Privacy

Last updated 1 October 2026.

Flitterby moves files between cloud storage providers on your instruction. This page describes exactly what that involves, in plain terms.

Flitterby is a service operated by Serious Business Software LLC, which is the data controller for everything described below. “We” and “us” mean that company.

What we store

• Your account: the email address and name your sign-in provider gives us.
• Access to your providers: authorization tokens for the accounts you connect, encrypted before they are written down. We never see or store your provider passwords.
• A list of what to move: for each transfer we record file names, paths, sizes, timestamps and checksums, plus progress, errors and comparison results, so a transfer can resume and you can inspect the checks performed.
• Purchases and credit: payment references, order status, credit grants and usage records. Card details are handled by Stripe, not stored by Flitterby.
• Service records: account and connection settings, operational logs and support requests needed to run the service and investigate problems.
• Waitlist details: your email, signup time, any interest you submit, and the referring page address supplied by your browser, if you asked for an invite.

What we do not store

The contents of your files. File data streams from the source provider to the destination provider through memory and is never written to our storage. When a transfer finishes, no copy of your file exists on our systems, because none ever did.

We do not store your IP address against waitlist signups, and we use no advertising trackers.

Analytics

The public site uses Abner for analytics. Its privacy policy describes pageview events containing page and referrer addresses, browser, operating system, device type, campaign parameters and approximate location. Abner processes the IP address into a daily salted hash for location and daily visitor counts; it says raw IP addresses are not stored. Events are used to produce analytics reports. Abner's script sets no cookies and does not track visitors across sites. We use no advertising trackers.

What we access

Google Drive's full drive permission allows reading, creating, changing and deleting files, including files Flitterby did not create. Dropbox's requested read and write permissions also allow deletion. Flitterby uses access to browse your accounts, copy the files and folders you select, check the copies, and resume interrupted work. It does not delete your source originals or deliberately replace existing destination files. When verification fails, it may remove the failed destination copy it created. S3 access depends on the credentials you supply; its connection check creates a unique test object and attempts cleanup. If permissions or safe deletion checks prevent cleanup, a small marker may remain for you to remove.

We also request your Google email to identify a connected Drive account. Google offers narrower per-file access, but that does not provide general access to an existing account's folder tree for this migration flow. You can revoke access through your provider's security settings. Once the provider applies revocation, further authorized access fails; work already in flight may finish.

How we use Google data

Google account information, file metadata and file contents are used to provide the copying, comparison and recovery features you request. We do not sell this data, use it for advertising, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs is limited by the Google API Services User Data Policy, including its Limited Use requirements.

Who we share it with

Your file contents pass from your chosen source through Cloudflare's processing infrastructure to your chosen destination. Cloudflare also stores account records, file metadata, comparison results and encrypted provider credentials. We use Firebase for sign-in, Stripe for payments, our email delivery service (freesend) for account and job notifications, and Abner for the public site's analytics described above. Notification emails can include job status and destination names; these providers do not all receive the same data. We do not send your file contents or provider tokens to our payment, email or analytics services.

Support requests include the information you choose to send. Do not send provider passwords, authorization tokens or sensitive file contents in support email. Your data is not sold or rented.

Where it runs

Flitterby runs on Cloudflare Workers. Account records, transfer manifests and encrypted tokens are stored in Cloudflare's databases.

Deleting your data

Request account, connection or transfer-history deletion by emailing support@flitterby.com. We need to verify the request and stop unfinished work before removing data it still needs. Removing a connection from the app is refused while an unfinished copy relies on it; removal requests cleanup of its stored credentials. For immediate control over provider access, also revoke the grant in the provider's own settings.

File metadata and comparison history are retained to support recovery and review until removed. Payment, credit and necessary security records may be retained after account or job-history removal for accounting, reconciliation and abuse prevention. Deleting job history does not restore spent credit. Contact support for the data affected by your request and its completion status.

Contact

Serious Business Software LLC
support@flitterby.com