Flipper Relay Privacy Policy

Effective: 7 November 2026

Flipper Relay is published by Paul Henschel, Switzerland.

Your device and your choices

Flipper Relay connects your iPhone or iPad to your Flipper Zero over Bluetooth. Manual controls, the live screen and local file management work without enabling remote access. There is no advertising, tracking SDK, built-in AI chat, microphone recording or sale of personal data.

When you enable Remote access, the app connects to the managed Cloudflare gateway. An agent you authorize can read the Zero's screen and files and control the device, including running scripts on the Zero. Approve only clients you trust. Sharing the endpoint alone does not authorize access.

Information on your phone

The app saves preferences, relay configuration and the remembered Bluetooth device identifier in its own settings. Device and operator credentials are stored in iOS Keychain, restricted to this device after its first unlock. Keychain items can survive deleting and reinstalling the app. The activity list holds at most 200 entries in memory; it is not uploaded as an analytics feed. Screen frames and device information are held for the active session. Files you import, export or share can produce local temporary copies and copies in destinations you select.

Picture in Picture streams the Zero's actual screen, including instructions printed by device scripts, while you use another app. It does not record the iPhone's other apps. The app does not collect your phone's contacts, photo library, location or microphone data. Information visible on the Zero or in files you choose to expose may itself be sensitive.

Information handled by the managed gateway

Cloudflare processes the connection's network information, including IP addresses, to deliver and protect the service. The gateway uses IP addresses for short-term setup rate limiting. It receives a random installation identifier and credentials needed to authenticate the phone and clients. The public installation route is derived from a random credential; it is not the Zero's serial number.

Commands, device responses, requested screen images and requested file contents pass through the gateway to the authorized client. Transport uses TLS. Cloudflare terminates TLS and the gateway processes the content: this is not end-to-end encryption between the agent and the Zero. The application does not persist command bodies, screen images or file contents in cloud storage. In-flight commands are bounded and fail when the phone disconnects; a failed response does not prove that a device action did not execute.

The gateway stores installation authentication state, OAuth client registrations and grants, and temporary file-download capability metadata. Client records can include a client name, callback URL, scopes and authorization metadata. File capability records contain an SD path, file size, expiration and a random download credential, but no file bytes. Treat download URLs as private: anyone holding an unexpired URL can request that file while your phone is online.

Retention

Authorization records are stored in the installation’s SQLite database at the gateway. Expired records cannot authorize requests; scheduled cleanup removes expired records, normally within 24 hours. Access tokens expire after one hour. OAuth refresh grants expire after 30 days; refreshing does not extend that grant's original lifetime. Dynamic client registration records expire after 90 days of inactivity and can be renewed while used. Browser consent transactions expire after ten minutes; phone approval prompts expire after 90 seconds.

Download links expire after five minutes. The gateway holds at most 128 capability records per installation; expired records are removed by a scheduled cleanup. Installation authentication state remains until deleted by the service operator. Settings → Agent access lets you revoke individual OAuth grants and their download links. The gateway keeps each grant’s approximate last-use timestamp (updated at most once per five minutes) and revocation records for up to 35 days. Revoke all also rotates the shared access token; that token rotation takes effect when the phone reconnects with the new key. Revocation does not cancel an action already executing on the Zero.

Captured files remain on your Zero's microSD card. Link expiration does not delete them. Generated artifacts are deleted only after an agent confirms a saved, checksum-verified copy, or when you explicitly delete them. Files exported to another app remain under that app's control.

Cloudflare may process and retain infrastructure/security records under its service policies. Worker application observability is disabled; we do not run a persistent request-body or screen logging service.

Other services

An external agent service receives the device information and files you authorize it to request. Its privacy policy, retention and model-processing terms apply to that copy. Flipper Relay does not select a model provider or send data to an AI service on its own. If you configure a self-hosted relay, that server's operator controls its processing and retention. Opening an external documentation link sends the request to the relevant provider.

Cloudflare's processing may take place outside your country, including outside Switzerland and the EEA. See Cloudflare's privacy policy for its infrastructure processing and international safeguards.

Control, access and deletion

Turn off Remote access to disconnect the gateway. Use Settings → Agent access to review approved agents, revoke individual permissions, or revoke all agents and shared access tokens. Closing the floating video alone does not revoke those permissions. Disconnecting does not cancel a script already executing on the Zero.

You can delete files through the Files tab or your chosen export destination. Uninstalling the app removes its app-container data; iOS Keychain and copies stored elsewhere may remain. There is currently no in-app deletion control for managed-gateway installation records. Deleting cloud records does not erase your Zero, agent-service history or exported copies.

We use the information necessary to provide the service you request and to protect its security. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and may complain to your local data-protection authority.

Changes

We will update the effective date when this policy changes. Material changes to processing will be reflected in the app and its App Store disclosures.