The short version
Recording stays on your PC unless you explicitly upload a clip. Flashback does not sell personal information, build advertising profiles, or scan your local library. Cloud needs enough account, file, and security data to host the clips you choose.
Local app data
Replay segments, clips, screenshots, clip metadata, custom sounds, preferences, and diagnostic logs are stored on your device. Flashback accesses them to provide the features you use. They are not sent to Cloud merely because the app is running.
The optional participation count uses a daily rotating anonymous token for an approximate number of devices seen within 30 minutes. It is not an account total. The token does not include a clip, game name, hardware profile, account, setting, or feature history and can be disabled in Settings.
Cloud account data
Before Discord sign-in, the Cloud page asks for a date of birth to perform a neutral age-eligibility check. The date is processed only for that decision and is not stored. We retain that the age gate passed, the agreement versions, and the time. When you continue with Discord, we receive your Discord user ID, display name, and avatar reference. When you continue with Google, we receive your Google account ID, name, profile picture reference, and email address if Google has verified it. Either way we also keep security token records, plan and storage usage, and account lifecycle timestamps. Discord and Google sign-in tokens are used once to read that profile and are then revoked. A Discord sign-in and a Google sign-in are separate Cloud accounts.
Uploaded content
For each chosen upload, we store the MP4, poster image, title, size, duration, dimensions, frame rate, codec details, random share identifier, and upload state. We also record the day a share link was last viewed and count privacy-preserving daily unique viewers.
Flashback does not use uploaded clips to train an AI model or target advertising.
Network and security data
Cloudflare processes connection information such as an IP address to deliver and protect the service. Flashback turns the address into a secret-keyed, rotating value for rate limits and short-lived unique-view counting instead of storing the raw address in its application database. Operational logs use random request IDs and are normally retained for no more than 30 days unless needed for a documented security, abuse, or legal matter.
Billing
Cloud subscriptions are sold through Link, Stripe's checkout service, as merchant of record. Link and Stripe collect and process your payment details, email address, billing address, and tax information, send your receipts, and run their own fraud controls under their own privacy policies. Flashback never receives your full card number.
Flashback stores the Stripe customer, subscription, and checkout identifiers; your plan, subscription status, and paid-through date; any refund or dispute hold on paid storage; and a record of the automatic renewal terms you agreed to, when you agreed, and the amount and currency charged. We keep that consent record for at least three years, or one year after the subscription ends if that is longer, even if the account is deleted, because consumer-protection law requires it.
Support requests
When you contact support through the website, the app, or email, we store your email address, the name you give, your message and our replies, and the kind of request. A request from the app can include the Flashback and Windows versions, and one sent while signed in to Cloud is linked to that account. A secret-keyed, rotating value derived from your network limits how many requests one connection can send; the raw address is not stored. Support email is delivered through Resend.
People who work on Flashback see account and support data only as far as their role needs, and every change they make is recorded in an audit log. Support conversations are deleted two years after they close, and messages marked as spam after 30 days.
Why we use data
We use data to provide requested features, authenticate accounts, enforce quotas, process billing, keep links working, prevent abuse, measure service health and cost, answer support and legal requests, and comply with law. Depending on where you live, the legal basis may be performance of a contract, legitimate interests in security and operation, consent, or legal obligation.
Service providers
Cloudflare provides application delivery, database, security, and object storage. Discord and Google provide sign-in. Stripe and its Link service sell the subscriptions, process payments, and handle sales tax, receipts, and payment support. Resend delivers email from Flashback. Discord also carries private operational alerts to the owner about billing and service problems; they contain account and payment identifiers, never clip content. These providers process data under their own terms and privacy notices. We may disclose information when legally required, to protect people or the service, or as part of a properly structured business transfer.
Retention
Cloud clips stay while your plan is active until you delete them. Cloud has no free storage: 30 days after a plan ends, all of the account's cloud clips are permanently deleted, and after a move to a smaller plan the oldest clips beyond it are deleted after 30 days, as described on the Billing page. The app shows the date in advance. Abandoned upload reservations expire within hours. Sign-in handoffs expire within minutes. Refresh sessions normally expire after 30 days and rotate when used. Short-lived unique-view records are removed after about eight days; aggregated counts can remain.
An account-deletion request cancels any paid plan, disables sharing immediately, and normally purges active content within seven days. Provider recovery copies roll off under bounded backup schedules and are not returned to active use. Billing, renewal-consent, dispute, safety, and legal records are retained as required.
Your choices and rights
You can avoid Cloud entirely, disable the anonymous active-user count, rename or delete a shared clip, export Cloud account data, cancel a paid plan, sign out, or request Cloud account deletion in the app. Depending on where you live, you may also have rights to access, correct, delete, restrict, object, or appeal.
Send a privacy request to flashback.business.support@gmail.com. We may need to verify account ownership before acting.
Children
Flashback Cloud is not available to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 created an account, contact flashback.business.support@gmail.com so we can investigate and remove it.
Security and international use
We use short-lived upload permissions, encrypted transport, Windows-protected desktop tokens, hashed server tokens, rate limits, access-controlled administration, and recovery procedures. No service can guarantee perfect security.
Cloud infrastructure may process information in the United States and other locations where providers operate. Public availability by country will be limited until the corresponding privacy, consumer, and tax requirements are ready.
Changes and contact
We will post changes here with a new version date and request renewed acceptance when a material Cloud change requires it.
Privacy and legal questions can be sent to flashback.business.support@gmail.com.