Flurra Privacy Policy

How Flurra handles your content, AI requests, and connected account data.

Optional creator workflow answers

In Account settings, you can optionally tell us your creator role, the content and editing work you do, your editing experience, tools, production setup, main difficulty, how you prefer AI assistance, and your broad country and content language. We use these first-party answers to understand which creator workflows need better examples, onboarding, controls, and support. You can skip questions, edit your answers, or delete them in Account settings. These answers belong to your sign-in account, not to a client brand you manage. We remove them when you delete your Flurra account.

In workspace Preferences, you can also optionally describe a creator or brand you manage: its content type, audience relationship, input sources, business model, broad audience/team/client size, content language, visual style interests, and broad monthly business revenue or editing spend bands. These answers are attached to that creator profile, not to your personal identity. They help us improve workspace examples, editing workflows, collaboration, and pricing research. You can skip, edit, or delete them in Preferences. They are removed when you delete your Flurra account.

A separate, optional research study may ask for demographic or accessibility information only after we publish its specific purpose, questions, eligibility, and retention period and ask for a separate choice to participate. No such sensitive study is currently open. Study answers are kept outside routine product analytics and are not used to set your price, account access, or creator ranking. Participants can withdraw and delete their linked answers. We retain only reviewed, de-identified aggregate findings after the study's stated deletion date.

Editor and onboarding measurement

We record account-linked steps and bounded interaction summaries, such as which onboarding step was viewed, whether an editor tool was opened or kept in an export, and whether a preview or export failed. These new measurement events use fixed categories, counts, and bounded durations rather than your written answers, prompts, footage, transcripts, or other authored content. We use them to find confusing steps, improve editing tools, and compare outcomes across creators who voluntarily answered profile questions. Limited summaries are also sent to our product analytics provider. Raw first-party measurement events expire after 90 days; an account deletion removes these first-party events sooner.

Account deletion also queues a request to remove the linked person, events, and session recordings from our product analytics provider. That provider processes deletion asynchronously. We retain a limited deletion job record while retrying the request and checking the completion status the provider makes available.

Connected Instagram, TikTok, and YouTube accounts

Flurra lets users connect Instagram, TikTok, and YouTube through each platform's authorization screen. We only read social account data after the user signs in to the platform and authorizes Flurra.

• Instagram, TikTok, and Google/YouTube access tokens are exchanged server-side.
• Access and refresh tokens are encrypted before they are stored in Flurra's backend database.
• Tokens are never stored in localStorage and are never exposed in client-side API responses or browser state.

Data Flurra reads

After authorization, Flurra may read profile information, posts or videos, and available analytics or insight metrics needed to show creator performance and AI content recommendations.

Platform data access depends on the scopes approved by Instagram, Meta, TikTok, Google, and the user. If a scope is unavailable, Flurra shows a limited-data state instead of treating the account as failed.

Optional Instagram inbox and Threads connection

You can separately authorize Flurra to read comments on your Instagram media and messages sent to your professional account, and to send replies from your inbox. These features use the instagram_business_manage_comments and instagram_business_manage_messages permissions. Instagram supplies the conversation history shown in your inbox. Flurra does not send inbox content to AI providers for keyword matching.

If you enable a keyword rule, Flurra checks incoming comments or direct messages for the words you selected, including while your inbox is closed. For a matching comment, Flurra sends the public reply or private message you chose. For a matching direct message, it replies in that conversation. You can pause a rule in your inbox.

Flurra stores your rules, reply text and delivery records. These records use Instagram identifiers, including message or comment IDs and recipient IDs where needed, plus timestamps and delivery status to process replies and prevent duplicates. Keyword matching does not save the incoming text. Separately, workspaces using team lead suggestions may save a relevant comment or message excerpt, the sender's username when available, and a link to the source interaction so the team can review it.

An optional Threads connection uses threads_basic to verify your Threads identity and display your own posts. Threads credentials are encrypted server-side. This connection does not authorize publishing or access to private conversations. Public-profile research remains a separate feature. You can remove the connection from Connections in your workspace.

YouTube API Services and Google user data

Flurra uses YouTube API Services. By connecting a YouTube account, you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Flurra requests read-only access to YouTube data (the youtube.readonly and yt-analytics.readonly scopes). If you turn on publishing, Flurra also requests the youtube.upload scope, which it uses only to upload a video you explicitly choose to publish, with the title, description, visibility, and publish time you set. With the read-only authorization, Flurra reads your channel profile, your recent videos, and their performance analytics — including view, like, and comment counts and audience retention curves — and stores them in Flurra's backend database to power your dashboards and content insights. Stored YouTube data is refreshed on an ongoing basis (retention analytics typically weekly, and in all cases at least every 30 days) so it stays consistent with what YouTube reports.

Flurra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Flurra does not:

• use Google user data for serving personalized or targeted advertising;
• sell Google user data, or transfer it to data brokers, advertising platforms, or other information resellers;
• use Google user data to train, develop, or improve generalized or non-personalized AI or machine-learning models;
• use Google user data for determining credit-worthiness or for lending purposes; or
• allow humans to read Google user data, except with your affirmative consent for specific data, for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymized and used for internal operations.

Any AI processing of Google user data is performed solely to provide or improve the specific user-facing Flurra features you request, and only by data processors bound to those same Limited Use restrictions.

Disconnecting YouTube from Flurra settings revokes Flurra's Google authorization and deletes the stored connection, tokens, and the YouTube Analytics data Flurra captured through the API. You can also revoke Flurra's access at any time from your Google security settings. If you delete your Flurra account, stored Google user data is deleted with it — Flurra does not retain YouTube data after the connection or account it belongs to is gone, except where retention is required by law.

How Flurra protects your data

Flurra treats connected-account data — including the Google user data it obtains through YouTube API Services — as sensitive, and protects it with the safeguards below.

• Encryption in transit. All traffic between your browser or the Flurra app and Flurra's servers, and between Flurra and Google's APIs, is encrypted with TLS 1.2 or higher. Flurra sends an HTTP Strict Transport Security header on every response, so browsers refuse to reach Flurra over plain HTTP.
• Encryption at rest. Flurra's database and its backups are encrypted at rest by its managed hosting providers. On top of that, every Google OAuth access and refresh token is individually encrypted with AES-256-GCM authenticated encryption before it is written to the database, using a key held only in Flurra's server environment and never stored beside the data it protects.
• Credentials never reach the client. The OAuth code exchange, token refresh, and every YouTube Data API and YouTube Analytics API call run server-side. Access and refresh tokens are never returned in API responses, never written to browser storage, cookies, or device storage, and never written to application logs or error reports.
• Authenticated, per-account authorization. Flurra accounts are authenticated through a managed identity provider (Clerk) that supports email verification and multi-factor authentication. Every request for connected-account data is authorized on the server and scoped to the signed-in user's own account and workspace, so one user cannot read another user's Google data.
• Protected authorization flow. The authorization request Flurra sends to Google carries a signed, expiring HMAC-SHA-256 state value that is bound to an httpOnly, SameSite cookie and compared in constant time when Google returns, so a third party cannot attach a YouTube channel to a Flurra account it does not own.
• Least privilege. Flurra requests the read-only youtube.readonly and yt-analytics.readonly scopes by default. The youtube.upload scope is requested only when you turn on publishing, and it is used only for uploads you start yourself. Flurra holds no editing or channel-management access and never posts, modifies, or deletes anything on its own.
• Restricted internal access. Production credentials, environment secrets, and database access are limited to the small number of authorized personnel who need them to operate the service, and are held in managed secret stores rather than in source control. Staff do not read Google user data except with your affirmative consent, to investigate abuse or a security incident, or where required by law. Access is reviewed and credentials are rotated when personnel or providers change.
• No onward exposure. Google user data is excluded from Flurra's product analytics and error-monitoring events, is never sold or transferred to data brokers or advertising platforms, and is disclosed only to the AI processors named below, which are contractually bound to the same Limited Use restrictions and may use it solely to deliver the feature you asked for.
• Bounded retention and deletion. Flurra stores only the YouTube data needed for the features described above, keeps it refreshed against YouTube, and deletes it — together with the stored tokens — when you disconnect YouTube or delete your Flurra account.
• Incident response. If Flurra becomes aware of a security incident affecting Google user data, it will investigate, revoke and rotate the affected credentials, delete or restore affected data as appropriate, and notify affected users and any applicable regulator without undue delay. Security concerns can be reported to support@flurra.io.

Disconnecting and deletion

Users can disconnect Instagram, TikTok, or YouTube from Flurra settings. Disconnecting removes Flurra's stored connection for that platform and prevents future syncs unless the user reconnects.

Users can also request deletion of connected account data by emailing support@flurra.io. See the dedicated data deletion instructions for details.

How data is used

Flurra uses authorized social data to populate dashboards, summarize performance by platform, show top posts, and generate contextual content insights for the user. Flurra does not sell connected account tokens. Publishing features act on posts you submit. Instagram replies can be sent manually or through a keyword rule you enable for your account.

To deliver AI features you request, Flurra sends relevant content to third-party AI services, including Anthropic (Claude), Google (Gemini), OpenAI, xAI (Grok), Sapient (Ultra video analysis), and Higgsfield (image generation). Which service receives the content depends on the feature and the models used for that request. The Google user data restrictions described above continue to apply to AI processing of that data.

Content shared for AI features

Depending on the feature you choose, the information sent for AI processing can include your prompts and chat messages; photos, video, and audio you select; transcripts and extracted video frames; creator preferences and brand context; and relevant content and analytics from accounts you authorize. Flurra uses this information to provide the writing, research, recommendations, captions, video analysis, or editing or image generation you request. Social account access tokens are not included in AI prompts.

When you speak to Fiori on the web, Flurra sends the microphone clip to OpenAI for transcription. On iPhone, supported devices transcribe your speech on the device. When you send a voice message, its transcript becomes part of your Flurra chat history. Flurra does not save the microphone recording in that history. You can type in the same conversation at any time.

The iOS app asks for your explicit permission before starting a new AI request or uploading content for AI processing. The disclosure names the AI services and explains what may be shared and why. Choosing Not now cancels the pending AI request; you can continue using features that do not require AI sharing. Your choice is saved for your signed-in Flurra account on that device. You can withdraw permission in the app's AI data-sharing settings. Withdrawal applies to new requests; it does not undo processing already started or delete previous conversations and results. Use Flurra's deletion controls or the data deletion instructions to manage stored content.

AI assistants you connect to Flurra

If you choose to connect a compatible AI assistant to Flurra, you authorize that assistant to request data from your own Flurra workspaces through the permissions shown during sign-in. Read access covers saved creator preferences and brand context, connected-account summaries and recent content signals, saved drafts and their revision history, saved ideas, internal content plans, and video projects, including original footage and rendered videos through temporary download links. Optional write access lets the assistant save an idea you supply to your Idea Bank and upload edited videos as separate Flurra projects. File and editing tools you choose may download and process those videos outside Flurra. Flurra checks the account, workspace ownership, and permissions on each request. This connection does not provide social account tokens or permission to publish content, change billing, or edit existing drafts.

These assistants are services you choose to use separately from Flurra. Their handling of the information you share is governed by their own terms, privacy policies, and your settings with them. Connecting an assistant is optional. Review its privacy and data-use settings before sharing unpublished content or private brand information. Flurra's restrictions on Google API data described above continue to apply.

You can disconnect Flurra in the assistant's connector settings. Contact support@flurra.io if you need help revoking a Flurra authorization or deleting data stored in Flurra. Disconnecting does not delete content already copied into an assistant's conversations or storage; use that service's controls or contact it to manage those copies. Deleting your Flurra data follows our data deletion instructions.

Contact

Questions or deletion requests can be sent to support@flurra.io.