PRIVACY
We keep the facts, not your files.
Flipper reads the tools your team already uses and turns them into shared memory for people and AI agents. This page lists every privacy control that exists, in plain words — and, for each one, what you can check to see it is true.
- Read-only connections
- Encrypted before it is stored
- Never used to train a model
- Export or delete any time
The short version
What Flipper does, and what it never does.
What Flipper does
- Reads only the sources you connect, and only with view permission.
- Answers your own team’s questions, with a link back to the original message or file.
- Scrambles your content before saving it, so the database alone is unreadable.
- Gives each person only the context they are allowed to see — agents included.
- Lets you take everything out as one file, or delete it all, without asking us.
What Flipper never does
- Never trains an AI model on your content.
- Never sells, rents or advertises against it.
- Never mixes one company’s memory into another’s answers.
- Never scores or ranks people — there is no such number anywhere in it.
- Never sends, posts or changes anything on your behalf.
What Flipper reads
Nothing until you connect it. Then only what you connected.
Every connection asks the tool for the narrowest view-only permission it offers. Flipper cannot send an email, edit a document, move a file or change a ticket — the permission to do it was never requested.
| Source | What Flipper can see | Access | Who connects it |
|---|---|---|---|
| Gmail | Messages, subjects and labels in your own inbox | View only | Each person, for themselves |
| Google Drive | Document contents and file details | View only | An owner or admin, once |
| Google Calendar | Event titles, times and who was invited | View only | An owner or admin, once |
| Slack | Messages in the channels you allow | View only | An owner or admin, once |
| Notion | Pages you share with the integration | View only | An owner or admin, once |
| Jira & Trello | Issues, cards and their comments | View only | An owner or admin, once |
Gmail is the only per-person connection — an inbox belongs to one person, so nobody else can connect it for you. Every other source is one shared team connection.
Three more things worth knowing
- History has a ceiling. A new connection reads the last 7 days on the free plan, 30 days on paid — not your entire archive.
- Catching up has a ceiling too. If a connection is paused and resumes, Flipper reads at most 30 days of what it missed.
- Disconnecting stops it immediately. No more reading, and the stored key for that source is removed. You can also revoke Flipper directly in Google, Slack or Notion, without touching Flipper at all.
Who sees what
The same question can have two different answers.
Connecting a tool does not flatten its permissions. Flipper works out what you are allowed to see before it searches, so two people on the same team can ask the same thing and get different answers.
One rule decides it, and it only ever narrows:
- You can see a fact only if you can see at least one source it came from.
- Department groups narrow that further — sales does not inherit finance.
- Anything marked private is readable by its author and nobody else.
? What is our pricing floor for enterprise deals?
List-price floor is $40k, approved at the Q3 pricing review.from Finance / pricing-review.doc
Discounts past 15% need the CFO’s sign-off.from Finance email thread
? What is our pricing floor for enterprise deals?
Enterprise pricing is quoted per deal, not published.from Support / handbook page
2 facts withheld — sourced from Finance
Tom is not told what he is missing beyond the count. The filter runs inside the search itself, so hidden facts never reach the page in the first place.
Deciding what is sensitive
Where it came from matters more than what it says.
Three things set the level, and the result can only ever move up.
Floor
Where it arrived from
A fixed rule, no judgement involved. Email is treated as confidential. Shared team sources start as team-visible.
Cannot be lowered by anything downstream.
One check
What the document is about
A single pass over each document — never over individual facts — flags pay, performance, hiring and firing, health, legal disputes, passwords and unannounced deals.
Undecided means confidential, not public.
Result
The stricter of the two
Whichever is more restrictive wins. If the check fails or cannot run, the floor still applies on its own.
Failure makes Flipper less useful, never more exposed.
The check reads the document once, before any facts exist — so it is never judging a sentence out of context.
| What was said | Where it came from | Result |
|---|---|---|
| Support agents can refund under $50 on their own | Notion process page | TeamA process, not a person's pay |
| Refunds over $500 need Alice's approval | Notion process page | TeamNames a person, but not their pay or performance |
| Production deploys need two approvals | Jira ticket | TeamA working rule, and it applies to everyone |
| Priya owns the billing migration | Trello card | TeamNames a person, but it is their work, not their pay |
| A customer is threatening to sue over the March outage | Jira ticket | ConfidentialRaised above its source — a legal dispute, wherever it was written |
| Promotions are decided twice a year at calibration | HR handbook page | TeamA policy that applies to everyone |
| Staff accrue 20 days of leave a year | HR email | ConfidentialThe floor wins — the same sentence in a doc would be team-visible |
| Daniel's promotion was deferred at calibration | ConfidentialBoth agree: an email, and about one named person |
Two rows carry the design. The leave policy is locked up because of where it arrived, not what it says — an admin can widen it deliberately. The lawsuit ticket runs the other way: an ordinary team source, raised by what is in it.
Every step, end to end
Most of your content is never stored at all.
Flipper is a facts database, not a document store. It reads your work, distils what matters into short sourced statements, and lets the original go. Here is the whole journey, stage by stage.
Arriving
Content is pulled over an encrypted connection. The key that lets Flipper read your tool is itself scrambled with AES-256-GCM before it is saved.
Splitting up
Long documents are cut into passages while they are being processed, in memory. Nothing is written down at this stage.
Understanding
Passages go to the AI model that turns them into facts, under contracts that keep your content out of model training. Use your own provider key and it runs under your account instead.
Letting the original go
The original text is not kept. What the database records is a fingerprint of it — a one-way SHA-256 hash used to notice edits and avoid duplicates. A fingerprint cannot be turned back into the text it came from.
The one exception
Short items under 500 words can be kept so “show source” works. Each gets its own encryption key, that key is locked by a second key held elsewhere, and it is never handed out as a link — Flipper unlocks it on the server, after checking you are in the workspace.
Making it searchable
For meaning-based search, what gets stored is a list of 1,536 numbers per fact. Numbers, not sentences.
Answering
Facts are short statements, each carrying its access level and a link to where it came from. The access filter runs on every single read, for people and agents alike.
The shortest version: the database holds distilled facts and a fingerprint of the source. The source itself is either gone or locked.
The two locks on anything that is kept
Every stored item gets its own one-time key. That key is then locked with a second key that lives somewhere else entirely.
The content
Your message, document or event
Scrambled with AES-256-GCM
Using a fresh key made just for it
The key to it
That one-time key is itself locked
By a master key held outside the database
Rotating it re-locks keys, not your content
The database on its own is not enough to read anything. The same treatment applies to the access keys for every tool you connect, and to your own AI provider key if you bring one.
The rest of the storage picture
- In transit, everything is over TLS.
- Between companies, workspaces are separate — one company’s memory can never appear in another’s answer.
- Bring your own AI key and the thinking runs under your provider account, on your terms, metered by you rather than us.
- Where it lives: workspaces run in the United States, on managed infrastructure that encrypts its own storage underneath everything above.
Your AI agents
An agent gets your view. Never more.
- An agent connects with its own credential, tied to one workspace and one person.
- It reads through the same filter you do — connecting Claude or ChatGPT widens nothing.
- Every agent is listed on one screen, and revoking is one click. It stops working on its next request.
- Sign-ins, failures and revocations are all recorded.
An illustration of the Agents screen. Every connection is tied to the person who authorised it, and shows when it was last used.
And it never acts on its own
- When Flipper proposes a next step, it returns a draft plus its sources — marked as not executed.
- Anything Flipper writes for itself stays a draft until a person reads it and approves it. Agents cannot see unapproved drafts.
- Your agent does the doing, under its own credentials, where you can see it.
The audit log
Who did what, kept for your admins.
Admins and owners only — a member cannot open it.
- Memory changes — a fact created, corrected, retracted, deleted, re-marked, or replaced by a newer one.
- People changes — a workspace setting changed, a member added, removed or moved between departments.
- Connections — connected, paused, resumed, failed, or a key that stopped working.
- Agents — signed in, refused, granted, refreshed, revoked.
- Approvals — who approved which draft, and when.
Leaving
Take everything, or delete everything.
- Export is one file of JSON containing your whole workspace — facts, where each came from, its level, and its history. Available any time, without asking us, and available before you delete.
- The export deliberately includes retracted and corrected history. An export that quietly dropped what you changed your mind about would be a worse record than the thing it copies.
- Delete is the owner’s to press, and everything outward-facing stops the same second.
Immediately
- All reading of your tools stops
- Every agent credential is revoked — they fail on the next request
- Nothing new can come in
For 30 days
- Your team can still read the workspace, so an owner can change their mind
- A banner shows everyone the exact purge date
- One click restores it
After 30 days
- A scheduled job permanently erases the workspace and its contents
- Backups age out shortly after on their own cycle
- Only records the law requires us to keep remain
The undo window is why the workspace stays readable — it exists so a mistaken deletion is recoverable, not so anything keeps flowing. Nothing is ingested and no agent can read it.
Switches you control
Three are on out of the box. Two are yours to turn on.
Owners and admins set these for the whole workspace, so no member can loosen a restriction that hides pay or fundraising from them.
| Setting | What it does | Default |
|---|---|---|
| Keep sensitive facts to admins | Confidential material stays with owners and admins | On |
| Let people mark things private | Anyone can lock a fact to themselves alone | On |
| Require approval | Anything Flipper drafts waits for a person | On |
| Hide unreadable content | If the sensitivity check could not read something, treat it as confidential rather than trusting its source | Off |
| Hide unfiled content | Anything not yet assigned to a department is admins-only instead of team-wide | Off |
The last two are off by default on purpose: they tighten access, and a workspace that never touched its settings should behave exactly as it did yesterday. Turn them on when you would rather lose an answer than over-share one.