D-ALabs LLC (“D-ALabs”, “we”, “us”) runs Flasklings: the CLI (with its collector and agent plugin), flasklings.com and app.flasklings.com. The desktop app isn’t available yet; this policy covers it once it is. This policy explains what personal information we process, why, for how long, who helps us process it, and what your rights are. It follows the Personal Information Protection Act of the Republic of Korea.
This policy is published in Korean and English. If the two differ, the Korean version prevails.
The short version
- You need an account to use Flasklings. Of what a CLI linked to your account records on your computer, we receive only daily totals, the agent subscription value and live status.
- We never collect your prompts, code, file contents, commands, tool input or output, your agent’s replies, or the names and paths of your projects.
- We keep what we need to sign you in and to run your pets, growth, essence, rankings and purchases. Your activity reaches us only as daily totals and, if you use it, live session status.
- Nothing is public until you publish your profile, and you choose what it shows. Other accounts on the same agent subscription do see that you share it (section 4).
- We don’t sell personal information, show ads, or use analytics or tracking tools.
1. What is read and kept on your computer
To show your pet’s state and your usage, the CLI (with its collector) and the agent plugin read the following on your computer:
- your coding agent’s events: event and tool names, the working folder, the session ID and the like. Session IDs are used only as hashes;
- the session files your agent keeps on your computer: model names and token counts;
- the git history and settings of the working folder: the number of commits you authored;
- your agent’s sign-in files and settings: whether you use a subscription, and the organization and user IDs that tell it apart.
Of this, they keep only what’s listed below, in the .flaskling folder in your home directory and similar places, and drop the rest once it’s read:
- a random install ID;
- each session’s activity times and token usage, for 7 days;
- daily totals, your pets and essence, and a copy of your account information, until you remove them;
- the number of commits you authored, and commit hashes used only so a commit isn’t counted twice. Commit messages and changes are never stored;
- the token that connects the device to your account, in your operating system’s credential store (such as the macOS Keychain).
Usage-limit percentages are shown on screen and never stored. When another Flasklings program on the same computer asks for it (for example, the chat bubble of the desktop app, once it’s out), the CLI reads a session’s conversation text and hands it to that program. The text is never stored or sent off your computer.
Of what the CLI records, only the daily totals, agent subscription value and live status in section 2 leave your computer, and only once the device is linked to your account. Calls to our server also carry the device connection details, your IP address and program details: the CLI’s name and version, your kind of operating system and the Node.js or Bun version (sections 2 and 5). If you turn on starting at login in flaskling setup, the collector starts when you log in to your computer, and a linked device sends its daily totals every 30 minutes even with no flk window open. flaskling setup --remove turns this off. CLI plugins made by others that you install yourself aren’t ours, and this policy doesn’t cover what they process.
2. What we process, why and for how long
When you create an account or connect a device, we process the information below. We process it to provide the Service you signed up for, and, for your public profile and rankings, because you chose to turn them on.
| Information | Why | How long |
|---|---|---|
| Sign-in account Kept by Supabase for us: your email address, your user ID with each sign-in method (GitHub, Google, email), the name, username and profile picture address GitHub or Google shares (with a Google Workspace account, its organization’s domain too), when you signed up and signed in, sign-in session records (session ID, refresh token, and the IP address and browser of the device you sign in on), the hash and send time of the link token if you sign in with an email link, and Supabase’s logs (an audit record of sign-in activity such as signing in, signing out and deleting the account, and a record of the requests Supabase receives: user ID, email address, IP address, browser, request address and time). Kept on our server: your Supabase user ID, and if you sign in with GitHub, your GitHub user ID and username (the email address and name that come inside the sign-in token with each request aren’t stored). GitHub and Google access tokens are never stored on our server. During sign-in Supabase holds one briefly and deletes it when sign-in finishes (or after about a day if it doesn’t); right after sign-in one may sit in your browser’s sign-in session (section 6), and it’s gone at the latest when you sign out. | To sign you in, send sign-in links, suggest a handle and check who can join the rankings | Until you delete your account. A sign-in link expires after 1 hour and works once. Sign-in session records: until you sign out. Supabase’s logs: 1 day |
| Sessions and devices A one-way hash that tells sign-in sessions apart (the session itself stays in your browser and at Supabase, see the row above and section 6), and for each connected device its name, permissions, when it was connected and last seen, and a one-way hash of its token. | To keep you signed in and let you manage your devices | Session hashes: 90 days, or until you delete your account if that comes first. Device records: until you delete your account (a revoked device stays, marked revoked, and its token and live status are removed at once) |
| Profile and game data Your handle and past handles, display name, time zone and its changes, whether and when you confirmed you are 14 or older, your publishing settings, pets with their names, looks and what they wear, items, and your essence balance and history. | To check your age and run your pets, growth, essence and the store | Until you delete your account. A past handle redirects to the new one for 30 days |
| Daily totals from connected devices For each day: its time zone; work time and time with a session open, by coding agent and model; token counts by type; the number of commits you authored; and the IDs of the device and collector that recorded them. | For growth and essence, to show usage by subscription, and for rankings if you opt in | Until you delete your account |
| Agent subscription value (if you use a subscription) If you use Claude Code with a Claude sign-in or Codex with a ChatGPT sign-in, your daily totals carry a hash made from that sign-in’s organization and user IDs. We never receive the IDs themselves, and usage that isn’t a subscription, such as an API key, carries no such value. | To show each subscription’s usage by device, and other accounts on the same subscription (section 4) | Until you delete your account |
| Live status (if you use it) A keyed hash that stands for the session, the coding agent, its state and the time. | To show a session’s state on your other devices | Less than 24 hours, and removed when you revoke the device |
| Purchases (once on sale) Order, item, amount, currency, payment status, and whether you confirmed a guardian’s consent and the cancellation notice. Card details stay with the reseller (Paddle, section 5). | To deliver items, handle refunds and meet our legal duties | As Korean e-commerce law requires: 5 years for contract, cancellation, payment and delivery records, and 3 years for complaint and dispute records |
| Security records A hash of your IP address made with a key only we hold (from the first 64 bits of an IPv6 address), used only for rate limiting, and an account activity log (sign-ins, age confirmation, device, privacy and time zone changes, exports, deletion, restrictions, essence and item adjustments and the like) under a pseudonymous ID with no email, handle or IP address. | To prevent abuse and to show you your account’s activity | IP hashes: about a day. Activity log: 90 days |
| Restriction records The reason and period of any restriction or suspension, the notices and your responses, and any removal from the rankings. | To act on breaches of the terms (Terms of Service, sections 6 and 12) | Until you delete your account |
Our server program’s request log records only each request’s ID, method, route pattern (without values such as handles or tokens), result code and timing, not your IP address, your account or what you sent. The request logs kept by Railway, which runs our server, and by Cloudflare, which carries the sites, are in section 5. We delete information without delay once its period ends.
3. What we never collect
- Prompts, code, file contents or commands
- Tool input or output, or your agent’s replies
- Project or repository names and paths
- Commit messages or changes
- Your coding agent’s own session IDs
- The account IDs and credentials in your agent’s sign-in files
- Your GitHub or Google password. GitHub or Google access tokens issued at sign-in aren’t stored on our server either (Supabase and your browser may hold one briefly during sign-in, section 2).
Our server rejects uploads that contain fields it doesn’t expect, and model names that look like paths, web addresses or keys.
4. What other people can see
- Nothing, until you publish your profile (except the subscription sharing below). Signing up or connecting a device is never consent to publish, and you can unpublish at any time.
- A published profile shows your handle, display name, pets (their kind, look, name and stage), collection, achievements and streak. Your pets and their stages are always shown. Your activity heatmap, arena record and usage appear only if you turn each one on.
- If you join the rankings, others see your rank or band, handle, display name and main pet, never your figures.
- In the arena, others’ pets challenge a snapshot of your pet: its kind, element, stats and looks.
- People whose accounts have usage on the same agent subscription as yours in the last 30 days see that your account shares it: by your handle if you’ve published your profile, otherwise as a “private account”. Until public profiles open, every account shows as a “private account”. They never see your usage. Whether two accounts share a subscription is judged only from the hash each computer sends, and we can’t verify it.
- Your email address, GitHub or Google ID, devices, projects and session times are never shown to anyone. If this policy changes what a profile shows, your profile becomes private until you confirm again.
5. Sharing and the companies that help us
We don’t sell personal information or give it to anyone else, except where the law requires it, for example under a court order, and except that once paid items go on sale, we send the reseller what a payment needs, as described below.
These companies process personal information on our behalf:
| Company | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts flasklings.com and app.flasklings.com, carries all traffic to them, including your IP address, and passes app.flasklings.com’s requests on to our server | A US company. Main data centers in the United States and the EU, and the data centers your requests pass through |
| Railway Corporation | Runs our server (processes account and service data, keeps request logs) | Servers in Singapore (a US company) |
| Supabase Pte. Ltd. | Hosts our database and handles sign-in, and sends sign-in link emails (Supabase’s built-in mailer) | Stored in Seoul, Republic of Korea (a Singapore company; it also runs and supports the service from abroad, see the transfers below) |
When you sign in with GitHub or Google, GitHub, Inc. or Google LLC handles the sign-in under its own privacy policy and shares your profile information, such as your email address and name, with us.
Once paid items go on sale, Paddle will process payments as our reseller (for buyers in Korea, the seller is Paddle.com Market Limited, in the United Kingdom). Paddle collects your payment method and billing details directly on its checkout under its own privacy policy, and we never receive your card details. When a payment starts, we send Paddle your email address, your Supabase user ID, and the items and amount ordered. Before sales start, we’ll add the basis for this and how long Paddle keeps it to this policy; until then nothing is sent to Paddle.
Transfers outside Korea
Personal information is transferred outside Korea to these companies:
| Recipient | What and why | When, how and how long |
|---|---|---|
| Cloudflare, Inc. (a US company). Transferred to: the United States, the EU, and the countries of the Cloudflare data centers your requests pass through privacyquestions@cloudflare.com | Your IP address and the requests you send to flasklings.com and app.flasklings.com, to deliver the websites and pass requests on to our server | Over the network, each time you use either site. app.flasklings.com’s request logs (method, address and result, with the request details Cloudflare adds, such as the country it places your IP address in) are kept for 3 days; flasklings.com keeps no request logs |
| Railway Corporation, United States (servers in Singapore) privacy@railway.com | The information in section 2 that our server processes, your IP address, and the program details of your browser or the CLI (User-Agent), to run our server | Over the network, each time the dashboard or the CLI calls our server. Data isn’t stored at Railway; Railway’s request logs (method, address, host, result, timing, request and response size, program details and the IP address the request came from) and our server program’s logs (section 2) are kept for 7 days |
| Supabase Pte. Ltd. (a Singapore company), with Supabase affiliates such as Supabase, Inc. (United States) for support. Transferred to: Singapore, the United States and the other countries where Supabase and its subprocessors have staff and facilities (the database is in Seoul, Korea) privacy@supabase.com | The information in section 2 that Supabase accesses remotely to run and support the service, and Supabase’s logs (section 2), to run our database and sign-in | Remote access over the network when running or supporting the service needs it; logs each time you sign in or send Supabase a request. Data for the periods in section 2; logs for 1 day |
We can’t provide the Service without these transfers. If you don’t want them, you can delete your account and stop using the Service.
6. Cookies and browser storage
app.flasklings.com uses the cookie and browser storage (localStorage) below. flasklings.com sets no cookies.
| Name | Purpose | Expires |
|---|---|---|
flasklings_signed_inCookie | Marks that you’re signed in (holds no sign-in details) | 400 days, or when you sign out |
sb-…-auth-tokenBrowser storage | Keeps you signed in. It holds your Supabase sign-in session (access and refresh tokens, and sign-in details such as your email address and the name GitHub or Google shared). The dashboard suggests that name as your display name, and our server keeps it only if you save it. | When you sign out |
sb-…-auth-token-code-verifierBrowser storage | Protects sign-in against forgery | When sign-in finishes |
flasklings.profile-setup.<account ID>Browser storage | Keeps the handle, display name and publishing and usage choices you saved in the first-run profile step until our server has them | When they’re saved, or when you choose to keep your profile as it is |
flasklings.timezone-kept.<account ID>Browser storage | Remembers that you chose to keep your time zone when the first run asked (the zone’s name), used only so this browser doesn’t ask again | When you clear your browser storage |
flasklings.policy-notice.<account ID>Browser storage | Remembers that you closed the dashboard’s notice about a new version of the Terms of Service and this policy, used only so this browser doesn’t show it again | When you clear your browser storage |
We don’t use analytics, advertising or tracking cookies. You can block cookies or storage in your browser, but then you can’t sign in. flasklings.com keeps only your animation pause setting in browser storage (flaskling-motion).
When you open a policy link without a language in it, such as flasklings.com/privacy, flasklings.com shows the Korean text if Cloudflare places your IP address in Korea and the English text otherwise. The country is used only for that choice and isn’t stored.
7. Your rights
You can ask to see, correct or delete your personal information, ask us to stop processing it, and withdraw your consent. You can do much of this yourself in Settings:
- Export what our server holds about your account, up to 3 times a day. The file is deleted after 24 hours.
- Change your handle, display name and pet names.
- Publish or unpublish your profile, and turn rankings and each profile section on or off.
- See your account’s activity log and revoke devices.
- Delete your account.
For anything else, including a copy of what the export doesn’t include, such as your sign-in details at Supabase, contact our privacy officer (section 11). We’ll reply within 10 days. Someone you authorize, such as a legal representative, can make a request for you. If the law requires us to keep some information, we’ll tell you what and why.
8. Deleting your account
When you delete your account in Settings, all access to it ends at once, your public profile and rankings come down, and your account data and your sign-in details at Supabase are deleted right after. A Supabase sign-in ID that payment records must stay linked to may remain, with its email address, name, picture and sign-in sessions removed. There’s no undo. Signing up again creates a new account. The same applies when we delete an account whose user said they’re under 14, or who never confirmed being 14 or older (section 10).
After deletion we keep only:
- the two activity log entries that record the deletion request and its completion, re-keyed so they can’t be linked to you, for 90 days from when they were written;
- the deletion job’s progress record, for 30 days after it finishes, or 90 days if it failed and stopped;
- a hash of the deleted sign-in ID, for 30 days, used only so a session from before the deletion can’t create a new account, and to delete deleted accounts again if we restore a backup;
- the ID of a Supabase sign-in account not yet deleted there, until its deletion finishes (we retry if it fails);
- handles in requests to clear public profile caches, deleted as soon as each request is delivered, and within 30 days even if it can’t be;
- Supabase’s logs, including the deletion (user ID, email address, IP address and browser), for 1 day;
- purchase records the law requires us to keep, for the periods in section 2, stored apart from other data.
Copies in database backups disappear as the backups expire. If we ever restore a backup, we delete deleted accounts again before using it. We delete electronic files so they can’t be recovered, and we don’t keep personal information on paper.
9. How we protect it
- All connections use HTTPS. Your sign-in session stays in app.flasklings.com’s storage in your browser, where other sites can’t read it.
- Our server stores sign-in sessions and device tokens only as one-way hashes, and IP addresses only as hashes made with a key only we hold. The CLI keeps its device token in your operating system’s credential store. GitHub and Google tokens are never stored on our server.
- Our server program’s logs leave out IP addresses, email addresses, handles, account IDs and what you sent (when a job fails, they name the account only by a pseudonym or the job’s ID). The request logs of Railway, which runs our server, and of Cloudflare, which carries the sites, and Supabase’s logs are the exception: they hold the items in sections 2 and 5 for the periods given there.
- Only the people who run the Service, and the companies in section 5 as far as their work needs it, can access its production systems.
10. Children
Flasklings isn’t meant for children under 14, and only people 14 or older may use an account. After you sign in, we ask once per account whether you’re 14 or older, and until you confirm, the account can’t be used except to export or delete it in Settings. If you answer that you’re under 14, the account’s deletion starts at once, and its data and your sign-in details at Supabase are deleted as in section 8. An account that doesn’t answer is deleted the same way 30 days after we start asking. Beyond that, if we learn that we hold personal information of a child under 14 without a guardian’s consent, we delete it.
11. Privacy officer
Our privacy officer is Jeseok Lee, CEO. Contact them with any question, request or complaint about your personal information at ceo@d-alabs.com or +82-10-2983-3375.
12. Getting help elsewhere
If you need help beyond us, you can contact these Korean bodies:
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Supreme Prosecutors’ Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
13. Changes to this policy
We’ll post changes here with the new effective date, and tell account holders in the dashboard, at least 7 days before they take effect, or at least 30 days before for changes that significantly affect your rights.
This version corrects this policy’s notices about processing already under way, so it takes effect on the day it’s published rather than after the notice period above.
14. Contact
See Customer Support, or contact us:
- D-ALabs LLC, CEO Jeseok Lee
- (13012) #1140, Wirye Hyosung Harrington Tower, 190 Wirye-daero, Hanam-si, Gyeonggi-do, Republic of Korea
- Business Registration No. 547-87-03375
- Mail-Order Sales Registration No. 2026-Gyeonggi Hanam-1794
- Email ceo@d-alabs.com · Phone +82-10-2983-3375