Privacy policy

Last updated: October 25, 2026

This policy explains what Flashline stores, why it stores it, and the choices you have. Flashline is an independent gateway for DeepSeek's web model; it is not operated by DeepSeek.

1. What we collect

• Account data: email address, display name, password hash, role, account status, referral code, and timestamps.
• Authentication data: a hashed session token, CSRF token, IP address, and browser user-agent for active sessions.
• API key metadata: key name, prefix, last four characters, creation time, last-used time, and revocation time. The raw key is shown once and is not stored.
• Usage metadata: model, key name, input and output token counts, estimated cost, request status, latency, and timestamps.
• Billing data: balance, transactions, promo redemptions, top-up requests, referral earnings, and admin adjustments.

We do not store prompt or completion content in the website usage ledger. The gateway may keep a short-lived in-memory debug record of the most recent request for operator diagnostics; prompt content in that record is only included when explicitly enabled by the operator or when the legacy operator key is used.

2. Cookies

Flashline uses one essential cookie, fl_session, to keep you signed in. It is HttpOnly, SameSite=Lax, and expires after 30 days. It is marked Secure when the site is served over HTTPS. We do not use advertising or analytics cookies.

3. How we use data

• Authenticate you and protect your account and API keys.
• Meter requests, calculate charges, and maintain your balance and transaction history.
• Attribute referral bonuses and commissions.
• Review top-up requests and prevent abuse, fraud, and rate-limit evasion.
• Operate, debug, and improve the gateway.

4. Third parties

Requests you make through the API are sent to DeepSeek's upstream service so the model can generate a response. Your prompt and the model's output are processed by that service under its own terms and privacy practices. Flashline does not sell your personal data. The site loads fonts from Google Fonts; those requests may expose your IP address to Google.

5. Retention

Account, key, usage, and transaction records are kept while your account is active and for a reasonable period afterward for accounting, security, and dispute resolution. Sessions expire after 30 days or when you sign out. Backups may persist for a limited time. Usage rows are capped by the platform and older rows may be pruned.

6. Security

Passwords are hashed with scrypt and a per-user salt. Session tokens and API keys are stored as SHA-256 hashes. Dashboard access is protected by an HttpOnly session cookie and a CSRF token. No system is perfectly secure; use a unique password and keep API keys out of client-side code.

7. Your choices

You can update your display name and password in Settings. You can revoke API keys at any time. To request access, correction, or deletion of account data, contact the operator through the channel provided for this deployment. Some records may be retained where required for legal, accounting, or security reasons.

8. Children

Flashline is not directed to children under 13, and you may not use the service if you are under the age required to consent to data processing in your jurisdiction.

9. Changes

We may update this policy. Material changes will be reflected on this page with a new date. Continued use after a change means you accept the updated policy.

10. Contact

For privacy questions, use the Billing page in the dashboard to submit a request with a note, or contact the operator of this Flashline deployment through the channel they provided.