Privacy Policy

Last updated: 30 September 2026

This Privacy Policy explains what information FlintDB accesses and stores, how it is used, and the choices you have. By using FlintDB you agree to the practices described here.

1. Who we are & scope

FlintDB (🔥 FlintDB) is a web-based graphical user interface (GUI) that lets you browse and edit Google Cloud Firestore data and manage Firebase Authentication users across the Google / Firebase projects you are authorized to access. This policy covers the FlintDB application and the backend service that powers it. It does not cover Google's own services, which are governed by Google's privacy policy.

2. Data we access on your behalf

FlintDB connects to your Google Cloud / Firebase projects using your Google account's authorization. The Firestore documents and Firebase Authentication users you view and edit belong to your own Google projects.

3. Google user data — what we access, how we use it, store it, and share it

This section is FlintDB's disclosure of how it accesses, uses, stores, and shares Google user data, in accordance with the Google API Services User Data Policy.

What we access. When you sign in with Google, FlintDB requests the following OAuth scopes:

• https://www.googleapis.com/auth/datastore — Cloud Datastore / Firestore access
• https://www.googleapis.com/auth/cloud-platform.read-only — Cloud Platform, read-only
• https://www.googleapis.com/auth/firebase.readonly — Firebase, read-only
• https://www.googleapis.com/auth/identitytoolkit — Firebase Authentication user management
• openid — your Google account identifier
• email — your email address

Through these scopes, and only when you invoke the corresponding feature, FlintDB accesses: (a) the list and metadata of the Google Cloud / Firebase projects your account is authorized to view (read-only), so you can choose which project to open; (b) the Firestore documents and collections of the projects you select; and (c) the Firebase Authentication user records of those projects.

How we use it. FlintDB uses Google user data solely to provide the user-facing features you operate yourself: signing you in, listing your projects so you can pick one, browsing and querying your Firestore data, editing / importing / exporting the documents you choose, and managing Firebase Authentication users in your own projects. FlintDB does not use Google user data for advertising, does not sell it, does not use it to train machine-learning or AI models, and does not use it for profiling, credit-worthiness, or any purpose unrelated to the features above.

What we store. FlintDB does not keep a standing copy of your Firestore / Firebase data — it is fetched live from Google APIs and shown to you on demand. The only Google user data FlintDB stores is: (a) your Google OAuth refresh token, encrypted at rest with AES-256-GCM, kept solely so FlintDB can act on your behalf on the projects you authorized; (b) your account identity (email address and Google subject id) used for sign-in; (c) values from the specific documents you change through FlintDB — the audit log entry for each change (the before and after values of the fields you changed) and an encrypted Recovery before-image of the affected document; and (d) if you set up Backups (Team plan), compressed archives of the collections you chose to back up (see Data retention).

What we share. FlintDB does not sell Google user data and does not share or transfer it to third parties, except to the sub-processors listed in Section 6 strictly as needed to host and operate the service (for example, our hosting provider) — never for advertising or data brokerage. Our personnel do not read your data except with your explicit permission (for example, a support request you initiate), when necessary for security purposes such as investigating abuse, or to comply with applicable law.

You can revoke FlintDB's access at any time from your Google Account permissions page, or by deleting your FlintDB account. Revoking access invalidates the stored refresh token.

4. App metadata we store in our own database

FlintDB maintains its own database for application metadata that is necessary to operate the service. This includes:

• Workspaces you create or belong to
• Members & roles (role-based access control / RBAC)
• Saved queries
• Audit logs of actions taken in the app, including the before and after values of fields changed through FlintDB
• User settings and preferences
• Account identity — your email address and Google subject id (sub)

This metadata is created by your use of FlintDB and is distinct from the Firestore/Firebase data inside your Google projects.

5. Cookies

FlintDB sets exactly one cookie — a single HMAC-signed session cookie named kf_sid. It is configured as httpOnly, SameSite=Lax, and Secure over HTTPS. This cookie is strictly necessary for authentication and to keep you signed in.

FlintDB uses no tracking, advertising, or analytics cookies.

6. Sub-processors

FlintDB relies on the following third-party service providers ("sub-processors") to operate:

7. Data retention

• App metadata (workspaces, members, saved queries, settings) is retained while your account is active.
• Audit logs (including the before and after values of changed fields) are retained for operational and security purposes while the workspace exists, and are deleted when you delete the workspace or your account.
• Encrypted refresh token is retained until you revoke access or delete your FlintDB account.
• Recovery before-images (encrypted snapshots of documents you edit or delete through FlintDB, captured automatically on every plan) are retained for your plan's recovery window — currently 30 days on Free and Pro, 90 days on Team — then automatically expired; they are also removed when you delete your account. Restoring from a before-image requires a paid plan.
• Backup archives (Team plan, opt-in) — compressed copies of the collections you back up, kept until your schedule's retention prunes them or you delete them; you can download or delete any backup at any time.

8. Your rights (deletion & export)

You may request access to, an export of, or deletion of your FlintDB account data. Deleting your account removes your stored metadata and your encrypted refresh token.

If you are in the EU/EEA, you have rights under the GDPR (such as access, rectification, erasure, and portability). If you are in Thailand, you have rights under the Personal Data Protection Act (PDPA). See our PDPA notice for the full Thailand privacy notice.

9. Security

• Encryption at rest for OAuth refresh tokens using AES-256-GCM.
• Encrypted transport — all traffic is served over HTTPS.
• Application-layer access control — role-based access control (RBAC) and access control lists (ACL) restrict what each member can see and do.

No method of transmission or storage is completely secure, but we apply industry-standard safeguards to protect your data.

10. Children

FlintDB is a developer/operations tool and is not directed to children. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the application or by email where appropriate.

12. Contact

For privacy questions or to exercise your rights, contact us at support@saasthai.com.