4.1 Infrastructure
All data is stored on Google Cloud Platform infrastructure in the United States (US region). This includes:
- Account and application metadata stored in managed databases
- Patch files and snapshots stored in Google Cloud Storage (GCS)
- Application logs stored in Google Cloud Logging
4.2 Security Measures
We implement the following security measures to protect your data:
- Encryption in transit (TLS/HTTPS for all communications)
- Encryption at rest (Google Cloud default encryption for stored data)
- API key authentication for programmatic access
- JWT-based session authentication for the web console
- Rate limiting to prevent abuse
- Regular security reviews of infrastructure and application code
5. Third-Party Services
We use the following third-party services that may process your data:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing and subscription billing | Name, email, company name, invoice email, and payment method details (payment details are handled directly by Stripe; we do not store card numbers) |
| Brevo | Transactional email delivery (verification, notifications) | Email address, name |
| Google Cloud Platform | Infrastructure, storage, and compute | All service data (stored on GCP infrastructure) |
Each third-party service operates under its own privacy policy. We encourage you to review their policies: Stripe Privacy Policy, Brevo Privacy Policy, Google Cloud Privacy Notice.
6. Data Retention
6.1 Active Accounts
We retain your account data, app metadata, and stored patches for as long as your account remains active and as needed to provide the Service.
6.2 Deleted Accounts
When you delete your account, we will remove your personal data and stored content within thirty (30) days. Certain data may be retained longer where required by law or for legitimate business purposes (e.g., billing records for tax compliance).
6.3 Aggregate Analytics
Aggregated usage statistics (such as total patch installs) may be retained indefinitely once they no longer contain the per-device identifier, as they cannot then be linked back to individual users or accounts.
6.4 Logs
API request logs containing IP addresses are retained for a maximum of ninety (90) days and are then automatically deleted.
6.5 Enquiries and Checkout Details
The details you send through a contact or checkout form (see §2.4) are retained for twenty-four (24) months from your last contact with us, so we can follow up on an ongoing conversation, and are then deleted. This applies whether or not you hold an account: you can ask us to delete an enquiry at any time by writing to support@flutterplaza.com from the address you used, and no account is needed to make that request. Where an enquiry results in a paid subscription, the billing records that follow from it are kept under §6.2 instead.
6.6 Browser Error Reports
Browser error reports (see §2.5) are retained for a maximum of ninety (90) days and are then automatically deleted. They are not covered by §6.3: a stack trace is not aggregate data, and we do not retain it indefinitely.
7. Your Rights
You have the following rights regarding your personal data:
- Access — You can request a copy of the personal data we hold about you.
- Correction — You can update your display name in the console; for any other correction, contact support@flutterplaza.com.
- Deletion — You can request deletion of your account and associated data by contacting support@flutterplaza.com.
- Export — You can request an export of your data in a machine-readable format.
- Objection — You can object to certain processing activities where we rely on legitimate interests.
To exercise any of these rights, contact us at support@flutterplaza.com. We will respond to your request within thirty (30) days.
These rights are not conditional on holding an account. If you only ever sent us an enquiry, you can still ask for a copy of it, a correction, or its deletion — write to us from the address you used so we can find it.
8. Cookies and Browser Storage
The Service sets no cookies. The web console keeps a small amount of data in your browser's storage: two values in local storage, which survives closing the tab, and one group of short-lived markers in session storage, which the browser discards when the tab closes. Both local-storage values are needed for the console to work:
- Authentication token (JWT) — issued when you sign in and sent with each API request to maintain your session. Essential for the console to function.
- Cached account record — the account details returned by the service (including your name, email, plan and account identifier), so the console can render without re-fetching them on every page.
- Interrupted-page markers — so you can be returned to where you were, the console holds up to four values in your browser's session storage: the page, the account identifier it belongs to (or a marker meaning either that no-one was signed in, or that someone was but we could not tell who), the time it was recorded, and whether you had just returned from a completed payment. Two situations write them — a session expiring mid-task, and arriving on a console page without a session, including on return from checkout, in which case no account identifier is involved because none is known. Session storage is cleared by the browser when the tab closes. We clear all four when you sign out. Signing in clears the page, the identifier and the time — for a brand-new account, the console shows your API key first and clears them when you leave that screen, whether you continue or go back to the sign-in page. If you leave it some other way — going back to the page you arrived from, typing an address, opening a bookmark — they stay until you sign out or the tab closes. The payment marker is kept just long enough to tell you the payment went through, and is cleared once it has been shown or as soon as you are sent anywhere that would not show it. One case keeps it longer: if a signed-out visit is already holding a page recorded for a particular account, we leave that visit's values alone rather than overwrite someone else's — so the marker waits there until the next sign-in or until the tab closes.
All of it is removed when you sign out, and you can clear it at any time
through your browser's site-data controls. Because this data is held in
browser storage rather than in an HttpOnly cookie — both
the local and the session kind — it is readable by scripts running on
this site. We serve a Content Security Policy that blocks
externally-hosted scripts and restricts the servers this site can send data to.
We do not use third-party tracking cookies, advertising cookies, or analytics cookies. We do not use pixel trackers or similar tracking technologies.
9. Children's Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us at support@flutterplaza.com and we will promptly delete it.
10. International Data Transfers
Your data is stored and processed in the United States. If you are accessing the Service from outside the United States, you acknowledge that your data will be transferred to and processed in the United States. We take appropriate measures to ensure your data is protected in accordance with this Privacy Policy regardless of where it is processed.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the Service at least fourteen (14) days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.
The revision dated August 16, 2026 is not a material change and took effect on that date. It does not alter what we collect, why we collect it, who we share it with, or your rights; it describes practices already in place that the previous text stated incompletely — principally the browser storage keys in §8, the enquiry and checkout details in §2.4, the retention periods for both in §6, and the deletion route in §7, which names the same support address it always did.
The revision dated August 19, 2026 took effect on that date and rewrites §8. Two of the four interrupted-page markers it describes — the time a page was recorded, and whether you had just returned from a completed payment — are new in the same release as this text, as is the second situation that writes them: arriving on a console page without a session, including on return from checkout. We are saying so plainly rather than presenting them as practices the earlier text understated, because they were not.
It is not a material change. All four values live in your own browser's session storage, are readable only by this site, and are discarded when the tab closes; nothing new is collected by us, nothing new is shared, and none of your rights change. The two new values exist to return you to the page you were on and to tell you a payment went through — and §8 states, for each of them, when it is cleared and the one case where it is not.
The revision dated August 28, 2026 took effect on that date. The console no longer keeps a copy of your API key in your browser. It was written there at every sign-in and sign-up and read by nothing — the key shown to you after registration and the list in the console's Settings page both come from the service directly — so a long-lived credential was being stored for no purpose. The bullet describing it is gone from §8 because the practice is gone, not because it stopped being disclosed.
It is not a material change, and it reduces rather than expands what is held: nothing new is collected, shared, or retained. If you signed in before this release your browser may still hold the old copy; signing out removes it, and the console deletes it on sign-out for exactly that reason. You can also clear it at any time through your browser's site-data controls.
12. Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
FlutterPlaza
Email: support@flutterplaza.com
Website: https://codepush.flutterplaza.com