Privacy Policy

What Fludge does

Fludge is an AI creator platform that lets you upload images, train a personalized subject or LoRA style model, generate new images, manage your gallery, and optionally connect YouTube to upload videos and view analytics.

Personalized training note: Any “training” features in Fludge refer to user initiated, per user personalized models based on content you upload to Fludge. We do not use data obtained via Google/YouTube APIs to train generalized or foundational AI models.

Fludge is a multi tenant service. Your data is scoped to your user account. Fludge also supports multiple creator personas under one account (creator identifiers used to organize and filter content and settings).

Information we collect

Account and profile information

• Email address and authentication data for sign in (for example, magic link or one time passcode).
• Profile and settings information, such as display name, language, timezone, theme, and feature preferences.
• Creator persona information (for example, creator name and creator identifiers).

User content and content you generate

• Images you upload (including any metadata included in the file, such as EXIF metadata, if present).
• Generated images, thumbnails, videos, and other media you create or store in Fludge.
• Prompts, parameters, and related metadata used to provide generation, editing, or training features (for example, seeds, aspect ratios, trigger words, and provider metadata).
• Workflow artifacts and project assets you create in Fludge, such as scripts, captions, transcripts, edit manifests, and related files.

YouTube connection and YouTube API data

If you connect a YouTube channel, we may process and store information such as:

• Channel identifiers and basic channel metadata (for example, channel ID and channel title).
• Upload actions you initiate (for example, uploading a video, setting metadata, uploading a thumbnail).
• Analytics information retrieved via YouTube APIs, such as KPIs, retention metrics, and traffic sources, which we may store in Fludge to show you analytics over time.

Google Postmaster analytics

If you connect Google Postmaster Tools, Fludge stores your Google account identifier and email address, encrypted authorization tokens, and cached daily spam-rate statistics for sending domains you are authorized to view. This separate connection requests read-only traffic access and basic account identity. It does not access Gmail messages or change your YouTube connection.

These statistics describe a whole sending domain and may include other email providers. They do not identify individual Gmail complainants. We use them only to display the requested Email Analytics. They are not used for advertising or AI model training and are not sent to AI providers. Disconnecting Postmaster in Fludge removes its local tokens, account identity and cached statistics. You can also revoke Fludge's Google authorization in your Google Account permissions.

Billing and payment information

• Subscription plan status, credits, and billing related identifiers.
• Stripe customer and subscription identifiers.

Payment card details are processed by Stripe and are not stored by Fludge.

Technical, usage, and security information

• Request metadata and logs needed to operate and secure the Services (for example, timestamps, error logs, and basic request logs). Our hosting and infrastructure providers may also process IP address and user agent as part of normal web delivery and security.
• Operational records such as job status, workflow identifiers, rate limiting events, and idempotency records.

Marketing and communications data

• Subscription status and marketing preferences.
• When the sender enables tracking, email engagement signals such as a tracking image being requested or a link being clicked, associated with a message and contact, event timestamps, and the email provider's limited bot classification. These signals do not prove that a person read or clicked the email. Fludge does not store raw recipient IP addresses or user-agent strings in its email engagement records.
• Tagging and segmentation data used to organize audiences and tailor communications.

How we use information

We use personal information to:

• Provide, operate, and maintain the Services, including authentication, storage, and account management.
• Process uploads, training, and generation requests, and return outputs to you.
• Run background workflows that support long running tasks (for example, training, generation, post processing, and cleanup).
• Process payments, subscriptions, credits, fraud prevention, and accounting.
• Provide support and respond to requests.
• Protect the Services, prevent abuse, enforce policies, and troubleshoot issues.
• Comply with legal obligations and protect rights, safety, and security.

How we share information

We do not sell personal information.

We share information with service providers that help us operate the Services. These providers process information on our behalf under contract and only as needed to provide their services to us.

Service providers may include:

• Hosting and infrastructure providers (for example, Vercel).
• Authentication, database, and storage providers (for example, Supabase).
• Workflow orchestration providers (for example, Inngest).
• Payment providers (for example, Stripe).
• AI inference providers (generation and analysis): We may share prompts and user provided content with AI providers to generate outputs you request (for example, text generation, image generation, transcription, video generation, avatar rendering, or music generation), such as OpenAI, fal.ai, BFL API, HeyGen, Mubert, and Google Gemini.
• Model training providers (personalized models): Where Fludge offers user initiated personalized training, we use providers and infrastructure that process only the user’s uploaded training data for that user’s model. We do not use Google/YouTube API data for this purpose.
• Amazon Web Services (AWS), including Amazon Simple Email Service (SES), for email delivery and handling delivery and engagement events (for example, opens and clicks).
• Google and YouTube APIs when you connect YouTube or Google Postmaster Tools and use their related features.

For example, when we use OpenAI's API as an AI inference provider, OpenAI states that it does not use API data to train or improve its models unless the customer explicitly opts in. We do not opt in to such training.

We may also share information:

• If you direct us to do so (for example, when you choose to connect YouTube or upload content).
• To comply with law, respond to lawful requests, or protect rights, safety, and security.
• In connection with a business transaction (for example, a merger or acquisition), as permitted by law.

YouTube API Services and Google user data disclosures

This app uses YouTube API Services

Fludge uses YouTube API Services to enable YouTube connection, uploads, and analytics features.

YouTube Terms of Service: https://www.youtube.com/t/terms

Google Privacy Policy: https://policies.google.com/privacy

Your control over YouTube data and access

You can disconnect YouTube inside the app. You can also revoke Fludge's access through Google's security settings page: https://security.google.com/settings/security/permissions

If you revoke access through Google's security settings page, we will delete YouTube API data (including any data derived from it) in Fludge that was accessed or stored based on that authorization.

Disconnect and Delete YouTube Data

Fludge provides "Disconnect" and "Delete YouTube Data" controls.

When you disconnect or request deletion, we revoke tokens and remove stored YouTube tokens from Fludge. We also delete YouTube API data (including any data derived from it) stored in Fludge as described below.

"Delete YouTube Data" deletes YouTube API data (including any data derived from it) stored in Fludge. It does not delete content on YouTube itself. To delete content on YouTube, you must use YouTube or other authorized tools.

Validity checks

We periodically reconfirm that authorization tokens remain valid. If tokens cannot be refreshed, we will disconnect the channel and delete YouTube API data (including any data derived from it) stored in Fludge that was accessed or stored based on that authorization.

Google API Services User Data Policy and Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to provide user facing features that you request and that are prominent in the Fludge user interface, such as connecting your YouTube channel, uploading content you choose to upload, and showing analytics.

We do not use Google/YouTube user data obtained via Google APIs (including any data derived from it) to create, train, or improve any generalized, foundational, or frontier AI/ML models. We use such data only to provide user facing features that you request, and only as permitted by the Google API Services User Data Policy and Limited Use requirements.

We do not use Google user data for advertising purposes, and we do not sell Google user data.

Marketing communications

Fludge and customers using its marketing email features may send marketing communications where permitted. When enabled by the sender, open tracking uses a small remote image and click tracking uses links routed through Amazon Simple Email Service (SES) before reaching the intended destination. SES processes the network information needed to serve that image or redirect, including IP address and user-agent data, and may classify activity as likely automated. Fludge uses the resulting limited events to provide email performance reports.

Senders can disable open or click tracking in the Creator's email settings, or disable both for an individual marketing email. Open tracking is initially off. Changes apply to future sends; they cannot remove tracking from emails already delivered. Non-marketing and test messages sent through this feature do not use engagement tracking.

Depending on the recipient's country and applicable law, prior consent may be required for email tracking. The sender is responsible for providing required notices and obtaining that consent before enabling tracking. Consent to receive emails does not automatically include consent to tracking. The availability of these controls does not determine whether a particular use is lawful.

Mail privacy features, image blocking, caching, forwarding and security scanners affect opening and click measurements. The bot filter excludes events the provider identifies as likely automated, but cannot establish that all remaining activity is human. Opening or clicking an email does not by itself grant or renew marketing consent.

Recipients can unsubscribe through the link in a marketing email. For communications sent by a Fludge customer, contact that sender about tracking consent or your privacy rights. For Fludge's own communications, contact privacy@fludge.io; you can also unsubscribe or contact support@fludge.io to stop marketing emails.

Even if you opt out of marketing emails, we may still send you non marketing emails that are necessary to provide the Services, such as account, security, billing, or transactional messages.

Cookies and local storage

We use cookies and similar technologies that are necessary to run the Services, such as:

• Essential authentication and session cookies.
• Short-lived OAuth state cookies to protect connected-provider authorization, including Google Postmaster.
• A YouTube OAuth state cookie used to help protect the OAuth flow and prevent fraud.

We also store certain preferences locally in your browser (for example, theme settings in local storage).

We do not use third party advertising cookies. We use Vercel Web Analytics to understand page views and usage, and it does not use third party cookies.

Data retention

We retain personal information for as long as necessary to provide the Services and for legitimate business purposes, such as security, troubleshooting, and compliance.

Our retention goals by category include:

• YouTube tokens and YouTube API data (including any data derived from it): retained while your YouTube connection is active. After you disconnect, revoke consent, request "Delete YouTube Data", or delete your Fludge account, we revoke access and delete YouTube API data stored in Fludge as soon as possible and within 7 calendar days.
• Training intermediates (for example, training ZIP files): automatically deleted about 7 days after creation.
• Job and workflow debug payloads: about 30 days, after which we delete or minimize them. These payloads are designed to exclude YouTube API data (and data derived from it). If any such data is captured, it is deleted within 7 calendar days as described above.
• Idempotency records: about 7 days.
• Rate limiting events: about 30 days.
• Stripe webhook event payloads (raw): about 60 days, after which we delete or minimize them.
• Provider usage records (cost and performance metadata): about 90 days.
• User content (uploads, generated media, models, projects): retained until you delete it or request account deletion. After deletion requests, we aim to remove data promptly and complete storage cleanup within a reasonable period (commonly up to 30 days), subject to backups and legal obligations.
• Detailed marketing email open and click events and link records: up to 90 days. Per-message engagement counts, first-event timestamps, and report contact associations: up to 395 days after the message is created or sent, subject to earlier deletion. Reports may retain delivery totals without those engagement details or contact associations. Subscription, consent, audience tags and suppression records follow their separate operational purposes. After an unsubscribe, we retain the minimal opt-out record needed to honor that preference and prevent future marketing sends.
• Minimal native email history: original delivery records and sparse monthly first/last observations may remain for current contact relationships, subject to an explicit annual necessity review by the sender. These summaries do not retain message bodies, clicked URLs or detailed engagement counts. Removing the contact removes this retained history. Previously deleted history cannot be recovered.
• Google Postmaster data: encrypted authorization and a bounded cache of requested domain statistics remain while the connection is active. Disconnecting removes them. Deleting the connected account, Creator or organization also removes its connection and cached statistics.

If you request deletion, we may retain certain information as required by law or for legitimate purposes such as fraud prevention, security, and accounting.

Account deletion

You can delete your Fludge account in the app settings.

When you delete your account, we will delete or deidentify personal information associated with your account, including your stored content, subject to the retention and legal exceptions described above. We aim to complete account deletion within a reasonable period (commonly up to 30 days), and we will delete YouTube API data stored in Fludge within 7 calendar days as described above.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These may include access controls, encryption in transit (HTTPS), database access policies, token protection for connected integrations, rate limiting, and other measures.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

Your choices and rights

You may be able to:

• Access and update certain profile information in the app.
• Delete certain content you uploaded or generated.
• Disconnect YouTube and request deletion of YouTube API data stored in Fludge.
• Delete your Fludge account in the app settings.

You can also contact us to request access, deletion, or export of personal information by emailing privacy@fludge.io. We may need to verify your request.

California privacy rights

If you are a California resident, you may have rights under California privacy laws, depending on applicability, including rights to know, access, delete, and correct certain personal information.

We do not sell personal information, and we do not share personal information for cross context behavioral advertising.

International transfers

We are based in the United States, and our service providers may process data in the United States and other locations. If you access the Services from outside the United States, your information may be transferred internationally.

Children

Fludge is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will take appropriate steps.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, if changes are material, we will provide additional notice within the Services or as required by law.

Contact us