Privacy

Last updated 26 August 2026

Flint runs on your machine. Most of what it does — reading files, running commands, driving your browser — happens locally and never reaches us. This page covers the part that does.

The short version

• We store your email address and a count of tokens you've used.
• We do not store your prompts, your code, your files or the model's replies.
• If you use your own API key, none of this applies — we're not in the path at all.

What we collect

Your email address

Given when you sign in. It's the account identifier and the only way to send you a sign-in code. Nothing else is asked for — no name, no company, no card.

Usage records

Every model request through our API writes one row: which model, how many input and output tokens, what it cost, and when. That's what your allowance is measured against and what your account page shows you.

The content is not in that row. Requests are streamed straight through to the model provider as they arrive; we read the token-count summary at the end and discard the rest. We never write your prompts or the replies to disk.

Authentication tokens

Your Flint token is stored as a SHA-256 hash, never in the clear. A copy of our database yields nothing anyone could sign in with. Sign-in codes are hashed the same way, are single-use, and expire after 10 minutes.

What we don't collect

• Your files and code. Flint reads them on your machine. They only leave it as part of a prompt you send to a model, and we don't retain those.
• Your terminal output. Same — local, unless you include it in a prompt.
• Your browsing. The browser bridge is loopback-only and reports to the app on your machine, not to us.
• Analytics. This site runs no analytics, no tracking pixels and no advertising scripts.
• Cookies. We don't set any. Your account page keeps your token in this browser's local storage; signing out deletes it.

Who else sees it

Flint is a small operation built on a few services. In order of how much they see:

• The model provider. Your prompts are forwarded to OpenRouter, which routes them to the model you picked. They see the content of your requests and are bound by their own privacy policy and the underlying model provider's.
• Cloudflare. Hosts this site, the API and the database. Standard request logs apply.
• Resend. Sends sign-in emails, so it processes your email address.

We don't sell data, share it with advertisers, or hand it to anyone else.

Using your own key instead

If you'd rather we saw nothing at all, don't sign in. Set your own API key in .env and Flint talks to your provider directly — no account, no metering, no requests through our servers. See the docs.

How long it's kept

Usage rows are kept while the account exists, so you can see your own history. Sign-in codes are deleted once used or expired. Pending device authorisations are deleted the moment the app collects its token.

Your choices

• See what we hold — your email, plan and usage are all on your account page.
• Revoke a token — sign in again to issue a new one, or ask us to revoke the old one.
• Delete your account — email the address below and we'll remove your account and its usage rows.

Children

Flint isn't intended for anyone under 16, and we don't knowingly collect their data.

Changes

If this policy changes in a way that affects what we collect, the date at the top changes and we'll say so on the site.

Contact

Questions, deletion requests, or anything else about your data: hunterjreid@gmail.com.