Privacy Policy

Last updated: August 19, 2026

Updated August 19, 2026 — Added account/authentication section

FlowThingy ("we", "us", "our") operates flowthingy.xyz and provides the FlowThingy External Minecraft mod, the 24/7 Bot service, and the TikTok Patcher tool. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

When you use our services, we may collect:

• Minecraft username — to generate and associate your license key
• IP address — stored when you visit the website and when you claim a key, used to prevent abuse and for analytics
• Visit data — page visited, timestamp, and whether you accepted or declined our Privacy Policy
• Key usage data — when your key was activated and last validated
• Bot configuration data — server IP, bot name, behavior settings (if you use the 24/7 Bot service)
• Cookie consent status — whether you accepted or declined our cookie/privacy policy banner

We do not collect passwords in plain text, payment information, real names, or any personally identifying information beyond the above.

2. TikTok Patcher Tool

The TikTok Patcher tool at flowthingy.xyz/tiktok processes video files entirely within your browser. Your video is never uploaded to any server — all processing happens locally on your device. We do not collect, store, or transmit your video files in any way. No data from your video is retained after you close the page.

3. Accounts & Authentication

To use certain FlowThingy tools (including the TikTok Patcher), you are required to sign in with a FlowThingy account. We support the following sign-in methods:

• Google OAuth — we receive your Google account email and profile name. We do not receive your Google password.
• Telegram Login — we receive your Telegram user ID, first name, and username (if set). We do not receive your phone number.

Authentication is handled by Supabase Auth using the OAuth 2.0 PKCE flow, which is the industry-standard secure authentication method. Your credentials are never stored by FlowThingy directly — only a unique user ID is stored in our database.

Your account is linked to your FlowThingy key, allowing you to use one key across all FlowThingy tools.

3. How We Use Your Data

• To generate and validate your license key
• To prevent abuse of the free key system (IP rate limiting)
• To operate the 24/7 Bot service
• To understand site traffic and improve our services
• To maintain records of consent as required by privacy law

4. Data Storage

Your data is stored securely on Supabase (cloud database). Supabase servers are located in the United States. By using our service, you consent to your data being processed there.

We retain your data for as long as your account or bot is active, or for a maximum of 12 months. You may request deletion at any time by contacting us.

5. Third-Party Services

• Supabase — database and key storage (Privacy Policy)
• Vercel — website hosting (Privacy Policy)
• Linkvertise / work.ink — ad verification steps for free keys (subject to their own privacy policies)
• OpenRouter — AI responses in our admin bot (no user data is sent to OpenRouter)

6. Cookies & Consent

When you first visit our website, we display a consent banner. Your choice is:

• Stored in your browser (localStorage)
• Saved to our database with your IP address and the page you visited
• Used for legal compliance — we keep records of consent decisions

If you click Decline, we still record the decline (required for compliance) but do not use your data for analytics. The site functions normally regardless of your choice.

Strictly necessary storage (consent preference) does not require your consent to function.

7. Your Rights

You have the right to:

• Request a copy of the data we hold about you
• Request deletion of your data
• Withdraw consent at any time
• Object to processing of your data

To exercise these rights, contact us via Discord or the contact details below.

8. Children

Our service is not intended for users under 13 years of age. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us immediately.

9. Changes

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions, contact us at flowthingy.xyz or via our Discord server.