Last updated October 2, 2026.
Who we are
Flared (“Flared”, “we”, “us”) operates the hosted service at flared.page and the short-link domain flared.link. This policy explains what personal information the hosted service processes and why. For privacy questions and requests, email support@flared.page.
Self-hosted installations run in their owner’s Cloudflare account. The installation owner controls that data and is responsible for the privacy information they give their own users and visitors. Flared receives no telemetry and has no administrative access to self-hosted installations.
This website
The website has no advertising trackers, third-party analytics scripts, or nonessential cookies. Fonts and logos are served from our own site. Cloudflare, our hosting provider, processes technical request information such as IP address and browser type to deliver and protect the site. Links to GitHub and other services lead to sites with their own privacy policies.
Your account
To sign in or create an account, you give us your email address. We verify it with a one-time code or a sign-in link sent from no-reply@flared.page. Codes and link tokens are stored only in hashed form and expire after five minutes.
A session cookie keeps you signed in for up to seven days. We do not store your IP address or browser user agent with your session. To limit abuse of sign-in emails, we keep keyed hashes of your email address and network address for 48 hours to enforce sending limits.
As link features become available, we process the links you create, their destinations, your domain settings, and your usage, so that we can provide the service.
Payments
Paid plans are not yet available. When they open, Polar will handle checkout and payments as merchant of record under its own privacy policy. We will keep only the subscription and billing references needed to apply your plan. We never receive or store your card details.
What click analytics records
When click analytics launches, it will record aggregate click totals and daily breakdowns by country, device category, and referring hostname where available. It will not store raw IP addresses, full user-agent strings, or complete referrer URLs in product analytics.
Clicks are not unique people. Bot filtering is best effort, test traffic is labeled, and missing or delayed analytics is reported. Analytics uses no visitor cookies or cross-site identifiers. Infrastructure security logs are separate from product analytics.
Service providers and transfers
Cloudflare provides hosting, the database, and email delivery. Account data is stored in a Cloudflare D1 database located in the Asia-Pacific region and is served through Cloudflare’s global network, so it can be processed in countries other than yours. Polar will process payment data when paid plans open.
We do not sell personal information, and we do not share it for advertising. We disclose information to others only when a provider needs it to run the service, or when the law requires it.
Legal bases
Where laws such as the EU General Data Protection Regulation apply, we process account and service data to provide the service you ask for, sign-in limits and security logs for our legitimate interest in protecting the service and its users, and billing records to meet legal obligations.
Security and operator access
The service uses HTTPS, managed encryption at rest, tenant isolation, and restricted operator access. Authorized operators can technically access hosted data for support, security, and operations. Hosted data is not end-to-end encrypted.
A public short link reveals its destination when followed. Do not use a short URL as access control for confidential content.
Retention and deletion
Sign-in codes and links expire after five minutes, sessions after seven days, and sign-in limit records after 48 hours. Operational logs are kept for at most seven days. Planned analytics retention is 30 days on Free and 365 days on Plus, and export files will expire after 24 hours.
Deleting an account removes its data. Until self-service deletion is available, email support@flared.page from your account email to delete your account. Minimal domain-and-slug reservations remain permanently so an old short address cannot be reassigned. These reservations contain no account identity or destination.
Cloudflare’s recovery history can retain deleted database data for up to 30 days.
Your rights and requests
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict its processing. Email support@flared.page from the email address on your account. We reply within 30 days and may ask you to confirm the request from that address.
You may also complain to the data protection authority where you live.
Children and changes
Flared is not directed to children under 16, and we do not knowingly collect their personal information.
We will post changes to this policy on this page and update the date above. If a change materially affects account holders, we will email them before it takes effect.