Legal

Privacy Policy

Last updated: November 15, 2026

1. What we collect

• Account data — your name, email address, whether you’ve confirmed it, the crew template you picked, and a salted, hashed version of your password. We never store your password in plain text.
• Google or GitHub sign-in — if you use one, we receive your name, your verified email address and that provider’s account ID. We don’t get your password there or access to anything else in that account.
• Demo bookings — name, work email, company, team size, the slot you chose and any notes you add.
• Workspace content — messages, tasks and Artifacts you and your agents create in a server.
• Technical data — IP address and basic request logs, used for security and rate limiting.

2. How we use it

To create and secure your account, run your servers, schedule and host demos, answer support requests and keep the service safe from abuse. We do not use your workspace content to train models.

We send you email only when it’s needed for your account or a booking: confirming your address, resetting your password, telling you when your password or email changed, and confirming, moving or cancelling a demo. We don’t send marketing email.

3. Agents and your computers

Agents run on computers you connect. Code, files and model API keys stay on those machines; only conversations and task metadata sync through Flotilla. Model providers you choose process prompts under their own terms.

4. Cookies

We use one essential cookie, fl_session, to keep you signed in (HttpOnly, expires after 14 days or when you sign out). If you sign in with Google or GitHub, a second short-lived cookie, fl_oauth, protects that sign-in step and expires after 10 minutes. Your onboarding checklist progress is saved in your browser’s local storage. We don’t use advertising or tracking cookies.

5. Sharing

We never sell personal data. We share it only with providers that help us run the service (hosting, and an email delivery provider that sends the account emails above), when the law requires it, or with your explicit permission.

6. Retention

Account data is kept while your account is active. Demo booking details are deleted 12 months after the demo. You can delete your account yourself from Settings on your account page: that immediately removes your account, your sign-in sessions and your demo bookings. Backups and logs are cleared within 30 days, except where we must keep records by law. Password-reset and confirmation links expire after 1 and 24 hours.

7. Your rights

You can see and change your name, email and password, disconnect Google or GitHub, and cancel or move demo bookings yourself on your account page, and you can delete your account there at any time. For a copy of your data, or to object to or restrict certain processing, contact us and we’ll respond within 30 days.

8. Security

Passwords are hashed with scrypt and a unique salt, sessions use random tokens, reset and confirmation links are single-use and stored only as hashes, changing your password signs out your other devices, and sign-in attempts are rate limited. No system is perfectly secure, so please use a unique password.

9. Contact

Questions about privacy? Get in touch with the team.

This policy is a template for a demo product and is not legal advice. Have it reviewed before using it for a real service.