Privacy policy

Last updated 24 September 2026 · Applies to the FLAMES mobile app (package flame.xoxo) and this website.

Who we are

FLAMES is an independent app built for fun. In this policy, “we” and “us” mean the developer of FLAMES, and “the app” means the FLAMES mobile app published under the identifier flame.xoxo.

The names you type

The two names you enter are held in the app’s working memory only for as long as the screen is open. They are used on your device to work out which FLAMES letter is left over, and nothing else. They are not written to storage, not backed up, not shared, and not sent over a network. Closing the app discards them.

What we collect, and why

• An anonymous account id. Created by Google Firebase Authentication when you first continue past the number screen. It has no name or email attached; it is what your subscription is recorded against.
• Your mobile number. Typed by you at the start. It is the number your UPI Autopay mandate is registered under, and the one we may use to contact you about your subscription. It is not verified, not used for marketing, and never shared except with Razorpay to set up your payment.
• Your subscription status. Whether your access is active, until when, whether it came from a payment or a promo code, and a record of the payments and mandate events Razorpay reports to us.

We do not collect contacts, photos, files, location, advertising identifiers, usage analytics or crash reports.

Payments

Subscriptions are paid through UPI Autopay, processed by Razorpay. The payment itself happens in Razorpay’s checkout and your own UPI app: we never see or store your UPI PIN, bank account or card details. Razorpay tells us your customer and mandate ids and whether each payment succeeded, which is how we know to keep your access open.

Where it is stored

Account and subscription records are kept in Google Cloud Firestore in Mumbai, India, under Firebase’s terms. Our servers run on Vercel. Scheduled payment requests pass through Upstash QStash, which carries only internal ids, never your number.

How long we keep it

For as long as your account has a subscription or promo access, and afterwards for as long as we need a record of payments taken — for tax, accounting and resolving disputes.

Permissions

The app needs internet access for sign-in, subscriptions and payment. It asks for no other Android or iOS permissions.

This website

This site sets no cookies and runs no analytics. Vercel records standard server request logs, including IP addresses, to serve and protect the site; see the Vercel privacy policy.

Children

FLAMES is for a general audience, and subscribing requires being 18 or older. We do not knowingly collect personal information from children.

Your rights

You can ask us for a copy of what we hold about you, to correct your number, or to delete your account. Write to us with the number you signed up with. Deleting your account does not cancel a UPI Autopay mandate by itself — cancel that first, in the app or in your UPI app.

Changes to this policy

If what the app collects changes, this policy will be updated before that version is released, and the date at the top will change.

Contact

Questions about this policy can go to harshdbugger@gmail.com.