Privacy

In short

• The CLI reads your agent’s session logs on your machine. Nothing leaves it until you press Confirm on the review page.
• Before that page opens, secrets are replaced on your machine. What is replaced
• A run is private unless you choose unlisted or public.
• No third-party analytics, no advertising, no tracking. Flatbread counts page views per day, with nothing about who viewed. The only cookies keep you signed in.
• Nothing is sold, and nothing is shared for advertising.

Who we are

Flatbread (flatbread.io, the site, and the flatbread-cli package) is run by its founder, from India. For this policy that is “we”: the one who decides what is done with your data. Write to hello@flatbread.io about anything on this page.

On your machine

flatbread share reads a session log written by your agent and opens a review page served on 127.0.0.1 only. flatbread setup adds the Flatbread MCP server and a skill file to the agents installed on your machine, and flatbread setup --uninstall removes them. Signing in stores a token in ~/.flatbread/token.json; flatbread logout deletes it. The path of the session log on your machine is never uploaded. The CLI talks to flatbread.io and nothing else.

When you share a run

Pressing Confirm uploads the run as the review page showed it, after redaction:

• the prompts, the agent’s messages and steps, its tool calls and their output, and the changes it made to files
• the agent and its version, the model, the folder it ran in (with your username replaced), and the git branch and commit when it ran in a repository
• the title, the kind of job, and counts such as steps, tool calls and lines changed
• which redactions were made: the kind, where, and how long the value was - never the value

Who can open it is yours to choose. Private: your account only. Unlisted: anyone with its link; it is not listed or searched. Public: listed, searchable, and offered to search engines. On the run, Manage run can change that, hide another word or phrase, or delete it.

A session can hold other people’s details, such as a name in a commit or an address in a log. The review page is where you remove them; share only what you have the right to share.

Your account

• Your email address and password, held by Supabase Auth. Flatbread passes the password to it and does not store it.
• If you continue with Google or GitHub instead: it tells Supabase Auth your email address and your name (GitHub also your username there). The address is your account; the names are only offered as your display name and username, which you choose.
• Emails sent to your address: a link to confirm it when you sign up, and a link to set a new password when you ask for one. Nothing else.
• Your handle and display name, shown on the runs you share.
• For each device signed in with flatbread login: a hash of its token, its label, and when it was created and last used. Your runs can sign every device out. A sign-in request expires after ten minutes.
• When your account copies a run’s execution brief, or pulls it with flatbread pull: which run and when, once per run, to count how often a run is reused. Nothing is recorded for a visitor who is not signed in, or for an agent reading through the MCP server.
• If you join the Teams waitlist: the email address you give, and the team size if you pick one.

Cookies and requests

One cookie, fb_session, set when you sign in: it holds your sign-in, scripts on the page cannot read it, and it lasts 30 days, renewed while you use the site; signing out ends it. Continuing with Google or GitHub sets a second, fb_oauth, for 10 minutes: it holds the check that the answer coming back from Google or GitHub is for the sign-in you started, and it is deleted when you return. There is no other cookie and nothing in your browser’s storage. To stop one caller from flooding the search and capsule API, each server keeps a count of requests per address for 60 seconds, in memory, and writes it nowhere.

Like any web host, Vercel sees each request’s IP address and browser details in order to answer it, and Supabase sees them on a sign-in; each keeps its own short-lived logs under its own policy.

Page counts

One number per day for views of the front page, one for views of runs, one for views of the Teams page, and one for fetches of install.md, the file an agent reads to set Flatbread up. Each number is split by the link that brought the visit, read from its utm_source tag and held to a fixed list of channels, such as a post on X or Hacker News; any other tag is counted as “other”. Nothing else is kept with them — no address, no cookie, no account, no browser details. Link previews, crawlers and the page’s own prefetches are not counted, and neither is an author viewing their own run.

Why we use it

• Your account, your runs and the emails about your account: to give you the service you signed up for.
• The device records, the request limiter and the hosts’ logs: to keep the service and your runs secure, which is our legitimate interest and yours.
• Which runs your account copied, and the page counts: to see whether Flatbread is useful. They are counts, never a profile of you.
• The Teams waitlist: your consent, given when you join. Ask us and we remove you.

How long we keep it

• A run: until you delete it, or until your account is deleted.
• Your account, handle and device records: until you ask us to delete the account. Signing a device out deletes its record.
• A sign-in request: ten minutes. The Google or GitHub check: until you return, at most 10 minutes.
• The Teams waitlist: until Teams opens to you, or until you ask to be removed.
• Page counts: kept, because they hold nothing about anyone.

Deleting removes the data from the database at once; copies in Supabase’s own backups expire on its schedule.

Who handles it

• Vercel hosts the site, in Singapore.
• Supabase holds the database and the sign-in, in Singapore.
• Resend delivers the two emails about your account.
• Google or GitHub, only if you choose to continue with them.
• npm serves the CLI when you install it.

Each works under its own privacy policy. Vercel, Supabase and Resend are companies based outside India and may process data in other countries; we use them only to run Flatbread.

Your rights

Wherever you are, you can ask us for a copy of what we hold about you, to correct it, to delete it, to stop using it for a purpose, or to have it in a form you can take elsewhere. Some of it you can do yourself:

• Change who can open a run, hide more of it, or delete it: Manage run, on the run.
• Sign every device out: Your runs.
• Take a run elsewhere: every run you can open is also served as markdown.

For the rest, including deleting your account, write to hello@flatbread.io from the address on your account. We answer within 30 days. If you are in the EU, the UK or another place with a data protection authority, you can also complain to it; in India, to the Data Protection Board of India.

Security

Secrets are replaced before anything leaves your machine. Everything travels over HTTPS. Device tokens are stored as hashes, never as the token. Only the server can read account details and device records; what anyone else can read from the database is what is public. If a breach ever affects your data, we will tell you and say what happened.

Children

Flatbread is for people aged 18 or over. We do not knowingly hold data about anyone younger; if you think we do, write to us and we will delete it.

Grievance officer

For a complaint about how your data is handled, or about a run you think should not be on Flatbread, write to the grievance officer, Flatbread’s founder, at hello@flatbread.io. We acknowledge a complaint within 24 hours and resolve it within 15 days.

Changes

When this policy changes, the date at the top changes with it. A change in what we do with data you already gave us is said on the site before it applies.