SECURITY

Your device makes a one-time key and locks the content with it before anything leaves. We get the locked box. The key goes into the share link, in the part after the #. That part is called the fragment, and no browser sends it to a server.

• —Anyone with the full link can open it. So can anyone they forward it to.
• —Lose the link and it's gone. There's no key on our side to fall back on.
• —A link that arrives without its # part is a dead link, not a locked one. It won't open, and it won't spend one of the flit's views either.

Your device locks the content before anything leaves. We store the locked copy and serve it exactly as we got it. It's unlocked again on the device you sent the link to.

The key never takes that route. It travels inside the link, straight from you to whoever you send it to.

We hold the locked box. We never hold the key.

A flit's key is kept only on the device that made it. It isn't uploaded, it isn't backed up to us, and it isn't attached to your account.

Sign in somewhere else and you'll see your flits listed. You can revoke them. You can't open or reshare them. Those rows say NO KEY.

Wipe the device, reinstall the app, or clear your browser storage and the keys held there are gone. We have no copy to restore them from, and no support request can change that.

We can't see the message you typed, the link you shared, the contents of the file you attached, or what you called it. For a new flit that reaches us already locked and stays that way.

We can see, because running the service needs it:

• —The kind of file it is and how big the locked copy is. Not its name: we get a stand-in like “file.pdf”, and the name you chose is locked inside with the rest.
• —How many files a flit holds, when it holds more than one. Each is locked separately, and one link opens all of them.
• —Whether the flit is a message, a link, a file, or media.
• —When you made it, when it expires, how many views it allows, and how many it's had.
• —The anonymous device id that made it, or your account if you were signed in.
• —The IP address you created it from, deleted when the flit's content is. see the privacy policy.
• —For a flit with a view limit, which devices or accounts opened it and when. That's how the views get counted. A flit without one keeps no list of who opened it.
• —The last time a flit was opened, kept for every flit whether or not it has a view limit. That's what deletes flits nobody has opened in fifteen days.
• —A one-way fingerprint of the key, used to tell a real link from a fabricated one before it spends a view.

• —It doesn't stop the person you sent it to. They can screenshot it, record the screen, save it, or forward the link while it's alive. We restrict right-click and download controls in the viewer, which slows casual copying and stops nothing determined.
• —It doesn't hide that a flit exists, roughly how big it is, what kind of file it is, or when it was opened.
• —It doesn't reach backwards. Flits made before this update are unchanged.
• —It doesn't survive a stolen device. Whoever has your phone or your browser profile has your links.

We can't go looking through flits, because we can't read them. A review only starts when someone holding the link reports it.

Reporting hands us the key from the link that person already has. That's a disclosure they choose to make about a flit they can already open. It isn't a spare key we kept. It covers the one flit they reported and nothing else.

While the report is open we keep the locked content and the key we were given, and we pause the automatic deletion so the evidence is still there when a person reviews it.

That pause has a limit. A reported file or media flit is kept for at most thirty days. After that the normal deletion resumes even if nobody has reviewed the report yet. We would rather lose the evidence than hold your content indefinitely because a report was filed and never dealt with.

The key, and the report itself, are deleted when the report is resolved, and in any case within twelve months.

Email security@getflit.app. Tell us what you found, how to reproduce it, and what an attacker gets out of it. We'll acknowledge within five business days and tell you what we're doing about it.

Please test against flits you made yourself, don't point automated scanners at the live service, and don't sit on a finding waiting for a payout. We don't run a bug bounty and can't pay one. We'll credit you by name if you want it.

A good-faith report made on those terms won't get a legal threat from us.

There's no PGP key. Send plain text, and don't include anyone else's data in the report.

Machine-readable version: /.well-known/security.txt

The container format, what each piece of a flit authenticates, how the key fingerprint is derived, and the exact test vectors both apps are checked against are written up separately.