Last updated September 24, 2026. Draft, pending review.
Your email address, your name if you give one, and the content you put into the apps (transactions, watch history, recipes, study data, and so on). Sign-in records include the time, IP address and browser of each session so you can review and revoke them.
Vault contents are encrypted in your browser with a master password that is never sent to us. We store only encrypted data and cannot read it or recover it if the master password is lost.
Only to provide the service to you: showing you your own data, keeping you signed in, sending account emails (verification, password reset, security notices). We do not sell data, show ads, or use third-party analytics.
Flint uses Plaid Inc. to connect your bank. You choose to connect a bank; nothing is retrieved until you do, and you can disconnect at any time from Flint's settings. Through Plaid we receive your account names and balances and your transactions; we do not receive your bank login, which is entered on Plaid's own screens. This data is stored in your account only, encrypted at rest, and used solely to show you your finances. By connecting a bank you also agree to Plaid's End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy.
Two essential cookies: one keeps you signed in across the apps, one protects forms against cross-site requests. Preferences such as light or dark mode are kept in your browser's local storage.
Data is stored on servers operated for firesuite.app, encrypted in transit (HTTPS) and backed up in encrypted form. Passwords are stored as argon2id hashes. Each account's data is kept in separate storage from every other account.
Bonfire can sync two ways with Apple Calendar or Google Calendar if you connect one. For Apple you provide an app-specific password created in your Apple account, which you can revoke there at any time; for Google you sign in with Google and can remove Bonfire's access from your Google account's third-party access page. These credentials are stored encrypted and used only to read and write the single calendar you choose. Disconnecting in Bonfire stops syncing and deletes the stored credential; events already in your calendar stay there.
Bonfire can give you a private calendar link to subscribe to from Apple Calendar, Google Calendar or Outlook. The link contains a long secret; anyone who has it can read that household calendar until you replace or remove the link from Bonfire. Calendar providers fetch it on their own schedule and store what they fetch under their own policies.
You can invite another Fire Suite account to view or edit your Flint, Flicker, Skillet, Lantern or Bonfire. Nothing is shared until they accept, you choose view-only or edit access, and either of you can end it at any time from the account page. Bank connections, API keys and other settings are never shared. Data you share with someone is visible to them for as long as the share lasts.
Your data is kept while your account exists and you can delete any of it yourself at any time. Deleting your account removes your data from every app immediately; encrypted backups age out within 14 days; sign-in and administrative audit records are kept for 12 months. Disconnecting a bank stops all further retrieval from Plaid and deletes the connection; transactions already imported remain part of your records until you delete them or your account. Our full Data Retention and Disposal Policy is available on request.
You can export everything, correct your details, or delete your account from the account page at any time, without asking us. For anything else, email us.
Privacy questions: hello@firesuite.app.