Privacy Policy

Effective October 12, 2026

Who we are

Tiny Penguin LLC, a California company in the United States, makes Flotilla and runs tinypenguin.com. We're the controller of the personal data described here. Reach us at hello@tinypenguin.com about anything in this policy.

What stays on your Mac

Flotilla keeps your projects, sessions, settings, files, git checkouts and agent transcripts on your Mac. We never receive them. Pull request data comes from GitHub through the GitHub CLI you've signed in to, directly on your Mac.

What we collect, and why

• Your account. If you sign in, our billing server stores an account ID, your email address, and, with Sign in with Apple, the identifier Apple gives us (the email may be an Apple private relay address). We use it to sign you in and unlock Pro. Legal basis: performing our contract with you.
• Sign-in links. When you sign in by email, we send a one-time link to your address. Links expire after 15 minutes. Legal basis: contract.
• Your subscription. We store your Paddle customer ID and, for each subscription, its ID, product, plan, status, renewal date and any scheduled cancellation, so the app knows what you've paid for. Legal basis: contract.
• Sessions. Signing in creates a session token. We store only a one-way hash of it, with when it was created and last used, and delete it when you sign out. Legal basis: contract.
• Crash reports and usage analytics. Described in detail below. Legal basis: your consent in the EEA, the UK and Switzerland, and elsewhere our legitimate interest in keeping Flotilla working and improving it.
• Messages you send us. If you email us, we keep the conversation to answer you and handle requests such as refunds. Legal basis: contract, or our legitimate interest in supporting users.

You don't have to create an account; Flotilla's free features work without one. Pro needs an account, since that's how the app knows you've subscribed. We don't make decisions about you by automated means that have legal or similarly significant effects.

Payments

Paddle.com is the Merchant of Record for our orders. Paddle collects your payment details, billing address and tax information and handles them as an independent controller under its own privacy policy, including keeping the records tax law requires. We never see your full card number. The checkout page at billing.tinypenguin.com loads Paddle's checkout, which may use cookies or similar technology for payments and fraud prevention.

Crash reports and usage analytics (Sentry)

Flotilla uses Sentry, run by Functional Software, Inc. in the United States, for crash reporting and usage analytics. Sentry processes this data for us under its privacy policy. If your Mac's region is in the EEA, the UK or Switzerland, Flotilla asks before sending anything, and sends nothing unless you agree. Elsewhere it's on by default in released versions of Flotilla. Either way you can change it at any time in Settings with "Send crash reports and usage data", and sending stops as soon as you turn it off.

What Flotilla sends:

• Crash reports: the stack trace of Flotilla's code when it crashes, with device details such as your Mac model, macOS version and memory, and Flotilla's version. Your home folder path is replaced with ~, and the trail of recent actions is removed before sending.
• Error reports: which place in Flotilla's code showed you an error, with a short fixed reason code, not the error's message.
• Usage metrics: counts and numbers such as app launches (with how many projects and sessions you have, your default agent and which of a few settings are on), new sessions (which agent, which checkout mode, where it was started, whether it was forked), how many agents are running, how long agent runs last and how they end, which features and pane tabs get used and which flotilla commands run, and every half hour the app's memory use with counts of agents, panes, windows and tabs and how long it has been open.
• An install ID: a random ID created on your Mac so we can tell installs apart. It isn't linked to your account or email.

It isn't linked to you: Flotilla never sends your code, file contents, prompts, messages, agent sessions or transcripts, or the names of your projects, sessions, repos or branches. Your IP address reaches Sentry as part of the connection, but we've turned off storing it, so it isn't kept with reports.

We use this only to find and fix crashes and bugs and to learn which features people use. We don't combine it with your account, use it for advertising or sell it. You can withdraw consent or object at any time by turning it off.

Updates

Flotilla checks for and downloads updates from GitHub, where our releases are hosted. Like any download, GitHub sees your IP address when that happens.

Agents you run

Flotilla starts agent tools such as Claude Code, Codex and Cursor on your Mac. What you send through them, and whatever files, repositories or systems they read, goes straight to their providers under those providers' privacy policies, not through us.

You decide what agents can see. Before you give them personal data, customer data, credentials or anything confidential, make sure you're allowed to share it with those providers, including under your employer's or client's policies and the data protection laws that apply to you. See the terms for more on your responsibilities when using agents.

This website

tinypenguin.com uses no cookies, analytics or trackers. It's hosted on GitHub Pages, and the Flotilla page asks GitHub's API for the latest download link, so GitHub may log your IP address as part of serving those requests.

We don't track you across other websites, so there's nothing for a browser's Do Not Track or Global Privacy Control signal to switch off. We treat a Global Privacy Control signal as a request to opt out of any sale or sharing anyway.

Who we share it with

We don't sell or rent personal information, and we don't share it for cross-context behavioral advertising. We share it only with these providers, to run the Services, or when the law requires it:

• Cloudflare hosts our billing server and its database (service provider).
• Resend delivers sign-in emails (service provider).
• Sentry receives crash reports and usage analytics (service provider).
• Paddle sells and bills subscriptions as Merchant of Record (independent controller).
• Apple provides Sign in with Apple, if you use it (independent controller).
• GitHub hosts this website and Flotilla's downloads (independent controller).

International transfers

We're based in the United States, and our providers process data in the United States and other countries. When we transfer personal data from the European Economic Area, the UK or Switzerland, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses (with the UK addendum) and, where a provider is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

How long we keep it

• Account and subscription data: while your account exists. If you ask us to delete your account, we delete it within 30 days, except anything we must keep to meet legal obligations.
• Sign-in links expire after 15 minutes and sign-in codes after 5 minutes. Sessions are deleted when you sign out.
• Crash reports and usage analytics: 90 days, after which Sentry deletes them.
• Emails with us: as long as needed to help you, and up to the period tax or consumer law requires for refund and billing questions.

How we protect it

Data travels over encrypted connections. Session tokens and sign-in links are stored only as one-way hashes, and the passes that unlock Pro are cryptographically signed. No system is perfectly secure, but we keep what we collect small so there's less to protect.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy, including in a portable, machine-readable form;
• correct it if it's wrong;
• delete it;
• restrict how we use it, or object to our use of it, including diagnostics based on our legitimate interest;
• withdraw consent you've given, such as for diagnostics, without affecting what was sent before.

Email hello@tinypenguin.com from the address on your account so we can confirm it's you. We answer within 30 days (one month under the GDPR). You won't be treated differently for exercising these rights. If you're in the EEA or UK and think we've mishandled your data, you can also complain to your local data protection authority.

California residents

This section adds the notice California law asks for. In the past 12 months we've collected these categories of personal information, from you, your device, Apple and Paddle, for the purposes described above:

• Identifiers: email address, account ID, Apple sign-in identifier, Paddle customer ID, Flotilla install ID and IP address (Sentry doesn't store the IP address).
• Commercial information: your plan and subscription history.
• Internet or other electronic network activity: crash reports, error reports and usage metrics from Flotilla.

We disclose these only to the providers listed above, for business purposes. We don't sell or share personal information, haven't in the past 12 months, don't knowingly sell or share data of anyone under 16, and don't collect sensitive personal information. You have the right to know, delete and correct your personal information and to not be discriminated against for using these rights. You can use them yourself by email, or through an authorized agent with your signed permission; we'll verify the request against your account email. We don't share personal information with third parties for their direct marketing.

Children

The Services aren't meant for children under 13, or under 16 in the EEA and UK, and we don't knowingly collect their data. If you think we have, email us and we'll delete it.

Changes

If we change this policy, we'll update the date above, and for material changes we'll let you know in the app or by email before they take effect.