How Flagship handles your information.

This policy applies to flagship.is, www.flagship.is, and the web applications Flagship designs, hosts, and operates (including but not limited to D3, GymPulse, CleanFleet Command Center, and Managed Reporting Services). Individual applications may publish their own, additional notice — where they conflict, the application’s notice governs that application.

• Your email address (for sign-in via magic link or Google OAuth)
• Your name, when you provide it
• The information you choose to enter into a Flagship application — including records, contacts, accounts, and documents specific to that application’s purpose
• Documents you upload (stored privately in our object store, accessible only to you and your authorized collaborators)
• Standard server logs (IP address, user agent, timestamps) for abuse prevention and operational reliability

• Encryption passphrases for applications that use client-side encryption — those never leave your device
• The contents of records you store inside Flagship applications, for the purpose of building an advertising profile about you
• Anything we don’t need to deliver the service you signed up for

We use the information you provide to operate the application you signed up for: to authenticate you, store your records, render the interfaces you interact with, and respond when you ask for help. We do not sell your information, and we do not use the contents of your records or uploaded documents to build advertising profiles. Some Flagship applications display third-party advertisements (see “Advertising” below).

In short: row-level isolation in Postgres so users can only see their own data; AES-GCM-256 client-side encryption for the most sensitive fields in applications that warrant it; HTTPS everywhere; and signed, time-limited URLs for document access. Encryption keys for client-encrypted fields are derived from passphrases that never leave your device, so even Flagship cannot read those fields server-side.

We share the minimum necessary with the following processors:

• Supabase — database, authentication, and file storage. Fields encrypted client-side remain unreadable even to Supabase, because the encryption key never leaves your browser.
• Vercel — application hosting and content delivery for our public sites and applications.
• Google— only if you choose “Sign in with Google.” We receive only the email address and name on your Google account, and only the scopes needed for sign-in.
• Anthropic — only when you explicitly use a feature in a Flagship application that involves AI processing (for example, document scanning), and only for the specific content you submit. Files are sent via short-lived signed URLs and are not retained by Anthropic per their privacy policy.
• Sentry, PostHog, and Axiom — for error tracking, product analytics, and server log aggregation. These services receive only the information necessary to detect and debug issues, never the contents of encrypted fields or uploaded documents.
• Google AdSense— for the advertisements that appear in some Flagship applications. See “Advertising” below for what is and isn’t shared.

We never sell your data.

To keep the core experience of some Flagship applications free, we display ads served by Google AdSense. AdSense is a third party and may use cookies, web beacons, and similar technologies to serve ads that are more relevant to you based on your prior visits to this and other sites. We do not share the contents of your records, uploaded documents, or any client-side-encrypted fields with AdSense or any other advertising network — AdSense only sees the pages you visit inside a Flagship application that displays ads, the standard signals your browser sends to any website (IP address, user agent), and Google’s own advertising cookies if you have them.

You can opt out of personalized advertising from Google by visiting Google’s Ads Settings or, for any participating network, the Digital Advertising Alliance opt-out. Opting out doesn’t remove ads, just the personalization layer.

Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this site or other sites. Google’s use of advertising cookies enables it and its partners to serve ads to users based on their visit to our sites and/or other sites on the internet.

We use a small number of strictly necessary cookies for authentication and session management. Flagship applications that display ads (see “Advertising” above) also cause Google AdSense to set its own cookies for ad serving and frequency capping; those cookies are governed by Google’s advertising-cookie policy. We don’t use cross-site trackers or fingerprinting of our own. Anonymous, aggregate usage analytics may be collected to understand how applications are used.

You may export, modify, or delete your data at any time through your account settings, or by emailing privacy@flagship.is. Most Flagship applications include an in-product export that produces a complete snapshot of every record we hold for you — for applications with client-side encryption, fields are decrypted in your browser before the file is written, so you always own the readable copy.

Deleting your account permanently removes your records and uploaded documents from our systems within 30 days. Backups are encrypted and rotated within 60 days.

If we discover a security incident that may have exposed your personal information, we will notify affected users by email within 72 hours of confirmingthe scope of the incident. The notice will describe what was accessed, what we’re doing about it, and what you can do to protect yourself. We’ll also notify the relevant authorities where required by law.

Flagship applications are intended for adults. We do not knowingly collect personal information from anyone under 13, and we will delete any such information we become aware of.

Flagship is operated from the United States. By using our services, you understand that your information will be processed in the United States. We make a reasonable effort to align our practices with applicable privacy laws including GDPR and CCPA; residents of those jurisdictions may exercise their statutory rights by contacting us at privacy@flagship.is.

We’ll update the “Last updated” date below whenever this notice changes. Material changes will also be communicated to active users by email at the address on file.

Privacy questions: privacy@flagship.is.

General contact: hello@flagship.is.