FlyControl: privacy and terms of use

FlyControl is an unofficial Fly.io client. It has no FlyControl account and no server of its own. The only thing it keeps is the Fly.io token you give it, and that token goes from your phone straight to Fly.io and nowhere else. Apart from that, the app sends a set of anonymous usage statistics and, when something breaks, a crash report.

I, Tiago Danin, am the developer and the controller of this data under the LGPD (Lei 13.709/2018). If you are in the EU, the GDPR gives you the same rights and I answer them the same way. Write to TiagoDanin@outlook.com about any of it. FlyControl is not affiliated with, endorsed by or supported by Fly.io.

What you give the app

Your Fly.io token

To connect, you paste a Fly.io token, usually an organization token from fly tokens create org, or the output of fly auth token. Before saving it, the app checks with Fly.io that the token works and lists its organizations.

The token is stored in the phone's encrypted storage, the Android Keystore or the iOS Keychain, together with the label you give the account and the slugs and names of its organizations. On iOS it is kept for this device only and is not restored to another one. You can connect more than one account; each is stored the same way.

The token is sent only to Fly.io's API, at api.machines.dev and api.fly.io, in the authorization header of each request. I never receive it.

What the app loads from Fly.io

With your token, the app asks Fly.io for your apps, machines, regions, logs, metrics and deployment history. The deployment history includes the email of whoever made each release, shown in the deployment details. All of this is kept in memory while the app runs and is not written to disk. When you start, stop, restart or destroy a machine, that command goes to Fly.io the same way.

Fly.io processes those requests under its own privacy policy.

What else stays on your phone

The app saves your appearance setting (light, dark or system), the selected organization and whether you are in demo mode. It reads the clipboard only when you tap Paste on the connect screen, and writes to it only when you copy a log line or a value.

It also keeps a few numbers of its own: how many times you have opened the app, the open on which it last asked for a rating, and the days of your first and last launch. They never leave the phone as they are; the statistics below only carry rough ranges made from them, such as "2 to 7 days since the last launch", and the month of the first launch.

On the 3rd, 5th and 10th time you open the app with an account connected, it may ask the store (Google Play, or the App Store on iPhone) to show its rating card. The store decides whether the card appears. Your stars and any review go to the store under its own terms, and the app never learns whether you rated it or what you wrote.

Usage statistics

Google Analytics for Firebase records how the app is used: connecting (and why a connection failed), entering demo mode, switching, removing or disconnecting accounts, changing organization, the screens you open, how many apps or machines a list has (in ranges such as "2 to 5"), opening an app or a machine, the machine commands you run and whether they worked, the metrics range you pick, opening logs and filtering them by level, pulling to refresh, the kind of error a screen shows and the appearance setting. It also records whether you are in demo mode.

On the connect screen it records whether you used the Paste button and whether the clipboard held text, the kind of token pasted (read from its prefix, such as an organization token), how many tries a connection took, roughly how long you spent on the screen, and whether you opened the token help or left adding an account without finishing. It also records the first search on Apps or Machines and whether it found nothing (never what you typed), the machine states you filter by, opening machines from a region, opening a deployment (with its status), cancelling a machine command, a machine that started or stopped outside the app, a log stream that starts, a log line you copy (only its level), metrics that fail to load, how long Fly.io took to answer in ranges, each launch with the days since the last launch and since the first in ranges, and when a rating card was requested. Each statistic is tagged with demo mode or not, the appearance setting, ranges of how many accounts, organizations, apps and machines you have, and the month of your first launch. It never records your token, the names or IDs of your organizations, apps or machines, log lines, metrics values or anything else loaded from Fly.io.

When the app crashes, Firebase Crashlytics sends a crash report: the technical trace of the error, the device model, operating system, app version and an ID that Crashlytics creates for this installation. A failed rating request is also reported this way. The report carries no user ID and nothing loaded from Fly.io. Development builds of the app send none.

Like any app using the SDK, it also records automatic events such as the first open and each session, together with an ID for this installation, the device model, operating system, app version and approximate location. On Android the SDK may read the install referrer (how you got to the app on Google Play). The app turns off the advertising ID, so the SDK neither reads nor sends it. The app does not send a user ID and does not use this data for advertising.

Google runs Firebase and processes this data on my behalf, on servers that may be outside Brazil, including in the United States. Their terms: Firebase privacy and Google Privacy Policy. The statistics and crash reports are kept for the retention period configured in Firebase, after which Google deletes them.

There are no ads and no notifications. I do not sell data, rent it or share it with anyone.

Why it is used

Your token and your Fly.io data are used only to show you your own resources and to run the commands you choose, which is the service you asked for. The usage statistics and crash reports are used to find bugs and to see which features people use, on the basis of my legitimate interest in keeping the app working.

Deleting it

In the app, remove one account, or disconnect every account, and the stored tokens are deleted from the device. Uninstalling the app deletes them too. The token itself still exists at Fly.io until you revoke it there, with fly tokens revoke or in the Fly.io dashboard. Do that if you lose the phone.

The usage statistics and crash reports carry no name or account, so I usually cannot tell which ones are yours; you can still ask me what exists, ask me to delete it or object to it. You can still write to me with any question about your rights, and I answer within 15 days. You may also complain to the ANPD, Brazil's data protection authority.

Security

Requests to Fly.io are encrypted in transit, and the token is kept in the system's encrypted storage. No system is completely secure. Use a token with the narrowest scope that works for you.

Children

FlyControl is meant for adults who run infrastructure on Fly.io. It is not directed at children, and I do not knowingly collect data from anyone under 18.

Changes

If this policy changes, the date at the top changes with it. A change that affects what is collected or where it goes will be described here before the version that makes it is published.

Contact

Tiago Danin, TiagoDanin@outlook.com.

These terms apply to anyone who installs or uses FlyControl on Android or iOS. Connecting an account means you accept them. If you do not, uninstall the app.

Who provides the app

Tiago Danin, a private individual in Brazil, who develops and publishes FlyControl. "I" and "me" below mean him. "You" means the person using the app.

What FlyControl is

An independent client for the Fly.io API. It lists your apps and machines, shows logs, metrics and deployments, and lets you start, stop, restart or destroy a machine.

FlyControl is not affiliated with, endorsed by or supported by Fly.io. Fly.io is a trademark of its owner. For problems with your Fly.io account, billing or infrastructure, contact Fly.io, not me.

Price

Free, with no ads and no purchases.

You act on real infrastructure

Every command runs on your actual Fly.io resources. Stopping a machine takes your service down. Destroying a machine is permanent and cannot be undone from the app or by me. The app asks you to confirm before destroying, and it is still your decision.

You are responsible for the token you connect, the permissions it carries and anything done with it through the app, including costs Fly.io charges you. Use a token with the narrowest scope that works, and revoke it at Fly.io if your phone is lost.

Fly.io can change

FlyControl depends on Fly.io's API, its limits and its terms. Some of what it uses, such as the logs endpoint, is not officially documented. If Fly.io changes or limits its API, features can stop working until I adapt the app, or for good. Your use of Fly.io itself is governed by Fly.io's own terms.

What you may do with it

I give you a personal, free, non-exclusive and revocable licence to use FlyControl on your devices. You may not resell or redistribute it, or use it against accounts you are not authorised to manage. The name, the icon and the design are mine.

Liability

FlyControl is provided as it is. Data shown in the app comes from Fly.io and can be delayed or incomplete. To the extent Brazilian law allows, I am not liable for downtime, data loss, destroyed machines, charges from Fly.io or any other damage caused by commands you send or by relying on what the app shows. Nothing here removes a right that the law gives you and that a contract cannot take away, such as those in the Código de Defesa do Consumidor.

Privacy

What the app stores and where it goes is described in the privacy policy on this same page.

Changes

I may update these terms. The date at the top changes when I do. Continuing to use FlyControl after that means you accept the new version.

Law

Brazilian law governs these terms. Anything an email cannot settle goes to the courts of Belém, Pará, without prejudice to your right as a consumer to sue where you live.

Contact

Tiago Danin, TiagoDanin@outlook.com.