Privacy policy

Who we are

Flizy is a chat wallet at flizy.app, operated by Flizy Tek Ltd, an incorporated company. That company is the data controller for the personal data described here, and "we" in this policy means that company.

You create an account on the site, then send and receive crypto from WhatsApp or Telegram to people you already trust. This policy describes personal data we hold when you use the site, the bots, and linked platforms.

What we collect

• Email and verification codes. Registration email, optional extra emails, and short-lived codes that prove you control that inbox. If you choose Continue with Google, Google tells us the verified email on that Google account. We use it to find your Flizy account. We do not store a Google access token.
• Phone number. Only when you prove it in WhatsApp or Telegram (contact share or equivalent). We do not accept a typed number as proof.
• Platform identities. If you link GitHub, Discord, X, or TikTok: the immutable user ID (routing key) and the display handle. We do not read your posts, messages, or followers on those platforms.
• Flizy username and display name. Username is your public invite and pay identity. Display name is optional.
• Wallet and history. Your Flizy agent-wallet address, trusted destination addresses you save, send / claim / swap records, and related transaction hashes.
• Payment notices. When a payment reaches your Flizy wallet, we store a short notice on your account and email it to your registration address. The notice names the amount, the asset, and who sent it. It does not include your password, your PIN, or a wallet key.
• Session cookies. A logged-in session cookie on the site. While that sign-in lasts we keep a short name for the device, and the city when the host provides one. We do not keep the network address. Continue with Google also sets a cookie for ten minutes. It carries the sign-in check and the page to open afterwards. It does not hold your email or a Google token. If you open an invite or a claim that carries an invite, a short invite cookie so signup can attribute you once. One cookie recording your analytics answer, set whichever way you answer.
• Chat link. One-time link codes and the channel bind (WhatsApp or Telegram chat id) after you redeem a code.
• Approval links. When chat needs your PIN, a one-time link to a Flizy page. We keep what the request was (for example the payment shown to you), which chat it came from, and when it was approved. Your PIN is checked against its stored hash and never kept.
• People you have paid. For each address you pay from Flizy, when you first and last paid it and how many times. This decides whether a small payment needs your PIN.
• Security counters. To limit password guessing and signup abuse, we count failed sign-ins and signups against a one-way hash of your email and of your network address. The counters hold neither in readable form.
• App background. If you upload one, the image is stored privately, shown only on your own signed-in pages, and removed when you replace it. Pausing the account keeps it. Signing in brings it back.
• Follows. When you follow someone, we store that pair, the time, whether you asked for activity alerts, and whether copy trade is on for that follow. No alert is sent yet, and nothing is copied yet. Follower and following counts and lists are public unless you turn off Show followers and following. Volume and swaps on a profile follow Show trading stats. Activity on a profile stays hidden unless you turn on Show activity. Choosing Private turns those switches off and removes the profile from search. Choosing Public turns them on. Show wallet address shows the wallet on the profile. Show portfolio value shows that wallet's ETH balance. The profile link still opens when the profile is private. Following does not send a payment and does not open a chat.

TikTok data

When you choose to link TikTok, Flizy requests the TikTok Login Kit scope user.info.basic. From that grant we read only:

• your TikTok user ID, stored as the routing key for claims sent to that account
• your TikTok display handle, stored for display on Flizy

We do not post to TikTok. We do not read your videos, comments, likes, DMs, or follower lists. We do not use TikTok data to advertise. Unlinking TikTok on Account removes that bind from your Flizy account. Pending claims already addressed to that TikTok user ID stay addressed to that ID until claimed or cancelled.

Why we hold it

• Create and sign you into the account.
• Prove email and phone so claims pay out to the right person.
• Route a send or claim to a GitHub, Discord, X, or TikTok identity you linked.
• Keep trusted destinations and an unlock PIN under your control.
• Attribute an invite once, and count it only after onboarding, a verified phone, and a confirmed Flizy transaction.
• Operate the product, debug failures, and stop abuse.
• Email you, and show a notice in the app, when a payment reaches your Flizy wallet.
• Show a public profile, follower counts, and who follows whom, when those switches are on. A wallet address or that wallet's ETH balance is shown only when that switch is on.

Analytics, and your choice

Nothing that measures your visit runs until you accept it. On your first visit we ask, with Accept and Reject offered equally. Reject is remembered and the site works exactly the same. If you never answer, nothing loads.

If you accept, these run on the public pages only: the home page, how it works, docs, terms, privacy, and the sign-in and sign-up pages. They do not run on your dashboard, on a payment link, or on a claim link, so what they see never includes your balance, your wallet address, your saved destinations or your history. They never run in WhatsApp or Telegram.

• Google Analytics 4. Pages visited, rough location from your IP, browser and device type. We switch on IP anonymization.
• Microsoft Clarity. How the public pages are used: clicks, scrolling, and a replay of the page session.
• Umami. Page view counts, no cookies.

These never see your password, your unlock PIN, or a verification code. They are not on the bots, and we do not use advertising pixels or sell anything to advertisers. Your answer is stored in one cookie for six months, and you can change it whenever you like.

Who it is shared with

We pass account data only to the services that run Flizy: Supabase (database) and our email sender for verification codes and payment notices. Continue with Google sends you to Google, which receives that sign-in request. If you accepted analytics, the measurement services named above also receive the site usage described there, and nothing else. We do not sell it. We do not use advertising pixels.

The NFT pages read public chain data about your wallet through the GIWA block explorer. NFT artwork loads from wherever that NFT's creator hosts it, so that host sees your IP address and browser, as with any image on the web; we send it no page address. The dollar estimate next to ETH prices is fetched by our servers from CoinGecko, and nothing about you is sent with that request.

You can also connect a wallet of your own, with or without a Flizy account. No account is made for it. Our servers see its address when a page asks for something on its behalf, such as which NFTs it owns or the steps of a trade it is about to sign, and the address is not saved from those requests. To stop those pages being overused, we count requests per network address, kept as a hash; counts older than a day are cleared as new requests come in. After a swap, an NFT trade or a deposit into a Flizy wallet, we keep its transaction hash so the Flizy accounts it touched are told once, and we add it to Scan. Scan also lists every swap and NFT trade made through Flizy's own contracts, read from the public chain, whether or not the wallet ever visited the site. Such an entry shows what the transaction did and the wallet's address, both already public on the chain, as a guest, and is not filed under any Flizy account. A deposit also shows the Flizy wallet it reached, named only if that account shows its username on Scan. The wallet signs its own transactions, and Flizy never holds its keys. Connecting goes through Privy and, for wallets on another device, WalletConnect; your wallet app and those services see the connection under their own terms. If you later save that wallet as a trusted address on your account, it is stored like any other trusted address.

How long we keep it

• Verification codes expire in minutes and are then useless.
• A sign-in counter clears on a correct sign-in. Network address counters reset after an hour without a failure.
• Session cookies last until you sign out or they expire.
• Invite cookies last up to 14 days, or until they are used at signup.
• The analytics answer lasts six months, or until you change it.
• Account, username, trusted addresses, and history stay while the account exists.
• The record of who you paid stays while the account exists. Someone you have not paid for 180 days no longer counts as someone you pay.
• A phone that has already produced an invite credit is remembered so the same number cannot mint a second credit after unlink. That record is not a live bind.
• A follow stays until you unfollow, or until either account is removed.
• On-chain records last as long as the chain does. We cannot erase them.

Deactivating your account

You can unlink WhatsApp, Telegram, GitHub, Discord, X, and TikTok yourself on Account. You can remove extra emails and trusted addresses there too.

Deactivate is the only way to close the sign-in. It pauses the account. Sign in later with the same email and the account password and that same account opens again, including the wallet and the history. A new browser still asks for the emailed code before the pause is lifted. Continue with Google opens that same account when Google has verified the same email, without the password and without that code. Chat does not run while the account is paused. Payments sent to the username or Flizy number can still arrive. The button does not move funds. Confirmed chain transactions stay on the chain.

Unlink and extra-email removal stay available while the account is open. For records this screen does not erase, email [email protected] from the address on the account, or message us on X at @Flizyapp from an account you can tie to that email. We will not delete another person's data. We cannot delete confirmed chain transactions. If you have pending escrow, say so; we will cancel unclaimed holds back to the sender where the product already allows cancel.

Contact

• [email protected]. Privacy and data requests, including account deletion.

You can also message @Flizyapp.

Changes

If this policy changes in a way that affects how we use personal data, we will update this page and the date above. Continued use after that date is acceptance of the updated policy.