Privacy policy
Last updated October 20, 2026. Flesh It Out is run by TR Studios (Traumatized Studios), Canada. Contact: contact@trstudios.ca.
Flesh It Out turns your notes into a web page you can share. This page explains what we collect to do that, why, who else handles it, how long we keep it, and how to have it removed. We don't sell your data or use it for advertising.
What we collect
- Your email address, to create your account and sign you in. With email sign-in we send a one-time code to it.
- Your Google account ID and the email address Google shares, only if you sign in with Google. We ask Google for nothing else: not your name, contacts, files or anything in your Google account. You can disconnect Google under Account.
- What you write: the notes, brief and instructions you give us to make a page, and the page that comes out.
- Account records: your plan, when you agreed to the terms, how many pages you've made (title, date and how much AI processing each used) so we can count them toward your plan.
- Payment records, if you pay: which plan or pack you bought, the amount, your country, and Stripe's customer and subscription references. Card details go to Stripe and never reach us.
- Reports: if you report a page, the reason and details you give, your email if you add it, and your IP address, so we can deal with abuse.
- Technical data: a sign-in cookie that keeps you signed in, and IP addresses used briefly in memory to limit abuse (for example, how many codes or pages one address can request per hour).
How we use it
- To sign you in and keep your account secure.
- To make, store and serve your pages, and to let you revise them.
- To check pages for scams and harmful content before they're published, and to act on reports.
- To count usage against your plan and handle payments, refunds and subscriptions.
- To email you sign-in codes and messages about your account or payments. We don't send marketing email.
Who else handles it
We use a few service providers to run Flesh It Out. Each only gets what it needs for its job:
- AI providers (OpenRouter and the model providers it routes to, or Anthropic): your notes and instructions, to write the page, and the finished page, to check it for scams and harmful content.
- Cloudflare: stores the pages you make (R2) and delivers the site.
- Zoho ZeptoMail: sends sign-in codes and account emails.
- Stripe: handles payments and subscriptions.
- Google: only if you choose to sign in with Google.
- Our hosting provider, where the app and its database run.
Some of these providers process data outside Canada, including in the United States. We may also disclose information if the law requires it, or to protect people from fraud or abuse.
Who can see your pages
A page is visible to anyone who has its link. Links are long and random, and pages aren't listed or indexed by search engines, but anyone you share a link with can pass it on. Don't put anything in your notes that you wouldn't want the people you share with to see.
How long we keep it
- Pages are deleted automatically when their link expires: after 24 hours on the Free plan and 30 days on Pro or with a page pack. You can delete a page sooner yourself. After deletion we keep only a small record (title, date and usage) so it still counts toward your plan's limits.
- Sign-in codes expire after 10 minutes. Sign-in sessions last up to 30 days.
- Your account stays until you delete it (under Account) or ask us to. Payment records are kept as long as tax and accounting law requires.
- Reports are kept while we deal with them and for a reasonable time after, in case the same page or person comes back.
Your choices and rights
You can delete your pages at any time, and under Account you can disconnect Google or delete your account and everything in it (this also cancels a Pro subscription). To see the information we hold about you, correct it, or for any other request, email contact@trstudios.ca from the address on your account. We'll reply within 30 days. If you're not satisfied, you can contact the privacy regulator where you live; in Canada that's the Office of the Privacy Commissioner.
Cookies
We use only the cookies the site needs to work: one that keeps you signed in, and a short-lived one during Google sign-in. We don't use advertising or tracking cookies.
Children
Flesh It Out isn't meant for children under 13, and we don't knowingly collect their information. If you think a child has given us information, email us and we'll delete it.
Security
Connections are encrypted, sign-in codes and session tokens are stored only as hashes, and access to our systems is limited. No service is perfectly secure, but we work to protect your information and will tell you if a breach affects you.
Changes
If we change this policy in a way that matters, we'll update the date at the top and tell you when you next sign in.