Privacy

Last updated 1 November 2026

Flame is a private space for two people. It's run by st. This page says what we keep, who can see it, and how to take it with you or delete it. There are no ads, we don't sell or share your data for advertising, and nothing you write is used to train AI models.

What we keep

Your account: your email address, name and profile picture from the way you sign in (email, Apple or Google), and the birthday, timezone and pronouns you choose to add. If you answer “What brings you here?” when you join, we keep your answer to pick where Today starts; only you see it, and you can skip it.
What the two of you make: memories, letters, notes, answers, how you're each doing (your energy and what you need that day), photos, videos, voice notes, drawings, places and dates. Photos can carry the time and place they were taken; we use that to sort and map them.
Arcade games: who invited whom to which game, and each match's result (who won, the score, how long it took and a few counts like the longest rally). Your moves are never stored. While you play, they go straight from one of your devices to the other when your networks allow it, so each device sees the other's IP address, and a STUN service (Cloudflare or Google) helps the two find each other. Otherwise they go through Ably, encrypted with a key only your two devices get.
To run the app safely: the devices you get notifications on (and whether recent notifications reached them), the notifications in your bell (a title like “Sam 🫶”, never what was written), a log of security events (sign-ins, linking, exports, deletions) with no content in it, counts of how much storage and assistant use your space takes, and your IP address for at most an hour to limit repeated attempts.
On your phone or computer, so Flame opens fast: a copy of what Today shows (names, counts, which photos, what's waiting for you) and the photos you've seen recently. It never includes letters, notes or anything either of you wrote. It stays on that device only, for a week at most, and signing out of it removes it. Photos and videos you add to Memories or Photos are also kept there until they've finished uploading (a week at most), so a closed tab or a lost connection doesn't lose them; signing out removes them too.
For home-screen widgets on your phone: a key for that phone (we keep only a scrambled copy of it) that can fetch nothing but the widgets' pictures: your partner's newest Right now photo, your canvas and your garden, drawn by us at the widget's size. The phone keeps the last pictures so the widgets work offline. Anyone who can see your home screen can see them, so add them only where that's fine. Signing out, signing out of every device, or 90 days without use removes the key.

Who can see it

Your partner sees what you share with them. Anything marked “only me” is yours alone. Blind questions and the Sunday check-in stay hidden until you've both answered.
Letters, time capsule entries, repair notes, sticky notes, appreciations, the Sunday check-in and what you need in your own words are encrypted before they're stored. Photos and files are kept in private storage and opened only through links issued to the two of you that expire within a day.
We don't read your space. Our logs hold IDs and counts, never what you wrote, and notifications and emails never quote it. We would only look at an account's state (never its content) to answer a support request, or if the law requires it.

Services that help run Flame

These companies process data for us, under their own security and privacy terms, only to provide their part of the service: Clerk (sign-in), Neon (database), Cloudflare R2 (photo and file storage), Inngest (background jobs), Resend (email), Ably (live updates, drawing, presence and arcade games), Cloudflare and Google STUN (finding a direct connection between your two devices in a game), Upstash (rate limiting), MapTiler (map tiles, and turning a place you search for, or where you are when you ask, into a name), Vercel (hosting), GitHub (runs our backup jobs, and builds each yearly archive of your space, which means reading it while it's made), Backblaze B2 (a second copy of our backups and those archives), and Expo with Apple, Google and Mozilla push services (notifications, which can name a fixed choice, like a tap or how much energy someone has, but never include what you wrote; on the iPhone, one your partner sent also carries their name and a link to their profile photo, so it can show their picture; a silent one, with nothing shown and only the name of a widget in it, tells your phone's widgets to redraw). The assistant uses Google's Gemini API on a paid plan. It's on for a new space, and it's one switch for the two of you: either of you can turn it off (or back on) for both in Settings. While it's on, and only when one of you uses it, it sends the parts of your space it needs to answer you, suggest a title and tags, write your Year in Review, or suggest dates (for those: what you picked, the area you typed and the names of wishlist places there, never your location). Under Google's terms for paid use, none of it is used to train or improve Google's models; Google keeps it for a limited time only to detect misuse.

If you buy a paid plan, the payment provider named at checkout takes the payment. Your card or bank details go to them, never to us; we keep only what's needed to run your plan and answer billing questions: which space it's for, who paid, the plan, the amount, the dates and the provider's reference. See Pricing and Cancellations and refunds.

Cookies and storage on your device

Flame sets only the cookies signing in needs. Clerk, our sign-in provider, uses them to keep you signed in and to protect accounts, and while you sign up a Cloudflare check may make sure you're a person.
There are no analytics, advertising or tracking cookies, and nothing from other sites follows you here, so there's nothing to accept or decline.
Your browser also keeps a few things for Flame on that device only: choices like the theme and sounds, a draft while you're writing it, and the copy of Today described above. You can clear it any time from your browser's settings.

How long we keep it

Things you delete go to the trash for 30 days, then they're gone.
Notifications stay in your bell for 180 days after you've read them, and a year at most. Signing out of a device, or out of every device, stops notifications reaching it straight away.
If either of you unlinks, your shared space is paused, not deleted. Neither of you can use it, both of you can download it for 90 days, and then it's deleted. Either of you can delete it sooner (the other gets 14 days' notice to download it first).
Deleting your account removes your sign-in and profile. A space you shared is paused as above, so your partner can still download it.
A download you ask for in Settings → Export is deleted when its link expires, a day after it's made.
Backups are kept for 30 days, plus one a month for 6 months. Each of you also gets a yearly archive of your space in our backups; only the newest is kept, and it goes when your space is paused or deleted. Something deleted leaves our backups within about 7 months.

Your choices

Download everything, any time: Settings → Export.
Delete things, unlink, or delete your account, in Settings.
Turn notifications, emails and the assistant on or off in Settings.
Ask what we hold about you, or to correct or delete it: write to privacy@tryflame.app. How deleting your account works, step by step: Delete your account.

Age

Flame is for people 18 and older. We delete accounts we learn belong to someone younger.

Changes

If this page changes in a way that matters, we'll tell you in the app before it takes effect. Questions: amangupta.main@gmail.com.

What we keep

Your account: your email address, name and profile picture from the way you sign in (email, Apple or Google), and the birthday, timezone and pronouns you choose to add. If you answer “What brings you here?” when you join, we keep your answer to pick where Today starts; only you see it, and you can skip it.

What the two of you make: memories, letters, notes, answers, how you're each doing (your energy and what you need that day), photos, videos, voice notes, drawings, places and dates. Photos can carry the time and place they were taken; we use that to sort and map them.

Arcade games: who invited whom to which game, and each match's result (who won, the score, how long it took and a few counts like the longest rally). Your moves are never stored. While you play, they go straight from one of your devices to the other when your networks allow it, so each device sees the other's IP address, and a STUN service (Cloudflare or Google) helps the two find each other. Otherwise they go through Ably, encrypted with a key only your two devices get.

To run the app safely: the devices you get notifications on (and whether recent notifications reached them), the notifications in your bell (a title like “Sam 🫶”, never what was written), a log of security events (sign-ins, linking, exports, deletions) with no content in it, counts of how much storage and assistant use your space takes, and your IP address for at most an hour to limit repeated attempts.

On your phone or computer, so Flame opens fast: a copy of what Today shows (names, counts, which photos, what's waiting for you) and the photos you've seen recently. It never includes letters, notes or anything either of you wrote. It stays on that device only, for a week at most, and signing out of it removes it. Photos and videos you add to Memories or Photos are also kept there until they've finished uploading (a week at most), so a closed tab or a lost connection doesn't lose them; signing out removes them too.

For home-screen widgets on your phone: a key for that phone (we keep only a scrambled copy of it) that can fetch nothing but the widgets' pictures: your partner's newest Right now photo, your canvas and your garden, drawn by us at the widget's size. The phone keeps the last pictures so the widgets work offline. Anyone who can see your home screen can see them, so add them only where that's fine. Signing out, signing out of every device, or 90 days without use removes the key.

Who can see it

Your partner sees what you share with them. Anything marked “only me” is yours alone. Blind questions and the Sunday check-in stay hidden until you've both answered.

Letters, time capsule entries, repair notes, sticky notes, appreciations, the Sunday check-in and what you need in your own words are encrypted before they're stored. Photos and files are kept in private storage and opened only through links issued to the two of you that expire within a day.

We don't read your space. Our logs hold IDs and counts, never what you wrote, and notifications and emails never quote it. We would only look at an account's state (never its content) to answer a support request, or if the law requires it.

Services that help run Flame

Cookies and storage on your device

Flame sets only the cookies signing in needs. Clerk, our sign-in provider, uses them to keep you signed in and to protect accounts, and while you sign up a Cloudflare check may make sure you're a person.

There are no analytics, advertising or tracking cookies, and nothing from other sites follows you here, so there's nothing to accept or decline.

Your browser also keeps a few things for Flame on that device only: choices like the theme and sounds, a draft while you're writing it, and the copy of Today described above. You can clear it any time from your browser's settings.

How long we keep it

Things you delete go to the trash for 30 days, then they're gone.

Notifications stay in your bell for 180 days after you've read them, and a year at most. Signing out of a device, or out of every device, stops notifications reaching it straight away.

If either of you unlinks, your shared space is paused, not deleted. Neither of you can use it, both of you can download it for 90 days, and then it's deleted. Either of you can delete it sooner (the other gets 14 days' notice to download it first).

Deleting your account removes your sign-in and profile. A space you shared is paused as above, so your partner can still download it.

A download you ask for in Settings → Export is deleted when its link expires, a day after it's made.

Backups are kept for 30 days, plus one a month for 6 months. Each of you also gets a yearly archive of your space in our backups; only the newest is kept, and it goes when your space is paused or deleted. Something deleted leaves our backups within about 7 months.

Your choices

Download everything, any time: Settings → Export.

Delete things, unlink, or delete your account, in Settings.

Turn notifications, emails and the assistant on or off in Settings.

Ask what we hold about you, or to correct or delete it: write to privacy@tryflame.app. How deleting your account works, step by step: Delete your account.