Privacy policy

Who we are

This policy covers Flick for Mac, Flick for iPhone and iPad, Flick in the browser, and the Flick website at flick.galactus.dev. Galactus makes Flick.

Your Galactus account

When you create a Galactus account, we store your name, your email address, and your sign-in credentials. When you subscribe, the Galactus Labs account system stores your plan and billing status. Stripe processes payments; we do not store card numbers.

Gmail permission

With the permission you grant through Google, Flick reads and changes your Gmail messages, threads, headers, message bodies, attachments, labels, drafts, and mailbox history. Flick uses this data only to show, search, organize, change, and send your email when you tell it to. For email, Flick requests gmail.modify, which cannot permanently delete mail.

Where your Gmail data goes

The Flick app on your Mac connects directly to Gmail. Apart from scheduled sends and reminders, described below, your Gmail data moves only between Google and your Mac. It does not pass through a Flick server, and we do not receive or store it. Your Google sign-in tokens are kept in the macOS Keychain on your Mac. A scheduled send or a reminder also gives our server the mailbox's Google refresh token, as described below.

Mail stored on your Mac

Flick keeps a copy of your recent mail on your Mac, up to 90 days old by the date Gmail received it, for fast reading and search. The copy includes message bodies, attachments, drafts, and sent mail. Older mail stays in Gmail, and Flick asks Gmail for it only when you search for it. The copy is protected by macOS disk encryption (FileVault) when you have it turned on. Flick does not add a separate encryption layer.

Flick in the browser

Flick in the browser sends mail requests directly to Gmail. Mail content does not pass through Flick servers. Our server exchanges Google sign-in codes and renews access tokens. It reads your Gmail address to identify the connection. The browser stores the refresh credential in an encrypted cookie for up to 30 days. Only our server can read that cookie. Reloading the page or deploying an update does not clear the connection. Disconnecting Gmail or signing out of Flick clears the cookie. Saved drafts are stored in Gmail. The browser blocks remote images and does not add open tracking to messages.

Flick for iPhone and iPad

Flick for iPhone and iPad connects directly to Gmail.

Your Google refresh credential is kept in the iOS Keychain on your device.

The app keeps your mail and drafts on your device and excludes them from device backups.

For new-mail notifications, the app sends our server its notification token, an app installation ID, and a Google sign-in token that identifies your Gmail address.

Our server keeps the notification token, the installation ID, your account ID, and a keyed hash of your Gmail address, never the address itself.

Gmail tells our server when your inbox changes, with your Gmail address and a change number only.

While notifications are on for a mailbox, the app also gives our server that mailbox's Google sign-in token, and our server keeps it with encryption.

Our server uses the token to read only the IDs and labels of messages added to your inbox, to decide whether new mail arrived.

It does not read the sender, subject, or message text.

When new mail arrived, our server sends a notification with those message IDs only through Firebase Cloud Messaging and Apple Push Notification service.

Your iPhone or iPad then reads the sender, subject, and preview from Gmail itself to show them in the notification.

Turning notifications off for the mailbox, or removing the mailbox, lets our server delete its sign-in token once no scheduled send or reminder needs it, on the schedule described under Scheduled sends and reminders.

The iPhone and iPad app sends product interaction events and your Galactus account ID to PostHog.

Analytics exclude mail content, subjects, addresses, search text, and message IDs.

The app does not add open tracking to messages.

Scheduled sends and reminders

When you schedule a send more than 2 minutes ahead, or set a reminder, in Flick for Mac or Flick for iPhone and iPad, the app sends our server the Google refresh token for that mailbox.

A send scheduled 2 minutes ahead or less, or one over 20 MiB once encrypted, stays on your device and sends only while the app is running.

For a scheduled send, the app also sends the message, encrypted with AES-256-GCM under a key that is used for that message only.

Our server keeps that key, itself encrypted, and uses it to open the message at the time you chose.

At the time you chose, our server sends the message through Gmail, even when no Flick app is running.

At a reminder's time, our server reads your Gmail address, the conversation's subject, the ID of its last message, and a short preview of that message from Gmail, and puts a "Reminder" message into that conversation in your inbox.

Our server does not store the address, the subject, the message ID, or the preview.

Our server deletes the message right after Gmail accepts it, and also when you cancel the send or it fails.

Our server stores the refresh token with encryption and keeps it while the mailbox has an open scheduled send or reminder, or while an iPhone or iPad has notifications on for it.

After that, our server deletes the token once 10 minutes have passed since the app last sent it. A cleanup that runs every 15 minutes deletes tokens that are no longer needed.

Our server keeps a keyed hash of your Gmail address, never the address itself.

It keeps the result of each send, with Gmail's message and conversation IDs, for 60 days, and the result of each reminder for 60 days, so that your devices can show them.

Removing a Gmail account from the app cancels the scheduled sends and reminders that the app gave our server.

Deleting your Flick account deletes all of them, with their messages and sign-in tokens.

Calendar on your Mac

The Mac app connects directly to Google Calendar with a separate Calendar permission.

The native Calendar credential stays in the macOS Keychain.

Reading a Calendly or Vimcal booking link sends the requested date range to that booking provider.

Availability images and text are processed on your Mac.

Place search and travel estimates send the search text or selected places to Apple Maps.

Hosted booking

Hosted booking uses a separate Google Calendar permission so booking can continue while Flick is closed.

The server stores this Calendar refresh credential with encryption.

The booking worker reads Google events to calculate current availability.

The worker creates and removes the events and temporary holds that a published booking link needs.

The server stores published meeting details, guest responses, and booking records.

Booking answers are excluded from the public page and the shared Google event description.

When the host enables an email reminder, Resend receives the booking guest's email and meeting details to deliver it.

Hosted Calendar consent does not include Gmail permission.

Calendar disconnect

Disconnecting hosted Calendar stops new work before the server removes its Calendar credential.

If Google cleanup fails, the encrypted credential can remain for up to 24 hours while cleanup is retried.

Archiving a booking link closes its public page and retains the booking records.

Hosted Calendar disconnect does not revoke your separate Gmail connection.

Remote images

Flick blocks images from remote servers by default. When you allow images for a sender, or for all mail, your Mac loads those images directly from the sender's servers, which can see that the image was loaded. No Flick server is involved.

Open tracking

Open tracking is on by default for mail you send, and you can turn it off for each message. When it is on, Flick adds a small image to the message and gives it a random token. Our server stores the token, your account ID, and the send time. Each time the image loads, the server stores the time, the kind of fetch, and a shortened hash of the browser identifier. It does not store IP addresses. The tracking endpoint never receives the message, its subject, its recipients, or your Gmail address. The link between a token and a message exists only on your Mac. While our server holds a scheduled send, it keeps the token with that send until Gmail accepts the message.

Product analytics

Flick for Mac, iPhone, iPad, and the browser sends product interaction events to PostHog.

After you sign in, events use your Galactus account ID.

Events include action counts, completion times, app version, and plan.

Events exclude mail content, subjects, email addresses, search text, message IDs, and your name.

Flick disables PostHog session recordings and automatic screen tracking.

Flick disables IP-based location collection.

Website analytics

The public pages of flick.galactus.dev use PostHog, Google Analytics, and Google Ads. These are the home, pricing, privacy, and terms pages and the comparison pages.

They count page views, clicks on download and sign-in links, and views of the pricing section.

They report each download click to Google Ads, so Flick can measure its ads.

They do not run in the browser mailbox or on account, sign-in, invitation, booking, or Calendar consent pages. They never receive mail content or Google API data.

These pages ask for your consent if you are in the European Economic Area, the United Kingdom, or Switzerland, if your browser uses a European time zone, or if Flick cannot tell where you are. Flick sets no analytics or advertising cookies until you choose Accept.

Until you accept, PostHog counts the visit without cookies, browser storage, or a lasting identifier.

Until you accept, Google tags run with analytics and advertising storage denied. They set no cookies, but Google may still receive cookieless pings that carry the page address, the referrer, and your browser type.

Elsewhere there is no prompt, and the pages count visits with cookies from the start.

Choose Reject or Accept in the banner. To change your choice at any time, select Cookie settings in the footer of a public page.

Flick keeps your choice in your browser's local storage, not on a server.

Flick removes private values, such as sign-in codes and tokens, from page addresses and referrers before they reach PostHog or Google.

PostHog session recording, automatic click capture, and heatmaps are off on these pages.

Flick does not link these events to your Galactus account.

Google explains how it uses data from sites like this one in How Google uses information from sites or apps that use our services.

Google API Services

Flick’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, give it to data brokers, use it to decide credit, or use it to train AI or machine-learning models. No one at Galactus reads your mail. Our hosting providers process the web sign-in requests, scheduled sends, and reminders described above.

How we use and share account information

We use account information to run Flick, manage your subscription, and answer your requests. We share it only with the providers that run our hosting, sign-in, billing, and analytics, under confidentiality obligations, or when the law requires it. We do not sell your personal information.

Retention and deletion

Disconnecting a Gmail account in Flick for Mac removes its Google tokens from the Keychain and deletes that account’s mail from your Mac. Copies in macOS backups, such as Time Machine, are outside Flick’s control. Removing a Gmail account in Flick for iPhone and iPad deletes its mail, drafts, attachments, credential, and search history from the device. You can also remove Flick’s access in your Google account settings. We keep account data until you delete your account. To delete it, tap Delete Account in Settings in Flick for iPhone and iPad, or contact us.

Security

Data sent between the app, our servers, and our providers is encrypted in transit. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

Contact

Questions about this policy go to support@galactus.dev.