Privacy

The website and your account

The website has no advertising and nothing that follows you across other sites. It counts visits and a few actions without knowing who you are, as described below. An account is optional: you can browse the store, read the help and download FlipMatic without one.

Who we are

FlipMatic is made by InkConfetti, which decides how the data described here is used and is responsible for it (the "controller"). Write to [email protected] with any question about it. We read every message and answer as soon as we can, usually within a few days.

Browsing

The site is hosted by Cloudflare, which delivers every page and protects the site; like any web host, it sees your internet address to do that. The site sets no cookies of our own.

Your FlipMatic account

If you create an account, it is held by Google Firebase, which we use for sign-in and for your library:

• Sign-in (Firebase Authentication): your email address, your password (Firebase keeps only a scrambled form of it, never the password itself), the name you give if you give one, and when you signed up and last signed in.
• Your library (Cloud Firestore): the name of each theme you add and when you added it. Nothing else.
• A connection to the app, only if you connect FlipMatic: a random connection key for each computer you connect, kept with your account, and a copy of your library's theme names under each key, which the app on that computer reads. Each copy holds your account's internal number, the theme names and when it last changed; it holds no email address and no name. Disconnect in My Library deletes all of them.

Your account and library are stored in the United States. When you use an account feature, your browser loads Firebase's code from Google (www.gstatic.com), and Firebase keeps you signed in, in your browser's own storage, until you sign out. Once you have signed in, the site also keeps a note in your browser, with your name and the list of themes in your library, so every page shows them at once; signing out removes it. A visitor who never signs in loads nothing from Google.

We use your email address to sign you in and, if you ask, to send a password reset. We do not send newsletters and we do not share it or sell it.

How we count visits

To learn which themes people like and where the site is hard to use, the site counts a few things in PostHog, an analytics service, on its servers in the European Union, without knowing who you are:

• that a page was opened, and the name of the site that linked to it, if any;
• that a theme or bundle was viewed or added (its name);
• that a download button was pressed (for which system);
• that the sign-up box was opened, and that creating an account or signing in worked or why it did not (for example, that the account already exists);
• that a password reset was sent, that FlipMatic was connected, and that an account was deleted.

With each, the page's address on this site and a random number made for that one count, so no two counts can be tied together or to you. No email address, name or account number is sent, no cookie is set, and nothing is stored in your browser for this. PostHog is asked not to work out a location from your internet address, and our PostHog project discards it. If your browser sends Global Privacy Control or Do Not Track, the site counts none of these.

Cloudflare, which hosts the site, also counts visits with Cloudflare Web Analytics: which page was opened, the site that linked to it, and the country and kind of device, which Cloudflare works out and keeps only as totals. It uses no cookies and stores nothing in your browser.

The prank remote page

The page a phone opens from the app's code (flipmatic.app/p/) sends only what the app's policy below describes under The prank remote: the moment the button was pressed and whether to wait 5 seconds. The code stays in the page's address after the # sign, so it is never sent to our website.

Downloads

The installer is downloaded from download.flipmatic.app, which is Cloudflare's file storage. Like any download, it carries your internet address; it names the file and nothing else.

Why we use it, and for how long

• Your account, library and connections are used to give you the service you signed up for. They are kept until you delete them or your account, and deleted at once when you do.
• The anonymous counts are used to improve the site, which is our legitimate interest. They cannot be tied to you, so they hold nothing about you to delete.
• Your internet address, seen by Cloudflare and Google like by any service on the internet, is used only to deliver the site and keep it safe.

Your account and library are held by Google in the United States, under Google's data processing terms for Firebase.

Your rights

You can see what your account holds, correct it, take a copy of it, object to how it is used, or delete it. To delete your account, open My Library, choose Delete account and confirm with your password: your sign-in, your library and every connection to the app are deleted at once, and themes already installed in FlipMatic stay on your computers. Removing a theme from your library deletes that entry at once. For everything else, write to [email protected] from the address you signed up with.

If you think we got something wrong, tell us first so we can fix it. You can also complain to the data protection authority in your country.

The account is not meant for children under 13.

The FlipMatic app

The whole of it

FlipMatic has no advertising and no tracking across other apps or websites. The app itself never asks who you are. A FlipMatic account exists only on the website, is optional, and the app works fully without one.

It uses the internet for the things below, each set out in full further down:

• Usage statistics: which features are used, and errors, under a random identifier that does not name you. They are on when you install the app, and one switch turns them off.
• A check for a new version, once a day, in the Windows and Mac apps.
• Themes from the FlipMatic store, when you install one.
• Your website library, only if you connect this computer to your FlipMatic account.
• The prank remote, only in a Halloween theme with a scare, and only while you have switched the remote on.
• The weather line, only if you switch it on. It sends one pair of coordinates and nothing else.

None of them sends your phrases, your reminders or your name, and only the weather line sends a location.

What it keeps, and where

Your settings and the phrases and reminders you type are saved in the app's own private storage on your machine (browser local storage inside the app's own profile folder), so that the clock looks the same tomorrow as it did today.

Your phrases and reminders never leave that folder. They are not synced, not backed up to us, not readable by us, and not sent anywhere. A few of your settings, the ones listed under usage statistics below, are counted in the usage statistics; nothing else is. Uninstalling the app or clearing its data removes all of it, and nobody has a copy.

Usage statistics

The app sends short reports of how it is used, so that we can see which features people use and what goes wrong. They carry no name, email address, account or location, only the random identifier described below. Because that identifier ties the reports of one installation together, the law treats them as pseudonymous rather than anonymous, and so do we. You can turn this off in the settings, on the Clock tab: Share usage statistics (in the Windows and Mac 1.0.1 downloads: Share anonymous usage statistics). Once it is off, nothing more is sent, anything waiting to be sent is thrown away, and the random identifier described below is deleted from your device.

• Where it goes. PostHog, an analytics service, on its servers in the European Union (eu.i.posthog.com). It goes nowhere else.

• What is sent.

• When the app starts: the app version; whether it is the Windows app, the Mac app or a web browser; the language of the board; which theme is on (its name, and whether it is built in or installed); whether the clock shows 12 or 24 hours; and the size of the screen as a range, for example "1920-2559 pixels".
• When you use certain features: that the theme changed and how (from the theme library, by the favorites rotation, by shuffle or by the arrows); that a theme was installed and how (from a store link, from your website library or from a file); how many favorites you have; that a timer was started and for how many minutes; that the weather line was switched on; that the new-version notice was shown and whether its Download button was pressed; and the name of a setting you changed, never what you changed it to.
• When something goes wrong in the app: the first 120 characters of the error message, with any web address, file path, email address or quoted text taken out.

• With each of these: the time, the app version, the platform, and a random identifier. The identifier is made on your device the first time a report is made. It is not derived from your device, your account or anything about you; it only lets reports from the same installation be counted together.

• What is never sent. Your phrases and reminders, the place you typed or the location of your device, your name or email address, your account connection, the names of files, web addresses, and the value of any setting other than the ones listed above.

• Your internet address. Every request on the internet carries one. The app asks PostHog not to work out a location from it, and our PostHog project is set to discard it, so it is not stored with the reports.

• When. In small batches: at most once a minute while the app runs, and once more when it is closed or hidden. While the computer is offline, up to the last 100 reports wait in memory and are sent when it is back online; nothing is written to disk for this.

Checking for a new version

The Windows and Mac apps check once a day whether a newer version exists. They ask our own website (flipmatic.app, or flipmatic.pages.dev if that does not answer) for one small file that holds the newest version number. The request carries nothing about you or your clock: no identifier and none of your settings.

If a newer version exists, the settings panel says so. In the installed app it offers Update: the app downloads the new version from our download server (download.flipmatic.app), checks that the file is exactly the one we published and that it is signed by us, installs it and opens again. Only that download is made, and it carries nothing about you. With Install updates automatically switched on (it is off unless you turn it on), the same happens by itself the next time FlipMatic starts. A copy that cannot update itself offers Download instead, which opens the download page in your web browser. Not now hides the notice until the next version. The version that runs in a web browser, and the App Store versions, do not check: the App Store updates those.

Themes from the FlipMatic store

When you install a theme from the FlipMatic store, the app downloads that one theme from our website (flipmatic.pages.dev, or flipmatic.app). The request names the theme and nothing else. Every theme is signed by us, and the app checks the signature before anything is kept; a theme that does not pass is thrown away.

Your website library

This is optional. If you have a FlipMatic account on the website and press Connect FlipMatic there, the app asks you whether to connect this computer. From then on, the themes you add to your library on the website appear in the app by themselves.

• What the app keeps. One random connection key, made on the website, and saved with your settings. It is not your password and says nothing about you.
• What the app reads. The list of theme names in your library, from our database at Google Firebase (firestore.googleapis.com). The request carries the connection key and nothing else. The app never writes anything there.
• When. When the app starts, when you open the theme library, when you come back to the window (at most once a minute), and otherwise once an hour.
• What it does with the list. It downloads the themes that are missing, exactly as under Themes from the FlipMatic store. It never removes a theme and never changes the theme on your clock.
• Disconnecting. Press Disconnect in the app's theme library, or disconnect on the website. After that the app reads nothing.

Your account itself (your email address and your library) is held by the website, and the website's own privacy page describes it.

The prank remote

Some Halloween themes have a scare. In those themes, and only while one of them is on, you can switch on a prank remote: the clock shows a code, you scan it with a phone, and a button on the phone makes the scare happen.

• Where it goes. Our Firebase Realtime Database, in the European Union (firebasedatabase.app, europe-west1). The phone page is on our website.
• What is sent. A random code made when you switch the remote on, the moment it was switched on, and, from the phone, the moment the button was pressed and whether to wait 5 seconds. Nothing about you, your clock or your phone.
• When. Only while the remote is on. Switching it off, changing the theme, or 30 minutes without a scare closes the connection and deletes the code and everything sent with it.

The weather line

The bottom bar can show the temperature. It is switched off when you install the app, and while it is off nothing is sent for it. If you switch it on:

• Where the request goes. api.met.no, the public forecast service of the Norwegian Meteorological Institute. Nothing from the weather line is sent to us or to the usage statistics.

• What the request contains. A latitude and a longitude, rounded to two decimal places, in the address itself. Nothing else at all: no name, no identifier, no account, no cookie, none of your settings, none of your phrases, not the fact that you have any.

Two decimals is about a kilometer. It is not your address or your street, and it is still close enough to get the right town's weather. Version 1.0.1 of the Windows and Mac apps from flipmatic.app rounds to three decimal places (about a hundred meters); the next version rounds to two everywhere.

• How often. At most four times an hour, and only when the previous answer has expired.

• Where the coordinates come from. The Mac, iPhone and iPad apps use only a place you type, and never your device's location. (Two versions 1.0.1 can still ask the system when the place is left empty, and the system asks you first: the iPhone and iPad app, and the Mac app from flipmatic.app.) In the Windows app, two ways, and you choose which:

1. You type a place. The coordinates for it are looked up in a list that ships inside the app. Typing in that box contacts nobody: the suggestions you see as you type are read out of the app, not fetched.

2. You leave the place empty. Then the app asks your computer where it is. On Windows the app does this without a question of its own, and only while the weather line is on; Windows' own location setting still decides whether a location is available at all. If the computer cannot say where it is, the weather line simply does not appear and nothing is sent. Nothing else in the clock changes.

The coordinates are used for the request and thrown away. They are not stored, except that a place you typed yourself is kept in your settings, on your machine, like every other setting.

What it does not do

• No sign-in inside the app, no advertising ID, no cookies. The only identifiers are the random one described under usage statistics, the connection key if you connect your library, and the prank remote's code while it is on.
• No updates you did not choose. The app installs a new version only when you press Update, or by itself if you switched on Install updates automatically, and only a file that is signed by us.
• No camera, no microphone, no contacts, no files of yours.
• No fonts, images or scripts fetched from anywhere. Everything the app draws is inside the app, except a theme you choose to install from the FlipMatic store, which is downloaded from our website.
• No third-party SDKs. The usage statistics, the library and the prank remote are reached by the app's own code; the only outside code inside the app is a small QR-code generator (MIT License) that draws the prank remote's code.

One honest footnote, because this document should not round anything off. The Windows version draws through WebView2, a component made by Microsoft and part of Windows. It is not ours and we do not control it: Microsoft keeps it up to date through Windows, and it carries Microsoft Defender SmartScreen. Microsoft's own terms for including it ask that you be told this, and we would have told you anyway. Nothing about your clock is involved: not your phrases, not your settings, not the fact that you opened it.

Children

The app collects no personal information from anyone, of any age.

Changes

If a future version collects or sends anything this page does not describe, that is a change to what the product is. It will be written here and in the release notes, and this page will be rewritten before that version ships.

Contact

Questions about this policy: [email protected]