Privacy Policy
Last updated: October 21, 2026
This policy explains what Flatpack collects, why we collect it, and the choices you have.
1. Who we are
Stratus Studios LLC ("we", "us") operates Flatpack at flatpack.tools.stratusstudios.com and is responsible for the personal data described here.
For privacy questions and requests, email privacy@stratusstudios.com. For anything else, email support@stratusstudios.com.
2. What we collect
- Your designs. Flatpack runs in your browser. To calculate a design, it sends the design to our servers, which do not keep it, except for the records described under Free downloads and Purchases. Without an account, your boxes stay in your browser's storage.
- Free downloads. When you export a design free, we keep a record of that design, linked to your account or, without an account, to your browser.
- Account information. If you create an account, we collect your email address, a name, and your password, which we store only in hashed form. If you sign in with Google, we receive your name, email address, and Google account ID from Google.
- Saved boxes. While you are signed in, we save your boxes to your account.
- Purchases. If you buy a pass or a plan, our payment processor collects your payment details on its own page. We do not receive your card number. We keep a reference to your customer record at the payment processor, the passes you bought and when, the state of your plan and of a payment that has not arrived yet, and which designs a pass covered.
- Usage and diagnostic data. We collect information about how the app is used and how it performs, such as box and export events, errors, and load times.
- Logs. Like most online services, our servers and network keep logs of requests, which include IP addresses and your browser type.
- Emails. We send account emails, such as verification and password reset codes. Our email provider records whether these emails are opened and whether their links are clicked.
3. How we use it
- To provide Flatpack, your account, and your saved boxes.
- To count your free designs, sell passes and plans, apply them to your exports, and handle refunds and disputes.
- To send account emails.
- To keep the service secure and working, find and fix errors, and improve it.
We do not sell your data, and we do not use it for advertising.
Where the GDPR or the UK GDPR applies, we rely on performance of our contract with you for your account, saved boxes, purchases, and account emails, and on our legitimate interests for usage data, logs, and security.
5. Service providers
We use service providers to run Flatpack:
- a cloud hosting provider, for hosting and backups, in the United States;
- an email delivery provider, for account emails;
- Google, only if you choose Google sign-in;
- a payment processor, for purchases.
If you use Flatpack from outside the United States, your data is transferred to the United States.
6. How long we keep data
- Account information and saved boxes: while your account is open. When you delete a box or your account, we delete it.
- Purchase records: while your account is open. When you delete your account, we first delete your customer record at the payment processor, then our records. The payment processor keeps its own payment records, as the law requires.
- Free download records: while your account is open. Without an account, as long as we need them to count free downloads.
- Usage data and logs: for a limited period, for operations and security.
- Backups: deleted data can stay in backups for a limited period before the backups expire.
- Some security and audit records, such as a history of account changes and network logs, can be kept longer.
7. Your choices and rights
- You can use Flatpack without an account.
- You can change your email address and password, and delete your account, in Account.
- You can ask us to access, correct, or delete your personal data by email to privacy@stratusstudios.com.
EEA and UK. You also have the right to restrict or object to our use of your data, to data portability, and to complain to your data protection authority.
California. You have the right to know what we collect, and to delete and correct it. We do not sell or share your personal information, and we will not treat you differently for using your rights.
8. Children
Flatpack is not for anyone under 16. If we learn that an account belongs to someone under 16, we delete it.
9. Security
We use reasonable measures to protect your data, including encryption in transit. No method of storage or transmission is completely secure.
10. Changes to this policy
When we change this policy, we update the date at the top of this page. If a change is material, we tell account holders by email.