Last updated: September 18, 2026
Flit. ("Flit", "we", "us", or "our") operates the Flit. mobile application and the website at flitcard.online (together, the "Service") — a platform for creating and sharing digital greeting cards and celebration invitations ("cards"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service, you agree to this policy.
Contact: orra.system.io@gmail.com
Account information. When you sign in with Google, Sign in with Apple, or email and password, we collect your email address, display name, profile photo URL (if provided by the sign-in provider), and an authentication identifier.
Using the app without an account. You can use the mobile app without signing in. When you first open it we create a guest account for you automatically, which gives us an authentication identifier for your install but no email address, name, or profile photo. A guest can create and share public cards using Flit's own photo collection; signing in is required to send a card privately to someone, to add photos from your own device, and to receive cards. If you later sign in, the cards you made as a guest are carried over to that account. See Section 8 for how deletion works for a guest account.
Content you create. When you make a card we store the content you enter, such as the title, message, event details (e.g., date, venue), the chosen template and theme, the visibility setting (private or public), the recipient email address you provide, and — if you add photos from Google Drive — the identifiers of the specific files you pick for each section.
Photos you attach from Google Drive stay in your Drive. Each time a card is viewed, the images are loaded directly from Google Drive using the file identifiers you selected. Drive photos are added on the website; see Section 3 for what picking a photo from Drive does to that file's sharing setting.
Flit's own photo collection. Flit includes a built-in collection of photographs you can use instead of your own. Choosing one stores only a reference to that photograph — Flit never copies or stores the image itself. The images are hosted by Unsplash and are loaded from Unsplash's servers each time the card is viewed, so Unsplash receives the ordinary technical information involved in serving an image, such as the viewer's IP address, browser or device type, and the time of the request. The same is true of Google when a card's Drive photos are loaded, and of Google Firebase when a card's uploaded photos are loaded.
Photos you upload from your device. If you choose to add photos from your phone, Flit stores those photos on Google Firebase Storage so they can be shown on your card. Before a photo is uploaded it is resized, and its EXIF metadata — including any location recorded by your camera — is separately removed. Uploaded photos are reachable by anyone who has the photo's link, in the same way as photos attached from Google Drive. We delete them automatically when the card expires (7 days after you send it, or 30 days for a photo album), when you delete the card, and when you delete your account. Flit does not restore deleted photos, so keep your own originals.
Automated checks on uploaded photos. Photos you upload from your device are automatically checked for prohibited content — sexual imagery and graphic violence — using Google Cloud Vision. This check is automated; no person at Flit reviews your photos. A photo that fails the check is deleted from our storage and removed from your card, and you are told in the app. Repeated failures can result in your account being suspended, which makes the cards you have published unavailable. Photos you pick from Flit's own curated collection are not checked this way, because we select those ourselves.
Device and technical data. We collect your push notification token (Firebase Cloud Messaging), app version, device type and operating system, IP address, and basic log data.
Usage data. We collect limited interaction data such as card view counts and timestamps (e.g., when a card was created or first opened). We also use Google Analytics for Firebase to collect usage statistics — such as screens or pages visited, session and device information, and approximate location derived from your IP address — to understand how the Service is used.
Adding photos from Google Drive is offered on the Flit website; the mobile app no longer offers it, and uses photos from your device or Flit's own photo collection instead. Cards that already use Drive photos — including ones made in earlier versions of the app — continue to display them, and the sharing change described below still applies to those files.
On the website, you sign in with Google and choose photos using Google's own picker. This grants Flit access only to the specific files you select (Google's drive.file permission) — not to your Drive as a whole.
Flit changes the sharing setting on the files you pick. When you choose photos from Google Drive, Flit sets those specific files to "anyone with the link can view" so the people you send the card to can see them. This applies only to the files you pick, never to your Drive generally. Flit does not change this setting back — not when the card expires, and not when you delete the card. You can revoke it yourself at any time in Google Drive (Share → change access). Flit never uploads, copies, or stores your Drive photos — they continue to live only in your Google Drive, and every view of the card loads them directly from there. Anything you pick for a public card may be viewable by anyone who has the card link, and — because of the sharing change above — by anyone who has the file's Drive link, independent of the card.
With your permission, we send push notifications through Firebase Cloud Messaging (for example, when you receive a card). You can turn notifications off at any time in your device settings. In this version of the Service we do not send marketing emails.
We use the following service providers to operate the Service, which process data on our behalf:
We do not sell your personal information. We may disclose information if required by law or to protect the rights, safety, and security of our users and the Service.
Published cards automatically expire 7 days after publishing (30 days for a photo album) and become inaccessible; expired cards are deleted after a short grace period. Uploaded photos are deleted when the card they're on expires, when the card is deleted, and when you delete your account. Account information is retained until you delete your account. You may request deletion of your account and associated data at any time (see Section 8).
You can access, correct, or delete your information, and delete your account, from within the app (Settings → Delete Account) or by emailing us at orra.system.io@gmail.com. Depending on where you live (for example, the EEA/UK under the GDPR, or California under the CCPA/CPRA), you may have additional rights, including the right to access, port, restrict, or object to certain processing. To exercise any right, contact us at the email above; we will respond as required by applicable law.
Guest accounts. A guest account has no email address or name attached, so we have no way to match an emailed deletion request to it. If you have used the app as a guest and want that data removed, sign in first — your guest account becomes a normal account you can then delete in the app, which removes it and its cards. Otherwise a guest's cards expire and are deleted on the ordinary schedule in Section 7, and the guest account holds no personal information beyond the identifier for your install.
The Service is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, please contact us and we will delete it.
We use reasonable administrative, technical, and organizational measures to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Your information may be processed and stored on servers operated by Google/Firebase that are located in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.
We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide notice within the app.
If you have questions or requests regarding this Privacy Policy or your data, contact us at orra.system.io@gmail.com.