Privacy policy
This policy says what personal data Flung collects, why, how long it is kept, who handles it for us, and how to use your rights. It covers the Flung API, the portal at app.flung.dev, the connect panel, the hosted MCP server and these docs.
Last updated: 2026-10-30
TL;DR
| Question | Answer |
|---|---|
| Who is responsible for your data? | Buun Group Pty Ltd, ABN 75 687 193 675, registered in Spring Mountain, QLD 4300, Australia. |
| Whose data is this about? | Two groups. People who sign in to Flung and own or belong to a workspace. And people who connect a social account through a workspace, often in another company's app that uses Flung. |
| What do you collect from people who sign in? | Their email address, when they signed in, the workspaces they belong to, and the apps they approved. Sign-in codes and sessions are kept only as hashes. |
| What do you collect from a connected social account? | The account's id, username, display name and picture address, the access granted, and the platform's tokens, encrypted. Then the posts the workspace sends to it, with each platform's result, and, where the inbox is on, comments on and mentions of the account. |
| What is the data used for? | Only to publish, schedule and report on what the workspace asks for, and to keep the service secure. Nothing is sold, used for advertising, or used to train AI models. |
| Who handles it for us? | Cloudflare hosts everything, Resend sends email, Stripe takes payments, and Neynar carries Farcaster posts. |
| How long is it kept? | Each row of What we collect and why says. Most of it stays until the workspace deletes it, or until you ask us to. |
| How do I get it deleted? | Disconnect the account, remove Flung in the platform's own settings, or write to legal@buungroup.com (opens in a new tab). Data deletion gives every way and what each removes. |
Who we are
Flung is run by Buun Group Pty Ltd ("Buun Group", "we", "us"). Buun Group decides why and how the personal data of the people who sign in to Flung is used. That makes it the controller under the GDPR (General Data Protection Regulation) and the organisation that answers for the data under Australian privacy law.
A workspace that uses Flung inside its own product decides what is posted to the accounts its users connect. For that data Flung acts on the workspace's instructions, and the workspace's own privacy policy also applies. Flung still answers for how it stores and protects everything described here.
| Detail | Value |
|---|---|
| Legal name | Buun Group Pty Ltd |
| ABN (Australian Business Number) | 75 687 193 675 |
| Registered office | Spring Mountain, QLD 4300, Australia |
| Privacy and legal contact | legal@buungroup.com (opens in a new tab) |
What we collect and why
Every kind of personal data Flung holds is in this table, with where it lives, why, how long it stays, and the legal basis. "The database" is Flung's database, hosted by Cloudflare. "Until the workspace deletes it" means there is no timer: the data stays until the workspace removes it through the API, the workspace is deleted, or you ask us to delete it.
| Data | Where it lives | Why | How long | Basis |
|---|---|---|---|---|
| Your email address, a person id, when the person was made, and the time of your last sign-in | The database | To sign you in to the portal and know which workspaces are yours | Until you ask us to delete it | Contract |
| Sign-in codes: a hash of your address, a hash of the 8-digit code bound to it, the times, and a count of wrong tries | The database | To check the code you type, and to limit guessing and repeated emails | A code works once, for 10 minutes. It is deleted an hour after it expires. | Contract and legitimate interests |
| Portal sessions: a hash of the session cookie, your person id, and the times | The database | To keep you signed in | 7 days, never extended. Deleted when it ends or when you sign out. | Contract |
| Workspace membership: the workspace, your role, and whether you want email notices | The database | To know who may act for a workspace and who to tell when an account needs attention | Until you are removed from the workspace | Contract |
| The workspace: its name, time zone, and, only if it joins the public leaderboard, the name it shows there with its level | The database | To run the workspace, and to show the leaderboard the workspace chose to join | Until the workspace is deleted. The leaderboard name goes when the workspace leaves it. | Contract and consent for the leaderboard |
| The private beta list: the addresses and domains approved to sign in, the reason, and when each was added or removed | The database | To let only approved people sign in while Flung is in private beta | A removed entry is marked and kept as a record, until you ask us to delete it | Legitimate interests |
| A connected social account: the platform, the account's id on it, its username or display name, its picture address, what the platform needs to post (such as a Mastodon server, a Facebook page, a LinkedIn organisation or a Discord server and channel), the access granted, its status, when its tokens expire, and the profile it belongs to | The database | To publish to the account and show which account it is | The tokens go when the account is disconnected. The rest stays so past posts keep their results, until the workspace is deleted or a deletion request removes the account. | Contract |
| The account's tokens from the platform: the access token, the refresh token, and the other secrets a few platforms need, such as Bluesky's session key | The database, encrypted with AES-256-GCM under a key held apart from the database. While posting, a decrypted copy is held in memory by the account's own process on Cloudflare (a Durable Object). | To publish for the account and to renew access before it runs out | The access and refresh tokens are deleted when the account is disconnected or the person removes Flung on a Meta platform. The other secrets stay encrypted with the account record, unusable without the tokens, until the account is deleted. A token the platform has refused stays encrypted and unusable until then. | Contract |
| A connect in progress: the platform, the page to return to, the platform's sign-in address, the result, and a single-use secret (PKCE) | The database | To finish connecting the account the person approved | The single-use secret is deleted when used, or after 10 minutes. The record of the connect is deleted 7 days after it expires. | Contract |
| Profiles: a name and the workspace's own id for one of its customers | The database | To keep each customer's accounts apart inside a workspace | Until the workspace deletes the profile | Contract |
| Posts: the text, the files attached, the text per platform, when to publish, and for each account the platform's post id, its link or the error | The database | To publish what the workspace asked, when it asked, and say what happened | Until the workspace deletes the post. A post already published stays on the platform under the platform's own rules. | Contract |
| Files: images and videos uploaded or imported, their type, name and size, and a thumbnail of each video | Cloudflare R2. Thumbnails are made by Cloudflare Media Transformations from the stored file. | To attach them to posts. Platforms that fetch files themselves (Instagram, Threads, Facebook, TikTok) get a signed address that expires. | Until the workspace deletes the file, which removes the file and its thumbnail | Contract |
| Templates, variables and feeds: saved post text, named values, and the address of each RSS or Atom feed with the ids of items already seen | The database | To post again from a template, fill in variables, and post each new feed item once | Until the workspace deletes them | Contract |
| The inbox: comments on and mentions of a connected account, with the author's id, name and handle, the text, the link and the times, and any reply sent | The database | To show the workspace what people said to its account and let it reply | Until the account is deleted. Turn the inbox off for an account to stop reading new ones. | Contract and legitimate interests |
| Webhook endpoints and deliveries: the address, the signing secrets (encrypted), the events chosen, and for each event sent its type, status, attempts and the endpoint's answer | The database | To tell the workspace's server what happened, and show why an event did not arrive | Until the workspace deletes the endpoint, which removes its deliveries | Contract |
| API keys: the name, the first characters, a SHA-256 hash of the key, its access, when it was last used, and when it expires or was revoked | The database | To check each call and let the workspace tell its keys apart | Until the workspace is deleted. A revoked key stays listed and never works again. | Contract |
| Apps and agents you approved: the app's name, the workspace, when, and the grant's tokens | Cloudflare KV | To let an app or agent act for the workspace you chose | An access token lasts an hour and a refresh token 90 days. The grant stops working when you disconnect the app in the portal or are removed from the workspace. | Contract |
| API usage: requests and errors per API key or app per day | The database | To show the workspace its usage and enforce plan limits | 90 days, then deleted | Legitimate interests |
Retry records: a hash of a request sent with an Idempotency-Key and the answer given | The database | So a retried request gets the first answer instead of a second post | Reused for 24 hours. The record stays until a later request with the same key replaces it, or the workspace is deleted. | Legitimate interests |
| Billing: the Stripe customer id, subscription id, plan, status and period end, and any plan Flung set by hand with its reason | The database | To give the workspace the plan it pays for | Until the workspace is deleted. Ids of Stripe events already handled are deleted after 30 days. | Contract |
| Email notices: your address and the account or post the notice is about | Sent through Resend | To tell workspace members when an account must be reconnected or a post failed | Not kept by Flung after sending. One click on the email's link turns notices off. | Legitimate interests |
| The staff log: each action Flung staff take in the staff console, with the time, the kind and id of what it was about, the reason typed, and the outcome. It holds ids only, never an address, a token or a key. | The database | To keep a record of who changed what and why | Kept as a record. It holds no rule to delete it. | Legitimate interests |
| Request logs: each request to the service, with its address, status and timing, and the lines the service writes when something fails | Cloudflare's logs service | To find and fix faults and abuse | For the time Cloudflare's logs service keeps them | Legitimate interests |
Data from each platform
Flung reads from each platform only what it needs to post for the workspace and report the result. It asks the platform for the access listed when a person connects, and the person approves it on the platform's own page. The data is used only to do what the workspace asks: publish, schedule, show the result, and, where the inbox is on, show and answer comments. It is never sold, never used for advertising, and never used to train AI models.
| Platform | What Flung reads | What Flung does with the access |
|---|---|---|
| X | Your account id, username, name and picture | Posts and uploads media. Reads replies and mentions only when the workspace turns the inbox on. |
| Your professional account's id, username and picture | Publishes posts, reads and answers comments, and reads the counts of posts Flung published | |
| The Pages you manage, with their names and tokens, and your Facebook user id | Publishes to the Pages you chose, reads and answers comments, and reads the counts of posts Flung published | |
| Threads | Your account id, username and picture | Publishes posts, reads and answers replies, and reads the counts of posts Flung published |
| Your member id, name and picture, and, if you allow it, the organisations you administer | Publishes posts for you or for those organisations | |
| TikTok | Your open id, username, display name and picture, and before each post the options TikTok lets you choose | Uploads and publishes videos |
| YouTube | Your channel's id and name | Uploads videos, reads and answers comments, and reads the counts of videos Flung published |
| Your account id, username and picture, and your boards | Creates pins on the boards you pick | |
| Mastodon | Your server, account id, username and picture | Publishes posts and media, reads and answers mentions |
| Bluesky | Your DID (decentralised id) and handle | Publishes posts, reads and answers replies and mentions |
| Discord | Your user id and name, and the server and channel you add Flung's bot to | Sends messages to that channel |
| Farcaster | Your FID (Farcaster id), username, display name and picture, through Neynar | Publishes casts through Neynar, reads and answers replies |
Each platform's own terms and privacy policy also apply to what you post there. Removing Flung in a platform's settings ends Flung's access at that platform.
YouTube and Google user data
Flung's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.
| Rule | What Flung does |
|---|---|
| Use | Data from YouTube is used only to upload the videos the workspace asks for, show their results and counts, and show and answer comments on them. |
| Transfer | It is not transferred to anyone, except as needed to provide those features, for security, to comply with the law, or as part of a sale of the business with notice to you. |
| Advertising | It is never used or transferred for advertising. |
| People reading it | No one at Flung reads it, unless you agree for a support request, it is needed for security or to comply with the law, or it is combined so that no person can be identified. |
| AI models | It is never used to train or improve AI or machine learning models. |
| Your choice | You can remove Flung's access at any time on your Google Account's third-party connections page (opens in a new tab). YouTube's use of your data is under the Google Privacy Policy (opens in a new tab) and the YouTube Terms of Service (opens in a new tab). |
The same rules apply to the data Flung receives from every other platform.
What we do not collect
- No passwords. You sign in to Flung with an emailed code, and to each platform on the platform's own page.
- No card details. You enter them on Stripe's pages, and Flung receives only ids and the plan.
- No direct messages. Flung reads public comments and mentions of an account only where the inbox is on.
- No advertising or analytics trackers. The portal, the connect panel and these docs load no third-party scripts.
- No full API key. Flung keeps only a hash, so a key is shown once when it is made and never again.
How sign-in and keys work
| Part | How |
|---|---|
| Signing in | You type your email address at app.flung.dev. Flung emails an 8-digit code that works once, for 10 minutes. Your address is stored only once the code is right. While Flung is in private beta, only approved addresses get a code. |
| Your session | A cookie that scripts cannot read, on the API's own address, for 7 days. A second cookie on flung.dev says only that a session exists, so the docs can show you are signed in; it grants nothing. |
| API keys | A key acts for its workspace. Flung keeps its hash, its name and its first characters. |
| Connect tokens | A short-lived token a server makes so a page can show the connect panel without an API key. It is not stored: it carries its own signed expiry. |
| Apps and agents | An app or agent you approve in the portal gets tokens for one workspace. You see and disconnect them on the portal's home page. |
Payments
Paid plans are sold through Stripe. When a workspace owner buys a plan, Stripe receives their email address and the workspace id, and they enter their card and billing details on Stripe's own pages. Flung stores the Stripe customer and subscription ids, the plan, its status and when the period ends. Stripe keeps payment records under its own policy.
The staff console
Flung staff use a staff console to run the service. It shows people, workspaces, connected accounts, keys and failed posts, but never a token, a key's secret part, a webhook secret or a post's media, and a post's text only in its first 140 characters. Staff can issue and revoke keys, disconnect an account, retry a post, set a plan and choose who may sign in. Every action needs a typed reason and is written to the staff log.
Cookies and stored items
| Item | Where | What it is for |
|---|---|---|
__Host-flung_session | A cookie on the API's address | Keeps you signed in to the portal for 7 days |
flung_signed_in | A cookie on flung.dev | Says that a session exists, so the docs can show you are signed in. It holds 1 and grants nothing. |
docs:theme and the chosen code tab | Your browser's storage, on these docs | Remember the light or dark theme and the language you picked for code samples |
There are no analytics or advertising cookies, so there is no consent banner.
Who handles data for us
| Provider | What it does for us | What it sees | Where |
|---|---|---|---|
| Cloudflare (opens in a new tab) | Hosts the API, the portal, the MCP server and these docs (Workers), the database (D1), files (R2), app grants (KV), the account processes (Durable Objects), scheduled posts (Workflows and Queues), video thumbnails (Media Transformations), rate limits and request logs | Everything described in this policy, encrypted where the table says | Cloudflare's network, worldwide |
| Resend (opens in a new tab) | Sends sign-in codes and email notices | Your email address and the email: the code, or the account or post the notice is about | United States |
| Stripe (opens in a new tab) | Takes payments and hosts the pages to pay and manage a plan | The buyer's email address, the workspace id, and what is entered on its pages | Stripe describes where in its privacy policy |
| Neynar | Carries Farcaster sign-in, posts and replies, for workspaces that connect Farcaster | The Farcaster account and what is posted to it | Neynar describes where in its privacy policy |
The social platforms are not our providers: Flung sends them what the workspace asks it to post, under each platform's own terms. These providers handle data outside Australia, and for a person in the European Union or the United Kingdom, outside their own region. Each describes its safeguards for such transfers in its privacy policy, linked above. We disclose data to others only where the law requires it.
A deleted record can remain for a limited time in Cloudflare's own database restore history.
Your rights
You can ask us to:
- tell you what we hold about you, and give you a copy
- correct data that is wrong
- delete your data
- restrict or stop a use of your data, where you object to it
For people in the European Union and the United Kingdom, these rights come from the GDPR. For people in Australia, they come from the Privacy Act 1988 and the Australian Privacy Principles (APPs), which include access to and correction of your personal information.
To use a right, write to legal@buungroup.com (opens in a new tab) from the address you sign in with, or say which address or social account it is about. We answer within 30 days. We may need to check it is you before we act, because acting on a false request would harm the real owner. If you connected your account through another company's app, you can also ask that company.
If you are not satisfied, complain to us first at the same address. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au (opens in a new tab)). A person in the European Union or the United Kingdom can complain to the data protection authority of their own country, such as the Information Commissioner's Office (ico.org.uk (opens in a new tab)) in the United Kingdom.
Deleting your data
Data deletion says how to delete a connected account, how to remove Flung in each platform's settings, how to have a whole workspace deleted, and what stays afterwards.
Changes to this policy
We change the date at the top whenever this policy changes. If a change affects how your data is used in a way that matters to you, we say so on this page and email the owners of workspaces.
See also
| Page | Why |
|---|---|
| Data deletion | Every way to delete your data, and what each removes |
| Terms of service | The agreement to use Flung |
| Authentication | API keys, app sign-in and connect tokens |
| Add account connecting to your site | The connect panel, where people connect and disconnect accounts |