FlylingFlyling Privacy Policy
Version 2026-09-30 · Effective 2026-09-30
Flyling ("the app") is a game in which you raise a virtual fruit fly whose brain is a simplified model of a real one. It is operated by Epsilondelta Inc. ("we", "us"). This policy explains what we collect, why, where it goes, how long we keep it and what you can do about it.
Korean version: 한국어. If the two differ, the version in the language you use the app in applies.
1. Summary
- You can play without giving us your name or email. The app makes an anonymous account the first time you name your fly.
- Your fly and its training history are copied to our server so they come back on a new phone. Camera images, recordings and microphone sound never leave your device.
- Linking Apple or Google is optional. It only lets you sign in again on another phone.
- Research use of your training records is optional, uses pseudonyms, and can be turned off at any time.
- You can download all your data, or delete your account and data, from Settings.
2. What we collect
| Data | What it is | When | Required |
|---|---|---|---|
| Account ID | A random identifier made by our backend (Supabase) | When you name your fly (screen "Meet & name") | Yes, for saving your fly on our server |
| Sign-in identity | If you link Google: your Google account identifier and the basic profile Google includes in the sign-in token (email address, name, profile picture). If you link Apple: your Apple user identifier (we ask Apple for no name or email) | Only if you link an account in Settings, or log in on a new phone | No |
| Profile | App language | When your account is made, and on each sync | Yes |
| Consent records | Which items you agreed to (including that you are at or above the minimum age for your country), the policy version, yes/no, and the time. Your country is used on your phone to look up that age and is not sent | Each time you agree or change a choice | Yes |
| Your fly | The fly's save file (its name, its brain's learned changes, needs, preferences), its birth time and save counter | When you name it, then on each sync | Yes |
| Training records | Each training round and scent test: time, scent, timing, the result, how much was learned | When you train or test | Yes, for your Growth history |
| Device record | A random install ID made by the app, platform (iOS/Android), app version, last sync time | Each sync | Yes |
| Technical logs | IP address, device and operating system details, and the time of each request to our server, kept by our hosting provider for security and operations | Each request to our server | Yes |
| Usage analytics | App events such as "first lesson finished" or "scent test done", with coarse values (day number, language, which tool, whether you agreed to research use); never your fly's name or your identity | Only after you accept the required items, once analytics is turned on; see section 5 | Yes |
We do not collect: precise location, contacts, photos you did not share, advertising identifiers (IDFA/AAID), payment data. Push notification tokens are not collected; care reminders are scheduled on your device.
On your device only (never sent to us): camera images in AR mode, recorded clips (until you save or share them yourself), microphone sound (off by default; only in clips you record), your badge record and app settings.
3. Why we use it
| Purpose | Data |
|---|---|
| Keep your fly and bring it back on a new phone or after reinstalling | Account ID, sign-in identity, your fly, training records, device record |
| Show your Growth history and badges | Training records, scent tests |
| Respect minimum ages and record your consents | Consent records |
| Understand which parts of the app work, to improve it | Usage analytics |
| Research on learning in fruit-fly brains (only if you agree) | Training records and scent tests, pseudonymized (section 6) |
| Answer your requests and keep the service secure | Account ID, consent records, technical logs |
We do not sell your data, use it for advertising, or build advertising profiles.
4. Google and Apple sign-in
If you link Google, the app asks Google only for a sign-in token with the basic openid, email and profile information. We use it only to recognise your account when you sign in again. We do not read your Gmail, contacts, files or any other Google data, and we do not use Google user data for advertising or to train AI models.
Flyling's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Unlinking: deleting your account removes the link and the identity data. You can also remove Flyling's access in your Google Account settings (Security → Third-party apps).
If you link Apple, we receive only Apple's identifier for you in this app. Apple lets you hide your email; we do not ask for it.
5. Analytics
We will use Google Analytics for Firebase to count app events (section 2); it is not yet turned on in the current version of the app. Once on, it starts only after you accept the required items. It uses an app-instance identifier made by Firebase, not your account ID, name or email, and not your fly's name. We do not use advertising identifiers, so the app does not ask iOS for tracking permission. Firebase keeps this event data for 14 months, so we can see whether people come back to Flyling and use it again over that time; Google Signals and ads personalization are off.
6. Research use (optional)
If you agree to "Use my training data anonymously for research" (you can change this in Settings → Manage consent):
- Once a week we export the training records and scent tests of users whose latest answer is yes to the current version of this item.
- Each user's ID is replaced with a pseudonym: a keyed hash (HMAC-SHA256) whose key is kept separately from the data. The export contains no account ID, name, email, device ID, fly name or fly file.
- The export is used only by Epsilondelta's Flyling team, and not given to anyone else, for research on learning and memory in fly brain models, and for scientific publications of aggregate results.
- If you turn it off, or delete your account, you are left out of every export after that.
- Each export is kept in our private storage for 90 days and then deleted, so your records leave the exports we hold within 90 days after you turn it off or delete your account. On request (contact@epsilondelta.ai) we remove them sooner, within 30 days; to find them we need your account ID, which is in your "Download my data" file, so ask before you delete your account or keep that file. Results already published in aggregate cannot be withdrawn.
- If this item's version changes, earlier yeses count as off until you agree again.
7. Who processes your data and where
| Recipient | Role | Data | Location |
|---|---|---|---|
| Supabase Inc. | Hosting of our database, file storage, sign-in and server functions (processor) | Everything in section 2 except usage analytics, including technical logs | United States (AWS us-west-1, N. California) |
| Google LLC | Google sign-in (if you use it); Google Analytics for Firebase | Sign-in token; usage analytics | United States and other Google locations |
| Apple Inc. | Sign in with Apple (if you use it) | Sign-in token | United States |
Data is sent over encrypted connections (TLS). Transfers outside your country rely on standard contractual clauses (such as those approved by the European Commission) and on the consent you give on the first screen. Korean users: see the overseas transfer table in the Korean version.
We disclose data to authorities only when the law requires it.
8. How long we keep it
- Your account, fly, training records, consents, device records and any data export file: until you delete your account. Deleting is immediate on our database and file storage. Copies in our hosting provider's backups are gone within 7 days.
- A "Download my data" file is deleted when you make a new one or delete your account; its download link expires after 24 hours.
- Technical logs: up to 7 days.
- Usage analytics: 14 months (section 5).
- Pseudonymized research exports: see section 6.
- Accounts that are not used: kept until you delete them; we do not delete unused accounts on our own.
9. Your choices and rights
In the app: - Download my data (Settings): a file with your fly, your account details and your records (profile, consents, devices, training records, scent tests). The identity data from Google or Apple sign-in is not in this file; ask us at the address below for a copy. - Delete account and data (Settings): removes your fly, records, account, sign-in identity and files from our server and your device. It cannot be undone. Pseudonymized research exports made before, if you had agreed to research use, are handled as in section 6. - Manage consent (Settings): turn research use and care reminders on or off.
You also have the right to ask for access, correction, deletion, restriction, objection and portability, and to withdraw consent, under the laws that apply to you (for example GDPR, UK GDPR, the Korean Personal Information Protection Act, the CCPA). Contact us at contact@epsilondelta.ai. You may complain to your data protection authority.
10. Children
Flyling is for people at or above the minimum age for consent in their country (for example 13 in the United States, 14 in Korea, 13–16 in the EU and UK). The app asks for this during setup and does not continue for younger users. If you believe a child below that age has given us data, contact us and we will delete it.
11. Security
Each account can read and write only its own rows and files (row level security). Server functions that need wider access run only on our backend. Data is encrypted in transit and at rest by our hosting provider. No method is perfectly secure, but we limit what we collect to keep risk low.
12. Changes
When we change this policy in a way that matters, we give it a new version. The app asks you to accept the new version before you continue (required items), or turns optional items off until you agree again.
13. Contact
Epsilondelta Inc., Suite 401, Girin Building, 6 Yeoksam-ro 73-gil, Gangnam-gu, Seoul, Republic of Korea Privacy contact: contact@epsilondelta.ai Data protection officer / 개인정보 보호책임자: Geoff Yoon, CEO, geoff.yoon@epsilondelta.ai