Flyspace Privacy Policy

Effective date: 1 October 2026 Last updated: 30 September 2026

1. Who we are

Flyspace (“Flyspace”, “we”, “us”) is operated by Flycoder Pty Ltd (ABN 64 688 279 852), based in Australia. Flyspace is a community and workspace platform with built-in AI agents, available at flyspace.ai and on customer-branded domains.

Privacy contact: josephj@flycoder.io

This policy explains what personal information we collect, why, who we share it with, and the choices you have. It applies to the Flyspace website, web app, CLI, API and MCP server (together, the “Service”).

2. Two roles: Flyspace and Workspace owners

Flyspace hosts many independent Workspaces (communities, teams, companies). Each Workspace is run by its owner.

• For your account and billing data, Flyspace decides how the data is used. We are the responsible party.
• For content inside a Workspace (messages, posts, documents, files, member lists), the Workspace owner decides how it is used and who can see it. We process it on their behalf. Workspace owners are responsible for having a lawful basis and any required consents for the content and member data they put into Flyspace, including data imported from other platforms such as Facebook Groups.

If you have a question about a specific Workspace, contact its owner first. We will help where we can.

3. Information we collect

Information you give us

• Account details: name, email address, profile photo, display name, language preference.
• Content: messages, replies, posts, documents, attachments (images, video, audio, PDF), reactions, and Agent instructions you write.
• Billing details: handled by Stripe. We receive your billing name, country, plan, and payment status, and the last four digits and brand of your card. We never see or store your full card number.
• Communications with us (support requests, feedback).

Information collected automatically

• Device and log data: IP address, browser and device type, timestamps, pages and features used, error logs.
• Usage data: AI usage (token counts, model used), storage used, feature usage. We use this for billing, quotas, abuse prevention and reliability.
• Bot-check signals from Cloudflare Turnstile at sign-in and sign-up.
• Cookies and local storage: see section 9.

Information from others

• Workspace owners and admins may invite you, import your past posts from another platform, or add you to channels.
• Integrations a Workspace owner enables per channel (for example Slack or GitHub): we receive the data the owner authorises.

We do not knowingly collect sensitive information (such as health or racial or ethnic origin). Please do not post it unless you are comfortable with the Workspace’s members seeing it.

4. How we use information

• Provide, secure and maintain the Service, including real-time chat, notifications, search, and file storage.
• Run AI features: agents you or other members invoke, translation, audio generation, summaries, moderation and onboarding assistance (see section 6).
• Process payments, trials and subscriptions.
• Send service emails (verification, notifications, billing, security). You can control optional notification emails in settings.
• Detect and prevent abuse, spam, fraud and security incidents.
• Measure usage, fix bugs and improve the Service.
• Comply with law and enforce our Terms.

We do not sell personal information, and we do not use your content to train AI models.

5. Who we share information with

Within a Workspace. Your name, profile, and content are visible to other members according to the channel’s settings (public, private, or guest-visible). Workspace owners and channel admins can see and moderate content and manage members. Public channels and documents shared via a public link may be viewed by anyone with the link and may be indexed by search engines.

Service providers (sub-processors). We use these to run the Service, under contracts that limit their use of your data:

Legal and safety. We may disclose information if required by law, to respond to valid legal process, or to protect the rights, safety and security of users, the public or Flyspace.

Business transfers. If Flyspace is involved in a merger, acquisition or sale of assets, information may be transferred. We will tell you about the transfer and any choices you have.

With your direction. Such as when you connect an integration, use the API or MCP server with a third-party tool, or share a document publicly.

6. AI features and your data

Flyspace is built with AI as a core feature. Please read this section carefully.

• When you or another member invoke an agent (for example with @agent), or use translation, audio, summaries or moderation tools, the relevant content (message text, documents, files in the channel folder, and the instructions given) is sent to the AI provider to generate a response. Agents may read and act on files and data in their channel’s folder.
• Which provider handles a request depends on the feature: Anthropic (Claude) or OpenAI (Codex) for agent work, and Groq for translation, audio and summaries. Under their commercial API terms, these providers do not train their models on API inputs or outputs by default.
• Local Agent. On the Local Agent plan, the agent runs on your own computer. Channel files and agent working data live on your machine, and agent requests go from your machine to the AI provider under your own account with that provider, whose terms and privacy policy then apply to you directly. Flyspace’s servers still store chat, documents and account data as described above.
• Cloud Agent. On the Cloud Agent plan, the agent runs on a Flyspace-managed Fly.io machine, and channel files are stored on an encrypted volume there.
• Agents can make mistakes. AI output may be inaccurate. Translations are generated automatically and are labelled as such; the original text is the authoritative version.
• Anyone with permission to invoke an agent in a channel can cause that channel’s content to be processed by the AI provider. Workspace owners should tell their members how AI is used in their Workspace.

7. Where your information is stored

Our primary database (Supabase) and application servers (Fly.io) are located in Sydney, Australia. File attachments are stored with Cloudflare R2 in the Oceania region. Some providers, such as Anthropic, OpenAI, Groq, Stripe, Resend, Cloudflare, Google and Microsoft, process data in other countries, including the United States. Your information may therefore be transferred and stored outside your country. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with this policy and applicable law (including the Australian Privacy Principles), for example through contract terms and security requirements.

8. Retention and deletion

• Account data: kept while your account is active.
• Workspace content: kept until the Workspace owner or author deletes it, or the Workspace is deleted.
• Paused subscriptions and expired trials: the Workspace is locked and its data is kept for 90 days so you can resubscribe or export it. We will email the owner before the 90 days end. After that, the Workspace and its content are deleted.
• Deleted content and accounts: removed from active systems within 30 days and from backups within 90 days.
• Billing records: kept for 5 years, as required by Australian tax law, even after your account is deleted.
• Logs: kept for up to 90 days.
• We may keep information longer where needed to resolve a dispute, investigate abuse, or comply with a legal obligation.
• Content you have already shared with others, or that appears in another member’s export, may remain with them.

9. Cookies and similar technologies

We use cookies and local storage that are necessary to sign you in, keep your session secure, and remember settings such as language and theme. We use Cloudflare Turnstile to protect sign-in from bots.

Website analytics. Our marketing website at flyspace.ai uses Google Analytics and Microsoft Clarity to understand how visitors find and use it. These tools set cookies and collect data such as pages viewed, the referring site, approximate location, device and browser type, and on-page interactions such as clicks and scrolling (Clarity can replay these, with text you type masked). We use this data in aggregate to improve the website, not to advertise to you.

Web app. The Flyspace web app does not currently use analytics cookies. If we add them, we will update this policy first and ask for consent where required.

We do not use advertising cookies. You can block cookies in your browser, but the Service may not work properly.

10. Security

We use encryption in transit (HTTPS/TLS) and at rest, access controls, row-level security on our database, separation between Workspaces, and least-privilege access for our team and systems. No system is perfectly secure. If we become aware of a data breach likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (and other regulators where required) as the law requires.

You are responsible for keeping your sign-in credentials and API keys secure.

11. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Delete your account and personal information.
• Export your data in a portable format (Flyspace supports full export of Workspace content).
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Opt out of optional emails using the link in the email or in settings.

To exercise a right, email josephj@flycoder.io. We may need to verify your identity, and will respond within 30 days. If your request concerns content inside a Workspace, we may refer you to the Workspace owner.

Complaints. Contact us first and we will try to resolve it. If you are in Australia and are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the EU/UK or Taiwan, you can also contact your local data protection authority.

12. Legal bases (EEA / UK users)

Where GDPR applies, we rely on: contract (providing the Service you signed up for); legitimate interests (security, abuse prevention, service improvement, which we balance against your rights); consent (optional emails, non-essential cookies, where used); and legal obligation (tax and accounting records).

13. Children

You must be at least 16 to use Flyspace. We do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has an account or has given us information, contact us and we will delete it.

14. Third-party links and integrations

Workspaces may link to or integrate with third-party services. Their privacy practices are their own; please review them.

15. Changes to this policy

We may update this policy. For material changes we will notify you by email or in the Service before they take effect. The “Last updated” date above shows the current version.

16. Contact

Flycoder Pty Ltd (ABN 64 688 279 852) Email: josephj@flycoder.io