1. Who we are and what this policy covers#
Fluttercube is operated by MGR Group UAB (legal name UAB "MGR Group"), registered office at Rasų g. 25-1, LT-11351 Vilnius, Lithuania (European Union). MGR Group UAB is the controller of the personal data described in this policy. You can reach us at privacy@fluttercube.com or through the in-app contact form.
This policy covers the Fluttercube service, currently served at fluttercube.vercel.app and at any other domain we operate for it. Fluttercube is a streaming platform for AI-generated films: every film on Fluttercube is AI-generated and is presented as such. Watching is free. Signed-in viewers can tip creators and buy a monthly creator Support subscription. Our ledger currency is the euro (EUR); if your card is in another currency, your bank or Stripe converts the amount.
This policy explains what data we collect, why, on what legal basis, who receives it, how long we keep it, and the rights you have under the General Data Protection Regulation (GDPR). It applies from 11/08/2026.
2. Data we collect#
Account data. When you sign up we collect your email address, a password (stored only in hashed form by our authentication provider), a display name, and an optional @handle. You can optionally add a first and last name; these are never shown publicly. If you sign in with Google or Apple, we receive your name and email address from that provider instead of a password.
Age attestation. Films flagged 16+ require a one-time, self-attested date of birth before playback. We store the date of birth you enter, once per account. This is a lightweight age gate, not identity verification.
Watching and engagement data. For signed-in users we store watch progress and watch history, your watchlist, the creators and series you follow, likes, comment reactions, and the comments you write.
View counting. To count a view once per person we use a viewer key. For signed-in viewers this is your account. For signed-out viewers it is a salted, one-way hash derived from your IP address and browser signature, computed on our servers. The raw IP address is never stored for view counting; only the hash is.
Payment data. When you tip or take out a Support subscription we create a customer record with our payment provider Stripe and store the Stripe customer reference, plus a transaction record: amount, currency (EUR), processing fee, status, and the creator you paid. Your card details are entered directly into Stripe's secure form and never touch our systems. If you choose to save a card for one-tap tips, we display only the card brand and last four digits.
Creator data. If you apply for creator verification we collect your application: a creative-vision statement, the AI tools you use, optional sample videos, an optional portfolio link, and the timestamp of your acceptance of the creator terms. If you connect a payout account, your bank and identity (know-your-customer) details are collected and held by Stripe, not by us; we store only your Stripe Connect account reference, its status, and your country.
Communications. Every email we send you is logged (recipient, template, delivery status). Messages sent through the contact form are relayed to our team by email and are not stored in our database.
Settings and audit records. We store your analytics consent decision, your email notification preferences, and an audit trail of key account actions (for example consent changes, data exports, account deletion).
Technical and error data. Our servers record operational error reports when something breaks. These reports contain the error, the page or route involved, and technical context; they carry no user identity, no cookies, and no request headers.
What others can see. Your display name, @handle, comments, and public profile are visible to everyone. If you Support a creator, your name appears on that creator's public supporters list. Tips are different: the creator is told a tip arrived, but never who sent it.
3. How we use your data and our legal bases#
We use your data only for the purposes below. Each purpose is matched to its GDPR legal basis.
• Running the service — creating and managing your account, streaming films, saving watch progress, comments, follows, watchlists, and creator tools. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
• Payments and payouts — processing tips and Support subscriptions, computing the revenue split, paying creators out, and sending receipts and payout notices. Legal basis: performance of contract. Stripe additionally processes your data under its own legal obligations (for example anti-money-laundering and know-your-customer rules) as an independent controller.
• Transactional messages — receipts, payout confirmations and failures, verification decisions, and moderation or copyright-case outcomes. These are part of the service and cannot be switched off. We also log the delivery of every email we send (recipient, template, delivery status). Legal basis: performance of contract; for the delivery log, our legitimate interest in reliable delivery and abuse prevention.
• Optional email updates — new uploads from creators you follow, new episodes, replies, new followers, milestones, and the weekly digest. All of these are OFF by default and sent only if you switch them on. Every such email can be switched off in one click — via the unsubscribe link or your mail app's unsubscribe function — and every category can be managed in Account under Notifications. Legal basis: consent (Article 6(1)(a)), which you can withdraw at any time.
• Security, fraud prevention, and abuse prevention — protecting accounts, deduplicating views, rate-limiting sensitive endpoints such as the contact form and data export, keeping an audit trail of sensitive actions, and operating our moderation and copyright-case processes. Legal basis: our legitimate interest in a safe, honest service (Article 6(1)(f)).
• Operational error telemetry — server-side error reports so we can find and fix faults. These reports carry no user identity and no profile is ever built from them; they run independently of your analytics choice. Legal basis: our legitimate interest in keeping the service working.
• Product analytics — understanding how Fluttercube is used, via PostHog on EU servers. Analytics run only if you have said yes. Legal basis: consent. See section 4.
• Age-appropriate access — using your one-time date-of-birth attestation to gate 16+ titles. Legal basis: our legitimate interest in protecting minors and complying with content-protection expectations.
• Legal compliance — keeping accounting records, tax records, and copyright-case records that the law requires us to keep. Legal basis: legal obligation (Article 6(1)(c)).
Whether you must provide data. You are never under a statutory obligation to give us personal data. Some data is contractually required: without an email address and a password (or a supported sign-in provider) we cannot create your account, and without the payment details you enter with Stripe we cannot process a tip or Support subscription. Everything else — optional names, the age attestation, watchlists, comments, optional emails, analytics — is your choice; not providing it only means the matching feature will not work.
4. Cookies, local storage and analytics#
Essential cookies. We set cookies that are strictly necessary to run the service: authentication session cookies (set by our auth provider, Supabase, so you stay signed in), a short-lived security cookie used only during password recovery (it expires after 60 minutes), and, for platform staff only, a session marker cookie used while an operator assists with an account (never set for ordinary visitors). Essential cookies are always on; the service cannot work without them.
Analytics is off by default. We use PostHog, hosted on European Union servers, for product analytics. It is fail-closed: until you actively say yes, no analytics code loads, no analytics request leaves your browser, and nothing is captured.
The consent banner. On your first visit a banner offers Accept or Decline for analytics. Essential cookies are shown as locked on; the analytics switch starts off. If you choose Accept or Decline, your choice is remembered and the banner does not reappear. Closing the banner without choosing leaves analytics off, but no choice is stored — the banner will ask again on your next visit.
Where your choice is stored. If you are signed in, your decision is stored on your account and applies wherever you sign in; every change is recorded in your account's audit trail. If you are signed out, the decision is stored in your browser's local storage (not a cookie) on that device only.
Changing your mind. Signed-in users can change the analytics setting at any time in Account, under Privacy & data. Switching analytics off takes effect immediately, without a page reload. Signed-out visitors can clear the site's browser data to be asked again.
What analytics collects when on. Page views and product events such as playback started, search used, upload completed, or tip completed. Analytics profiles are created only for signed-in, identified users. Search analytics record the shape of a search (query length, filters, sort, result counts) — not the text you typed.
We do not use advertising cookies or third-party tracking cookies.
5. Who receives your data#
We use a small set of service providers (processors) to run Fluttercube. Each receives only what its job requires, under contractual data-protection terms.
• Supabase — database, authentication, and file storage. Our project is hosted in Supabase's London region; all core application data lives there. Section 6 explains where your data is located and how transfers are protected.
• Stripe — payments, subscriptions, and creator payouts (Stripe Connect). Card details and creator bank and identity-verification data are held by Stripe. For its own compliance duties (fraud screening, anti-money-laundering, know-your-customer checks) Stripe acts as an independent controller under its own privacy policy.
• MUX — video processing and streaming delivery. Playback in this version of the service is public streaming: the video stream itself carries no personal account data.
• Resend — sending our emails from mail.fluttercube.com.
• PostHog — product analytics on its European Union cloud, only with your consent, and operational error telemetry without user identity.
• Vercel — application hosting, pinned to the London region.
• Trigger.dev — scheduled background jobs (for example payout runs and digest emails). Job payloads carry record identifiers, not personal details.
Beyond processors, we disclose personal data only: to the parties of a copyright case as described in section 11; where the law requires it or to competent authorities on a valid legal basis; and in a business transfer, in which case this policy continues to apply.
6. International transfers#
We keep your data in Europe wherever we can: our database, authentication, and application hosting run in London, United Kingdom — a country the European Commission has recognised as providing adequate data protection — and analytics run on PostHog's European Union cloud.
Some of our providers are headquartered in the United States (for example Stripe, MUX, Vercel, and Resend). Where a provider transfers personal data to the United States or another country outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
You can request a copy of the relevant safeguards by writing to privacy@fluttercube.com.
7. How long we keep data#
As a rule, we keep your data for as long as you have an account, then delete or de-identify it when you delete the account. Specific rules:
• Watch progress on unfinished films is pruned automatically after a period of inactivity on that title (currently 180 days). Finished watch history stays until you delete your account.
• Analytics data is held by PostHog on EU servers and only exists if you consented.
• Money records (transactions, payouts, subscription records) are kept for as long as accounting and tax law requires — under Lithuanian law, up to 10 years. After account deletion they are kept in de-identified form only: the records survive for legal and accounting purposes, but they are no longer linked to your identity.
• Copyright-case records and moderation records are kept as an audit trail of the statutory process, de-identified after account deletion.
• Consent and audit records are kept so we can demonstrate compliance; after account deletion they survive de-identified.
What account deletion does. You can delete your account yourself in Account, under Privacy & data. Deletion is a deliberate multi-step confirmation (you type a confirmation phrase). It permanently deletes your profile, private names, videos and series you uploaded, follows, watchlist, watch progress, notifications, consent records, and your age attestation. It de-identifies and retains: money records (as above), your comments (the text stays, authorship becomes anonymous so conversations are not destroyed), view counts, audit logs, and the deletion request record itself. Email delivery logs are unlinked from your account; the destination address on mail already sent remains part of the historical delivery record, retained as evidence of what was sent. After deletion you are signed out and the account cannot be recovered.
Creators and final settlement. If you are a creator with a confirmed balance at or above the payout minimum (currently EUR 25), or a payout in flight, deletion waits until that money is settled. A positive balance under the payout minimum cannot be paid out; you will be asked to explicitly acknowledge forfeiting it before deletion completes.
8. Your GDPR rights#
You have all the rights the GDPR gives you. None of them costs anything.
• Access and portability — download a copy of your data as a machine-readable JSON file, self-service, in Account under Privacy & data (Export my data). The export covers your profile, your age attestation, watch history, watchlist, follows, likes, comments and comment reactions, your own transactions and subscriptions, consent records, and notification preferences.
• Rectification — edit your profile details directly in Account, or ask us to correct anything you cannot edit yourself.
• Erasure — delete your account in Account under Privacy & data (see section 7 for exactly what is deleted, de-identified, or retained under legal obligations).
• Restriction — ask us to restrict processing of your data while a dispute about it is resolved.
• Objection — object to processing we base on legitimate interest. We will stop unless we have compelling legitimate grounds that override your interests.
• Withdraw consent — switch analytics off at any time in Account under Privacy & data, and switch off any optional email category there or via the unsubscribe link in the email. Withdrawal does not affect the lawfulness of processing before it.
To exercise any right you cannot complete in-app, email privacy@fluttercube.com or use the in-app contact form. We may need to verify that a request really comes from the account holder before acting on it.
Complaints. You have the right to complain to a supervisory authority. Our lead authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), vdai.lrv.lt. You may also complain to the data protection authority of the EU country where you live or work.
9. Children and age limits#
You must be at least 16 years old to hold a Fluttercube account. If you believe someone under 16 holds an account, contact us at privacy@fluttercube.com and we will investigate and close accounts held by children.
You must be at least 18 years old, or the age of majority where you live if that is higher, to tip, to take out a Support subscription, or to monetise as a creator.
Films flagged 16+ require a signed-in account and a one-time date-of-birth attestation before playback. If the attested date of birth shows an age under 16, playback of 16+ titles is blocked and the attestation cannot be re-entered.
10. Automated decision-making#
We make no automated decisions about you that produce legal effects or similarly significantly affect you, within the meaning of Article 22 GDPR.
What does run automatically is content ranking: recommendations, trending rows, and search ordering decide which films to show you, nothing more. Creator verification, content moderation, and copyright-case decisions are always made by a human; reports and copyright cases are reviewed by people, and nothing is removed automatically.
Payment fraud screening is performed by Stripe as an independent controller under its own policies.
11. Data in copyright cases#
If you send us a copyright infringement notice, we record the data the statutory process requires: your name, your contact details, your organisation if given, and the text of your notice. You do not need a Fluttercube account to send a notice. Notices go to our copyright agent: Copyright Agent, MGR Group UAB, email dmca@fluttercube.com.
If your content is taken down and you submit a counter-notice, we record the statutory counter-notice content, including your contact details and your statements made under penalty of perjury.
We send the statutory notices the process requires to both sides (for example takedown notices, counter-notice notices, and window-expiry notices). Automated case notifications never include the other party's contact details. A counter-notice is different: the law requires us to provide the person who filed the original notice with a copy of it, and a counter-notice necessarily includes your name and contact details — by submitting one, you accept that the claimant receives them. The counter-notice and court-action windows follow the statutory framework — for example, under 17 U.S.C. §512(g) the counter-notice restoration window is at least 10 and not more than 14 business days.
Copyright-case records, including an append-only activity log of every case action, are retained as the audit trail of the statutory process.
This section covers only the personal data involved. The full takedown and counter-notice process is described in our DMCA Policy at /legal/dmca.
12. Changes to this policy#
We will update this policy when the service or the law changes. The current version is always at /legal/privacy, and the Last updated date at the top of the page reflects the latest revision.
If a change materially reduces your rights or materially changes what we do with your data, we will give you reasonable advance notice — for signed-in users, by email or an in-app notice — before it takes effect. Continued use of Fluttercube after a change takes effect means the updated policy applies.
13. Contact#
Controller: MGR Group UAB (legal name UAB "MGR Group"), registered office at Rasų g. 25-1, LT-11351 Vilnius, Lithuania. VAT ID: LT100005973518.
• Privacy questions and GDPR requests: privacy@fluttercube.com, or the in-app contact form.
• Copyright notices: Copyright Agent, MGR Group UAB, dmca@fluttercube.com (DMCA Policy: /legal/dmca).
• Supervisory authority: the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), vdai.lrv.lt — or the data protection authority in your own EU country.
MGR Group UAB is established in Lithuania, so the GDPR applies to us with the Lithuanian State Data Protection Inspectorate as our lead supervisory authority.