← Flare

Privacy Policy

Last updated: 17 August 2026

Flare is a relational-communication assistant. The content you bring here is, by its nature, sensitive — it is about your relationships, your feelings, and the messages you are trying to figure out how to send. This policy describes exactly what we collect, why, who else sees it, and what you can do about it.

We have written it to describe what the app actually does today, not what it might do later. When that changes, this page changes.

1. Who we are

Flare is operated by Xuexuan Liu.

Questions about this policy or your data: shally.liu@flareai.me

2. What we collect

Account data

• Email address — used to sign you in and send transactional mail (verification, password reset). Stored with our authentication provider, Supabase.
• Authentication tokens — created at sign-in and stored on your device in the operating system's encrypted keystore.
• Apple sign-in data — if you use Sign in with Apple, we receive a verified identity token and the email address you choose to share. If you later delete your account, we briefly process a single-use Apple authorization code so we can revoke Flare's access. The code and the resulting Apple token are not stored.
• Google sign-in data — if you use Continue with Google, Supabase receives your email address and basic profile information made available by Google's standard openid, email, and profile scopes. Flare uses this information only to create and authenticate your account. We do not request your contacts, photos, calendar, or other Google service data.

If you use Sign in with Apple, you may choose Apple's Hide My Email option. We will then only ever see a relay address, never your real one.

Content you create

• Cases — the messages, conversation excerpts, and context notes you type or paste into Flare.
• Relationship context — the names or labels you give the people you are writing about, and any notes you add about them.
• Generated reflections — the Mirror, Deep analysis, Cards, and reply drafts Flare produces in response to what you wrote.

Usage data

• Anonymous event analytics — only if you turn them on. Analytics are off by default and stay off until you enable them in Settings. When enabled, we record that an event happened (for example case_submitted) with a timestamp and a randomly generated device identifier. We never record the content of your cases in analytics.
• Crash diagnostics — device model, OS version, and the crash stack trace, if crash reporting is enabled for the build you are running. No case content is included in a crash report.
• Pseudonymous safety signals — if on-device checks detect a high-risk pattern, we store a hashed case identifier, a pseudonymous account binding, the signal category, timestamp, and review status. Conversation text is not included in the safety record.

What we do not collect

• No camera, photo library, or microphone access. Screenshot text extraction and voice input are not available in this version, and the app ships without those permissions declared — it cannot request them.
• No location, contacts, or calendar.
• No advertising identifiers. We do not advertise to you, we do not sell or share your data with advertising networks, and we do not track you across other apps or websites.

3. Who else processes your data

Each service receives only what it needs to do its job.

Service	Purpose	What it receives
Supabase	Database and authentication	Email address, authentication data, your cases
Anthropic	Generates the Mirror, Deep, and reply outputs	The text of a case, at the moment you ask for a reflection. Anthropic does not use API inputs or outputs to train its models by default.
Apple	Sign in with Apple and token revocation on deletion	Identity token and shared email; a short-lived authorization code during Apple-linked account deletion
Google	Continue with Google	Email address and basic profile information supplied through Google's standard sign-in scopes
Sentry	Crash diagnostics, where enabled	Device model, OS version, stack trace. No case content.

Your case text is sent to Anthropic only when you actively ask for a reflection. It is not sent in the background, and it is not sent for any other purpose.

Anthropic may retain API inputs and outputs for up to 30 days under its standard API terms, unless a different retention arrangement applies, and may retain limited data longer where required for safety or legal reasons.

You can withdraw consent for AI processing at any time in Settings → AI processing. Flare will stop sending your content for generation. Reflections already produced remain readable.

4. Where your data lives, and for how long

• On your device. Your cases are stored in Flare's private local app database. The operating system protects the app sandbox according to your device security settings, and Flare adds an app lock when it moves to the background. Flare does not currently apply separate database-level encryption to case content. Local cases stay until you delete them, delete your account, or remove the app.
• On our servers. Account data and synced cases are held on Supabase infrastructure in the United States (US West, Oregon).
• Automatic cleanup. The text of cases older than 30 days is cleared automatically by a scheduled job. The case record and its reflections remain; the original conversation text does not.
• Consent records. We keep a log of consent and deletion events, as we are legally required to. After account deletion these records no longer identify you.
• Safety records. Pseudonymous safety-signal records are kept for safety operations until reviewed or deleted. Records linked to a registered account are erased when that account is deleted. They contain no conversation text.

5. Your rights

• Access. Settings → Privacy & data → Export my data returns a JSON file containing your relationships, cases, events, preferences, and consent history.
• Deletion. Settings → Delete account. This is immediate, not a scheduled request: your server-side data and your authentication identity are erased in the same operation, and local data on your device is cleared at the same time. It cannot be undone.
• Withdraw consent. Analytics and AI processing each have their own switch in Settings, and either can be turned off without affecting the other.
• Object, correct, or complain. Write to shally.liu@flareai.me. If you are in the EU or UK, you may also complain to your national data protection authority.

If you are a California resident, the CCPA gives you the right to know what we collect, to have it deleted, and not to be treated differently for exercising those rights. We do not sell personal information.

Deleting an account created with Apple

If you signed in with Apple, deleting your account also revokes Flare's Apple tokens, so Flare disappears from your Apple ID's list of connected apps. You will be asked to confirm with Apple during deletion — that confirmation is what allows the revocation to happen. We never store an Apple credential in order to do this.

6. Legal bases for processing (EU/UK users)

What	Basis
Your case content and relationship notes	Consent — Art. 6(1)(a)
Account data and authentication	Contract — Art. 6(1)(b)
Consent and deletion audit records	Legal obligation — Art. 6(1)(c)
Pseudonymous safety-signal metadata	Legitimate interest — Art. 6(1)(f)

7. Children

Flare is for people aged 13 and over. We do not knowingly collect data from anyone younger. If you believe a child under 13 has an account, write to shally.liu@flareai.me and we will delete it.

8. Security

We use TLS in transit, encrypted server storage, operating-system protected credential storage, scoped tokens, and least-privilege access. Supabase row-level security restricts server data to the authenticated account that owns it. Local case content is stored in Flare's private app database and is not separately encrypted at the database layer.

No system is perfectly secure. If you find a vulnerability, please write to shally.liu@flareai.me rather than disclosing it publicly. We aim to respond within 48 hours.

9. Changes

If we make a material change — a new processor, a new category of data — we will tell you inside the app before it takes effect, and update the date at the top of this page.

10. Contact

shally.liu@flareai.me