Encrypted
In System Messaging bodies are encrypted at rest (AES-256-GCM), using application-level encryption.
About messagingPrivate by design.
Your system's most personal details deserve a careful home. Here's how we look after them.
We don't sell your data.
We don't train AI on it.
We don't share it with AI providers.
Staff may access your data to provide support, moderate content, handle safeguarding concerns and administer your account.
Shared on your terms
Privacy buckets let you choose what friends can see across your members, groups and profile fields.
Explore privacy bucketsKeys with limits
Give each API resource no access, read access or read and write access, with no wildcard scopes.
Understand API scopesYours to take
Export your active data, including members, notes and settings, as JSON, CSV or an HTML report.
Open export settingsThe details
Account
- Sign-in is handled by Clerk.
- Dashboard sessions and API keys are separate.
- Account deletion is scheduled, with a grace period in which you can cancel.
Data
- Privacy buckets control sharing with friends.
- Exports cover active data, including messaging, front history and privacy settings.
- JSON, CSV and HTML downloads are available in Settings.
- Copies stored on your devices are protected by the device lock, not by extra Florality encryption.
Developers
- API keys can be rotated or revoked.
- New keys are shown once; saved keys show a masked prefix.
- Remote image fetchers check for private IPs and local hostnames.
- Remote image imports require HTTPS and enforce content-type and size checks.
Payments & privacy
- Stripe Checkout handles web payments.
- Florality does not store card numbers.
- Plan state synchronises from Stripe.
- Website analytics are opt-in.
Found a security issue?
Email our security inbox privately with the steps needed to reproduce the issue. We'll acknowledge within 72 hours and work on a fix with you.