Privacy policy

Last updated: November 11, 2026

1. INTRODUCTION

1.1 This Privacy Policy explains what personal data we collect when you use Flipper’s BUSY service – the busy.app website, the BUSY app, the BUSY Cloud, and the BUSY Bar device – and what we do with it.

1.2 “We”, “us”, and “Flipper” mean Flipper Devices, Inc. (USA) and Flipper FZCO (UAE), which are independent controllers for different parts of the BUSY service. The full allocation – which entity controls which processing, with addresses and contact points – is on our Controllers Page (Annex 1).

1.3 What this policy covers: the BUSY hardware and software service, our website, the BUSY mobile and desktop apps, the BUSY Cloud, our customer support, and our recruitment activities.

1.4 What this policy does not cover: third-party services you choose to connect to BUSY (such as a calendar provider, an OAuth identity provider, or your own server connected via supported IoT protocols). Those are governed by the third party’s own privacy policy.

1.5 For US state-specific rights, see Annex 2 — US States Privacy Notice.

2. WHO CONTROLS YOUR DATA

2.1 Flipper Devices, Inc. and Flipper FZCO are independent controllers for distinct parts of the service. Inc. controls sales, payment processing, shipping, and logistics data. FZCO controls the website, the BUSY app, BUSY Cloud, device firmware, and analytics. Marketing emails to users of the BUSY app may also be sent on behalf of FZCO by Inc., which acts as FZCO’s processor. Flipper Devices, Inc. also holds the hosting accounts for our product analytics, including device statistics from BUSY Bar, and processes that data only on FZCO’s instructions. The mapping of processing activities to controlling entities, with addresses and the relevant supervisory authorities, is on our Controllers Page (Annex 1). You can reach any of us at the addresses in Section 12.

3. WHAT WE COLLECT AND WHY

3.1 When You Visit Our Website. When you visit our website, we receive standard information that your browser sends, such as:

• IP address, approximate location derived from it, and language/timezone settings;
• browser type and operating system;
• pages you view, the page that referred you, links you click, and time spent;
• session and error logs needed to keep the site working.

3.2 We use cookies and similar technologies for site operation, security, analytics, and advertising. Strictly-necessary cookies run by default. Analytics, advertising, and other non-essential cookies run only with your consent, which you give and withdraw through our consent banner. Details, vendor names, and cookie lifetimes are in our Cookie Policy.

3.3 We work with online advertising and analytics providers so that advertising you see is more relevant and so that we can measure how our marketing performs. We do this only with your consent. The named providers are listed in our Cookie Policy. Under the California Consumer Privacy Act, some of these activities are considered “sharing” of personal information, and you have the right to opt out – see our US States Privacy Notice.

3.4 When You Create a Flipper Account. To use the BUSY app and the BUSY Cloud, you create an account. We collect:

• email address and password;
• if you sign in with Apple, Google, or Microsoft instead, the identifier the provider returns to us and, depending on your settings with that provider, your name and email;
• if you set up a passkey, the credential we need to verify it;
• optional profile information you choose to add (name, country, profile photo).

3.5 When you create an account in the BUSY app, we tell you that Flipper FZCO will send you emails about the BUSY app, and you can opt out right away. If you do not opt out, we may send you marketing emails about our services that are similar to those you use, for example new BUSY features, subscription offers, and BUSY devices.

3.6 You can opt out at any time, free of charge, by clicking the unsubscribe link included in every marketing email or by emailing privacy@busy.app. Opting out does not affect service announcements relating to your account.

3.7 When You Place an Order. When you buy a BUSY product, Flipper Devices, Inc. – acting on our behalf as seller of record in your region – collects what we need to take and fulfill your order:

• contact details (name, email, phone if you provide it);
• shipping and billing address;
• the items, quantities, prices, and order history;
• payment confirmation and a tokenized reference to your payment method – full card numbers and bank details are handled by our payment processor (Shopify Payments) and are not stored on our systems;
• invoices, receipts, returns, and refunds.

3.8 We share order data with the parties we need to deliver it: payment processor (Shopify Payments), shipping carrier and regional fulfillment partner for your region, and tax authorities when legally required.

3.9 When You Buy a Subscription. When you buy a paid subscription in the BUSY app, Flipper FZCO receives what we need to provide the paid features and manage your subscription:

• your account identifier and app store transaction identifiers;
• the subscription plan, price and currency, and the country of your app store account;
• purchase, trial, renewal, cancellation, billing-issue, and refund events and their dates.

3.10 Subscriptions are purchased through the Apple App Store or Google Play. Apple and Google process your payment and billing information as independent controllers under their own privacy policies; we do not receive your full payment card details.

3.11 When You Connect Your BUSY Bar Device. Your BUSY Bar device pairs with the BUSY app and may connect to the BUSY Cloud (or, where supported, to your own server using standard IoT protocols). This section describes what the device and the app exchange.

3.12 What the device does not collect. BUSY Bar has no microphone and no camera, and it does not capture or transmit any ambient audio, video, or images. It also has no GPS receiver. Some auto-status features (such as the “On call” indicator on macOS) work by detecting locally on your computer that your Mac microphone is active. This detection runs on your device through the BUSY desktop app; no audio is captured, recorded, or transmitted to us, and the device itself does not listen or watch.

3.13 A light sensor is built into the device to adjust LED brightness automatically. Light-sensor readings are used on the device and are not transmitted to us.

3.14 You can adjust LED brightness in the device or app settings. Any related on-device readings are used locally and are not transmitted to us.

3.15 What the device and app exchange with us. When you pair, sync, or update your BUSY Bar, we may receive technical and operational data, such as:

• firmware version and update events;
• device model and a device identifier used to associate the device with your account;
• storage and configuration status (e.g., free space, sync state);
• connectivity events (for example, that a Bluetooth or Wi-Fi pairing occurred), without the contents of your network traffic;
• features you activate on the device and in the app (for example, mode switches, session counts, brightness preferences);
• images, media, or other content you upload through the BUSY app for display on your BUSY Bar device;
• your timezone setting and approximate location (if provided in your account settings), used to localize your session display;
• API access tokens you generate to integrate the BUSY Cloud with third-party tools; these tokens are credential-equivalent and are stored securely;
• crash and diagnostic data if the device or the app fails or behaves unexpectedly.

3.16 We use this data to operate, secure, and improve the product. Diagnostic and analytics processing for the device and app runs on infrastructure we host ourselves, on servers we rent from the hosting providers listed on our Subprocessors page (Annex 3). The providers of the analytics software do not receive this data.

3.17 Device statistics (optional). If you turn on Share device stats, your BUSY Bar also sends us statistics about how it is used and how it is working, such as its serial number, the MAC address of its USB network interface, firmware and hardware details, and timer, app, settings, power, network, and account-link events. Sharing is off by default. The full list, what BUSY Bar never sends, and how long we keep this data are on our Device Data page. We use this data to improve BUSY Bar, fix problems, link defects to hardware and firmware versions, and produce anonymous statistics, such as how many devices are in use in each country and city. We process it on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by turning Share device stats off.

3.18 Self-hosted option (your own server). If you connect your BUSY Bar to your own server using a supported standard IoT protocol, the data exchanged with that server is controlled by you, not by Flipper. Our Privacy Policy does not cover that flow.

3.19 Additional data from the BUSY app. In addition to the device data above, the BUSY app itself produces:

• screens you view in the app, features you activate, and broad usage patterns – through self-hosted analytics;
• crash and performance logs if the app misbehaves – through self-hosted crash reporting;
• push notification token, if you allow notifications;
• if you connect Google Calendar or another supported integration, the tokens and the calendar metadata needed for the integration to work (see the “Calendar and similar integrations” subsection below);
• if you buy a subscription, information about your purchase and subscription status (see the “When You Buy a Subscription” subsection above);
• if you allow it, advertising identifiers and app events used for advertising attribution (see the “Advertising attribution in the BUSY app” subsection below).

3.20 Advertising attribution in the BUSY app. We use mobile attribution and measurement tools in the BUSY app to find out which of our advertising campaigns lead people to install and use the app, to measure the performance of our campaigns, and to show our ads to people who may be interested in the BUSY app. These tools collect:

• your device’s advertising identifier and other device and app identifiers;
• IP address, device model, operating system and its version, language, and app version;
• app events such as installation, first launch, account registration, and subscription purchase;
• information about the advertisement you saw or clicked before installing the app.

3.21 These tools start processing data automatically once you allow the BUSY app to track your activity in line with the advertising settings of your device. You can withdraw your permission at any time as described below, without affecting processing carried out before the withdrawal. Where applicable law requires consent, this processing is based on that permission (Art. 6(1)(a) consent).

3.22 The providers of these tools and their roles are listed on our Controllers Page (Annex 1) and our Subprocessors page (Annex 3). Under the California Consumer Privacy Act, this processing may be considered “sharing” of personal information, and you have the right to opt out – see our US States Privacy Notice (Annex 2).

3.23 How to opt out. You can stop or limit this processing at any time:

• on iOS, in Settings > Privacy & Security > Tracking, by turning off tracking for the BUSY app or the “Allow Apps to Request to Track” option;
• on Android, in your device settings (Settings > Privacy > Ads, or Settings > Google > Ads, depending on your device), by deleting or resetting your advertising ID;
• through industry opt-out tools such as the Digital Advertising Alliance AppChoices app (youradchoices.com/appchoices), the Network Advertising Initiative (optout.networkadvertising.org), and the European Interactive Digital Advertising Alliance (youronlinechoices.eu);
• through the privacy tools of the advertising platforms, such as the AppsFlyer opt-out page and Meta’s ad preferences;
• by emailing privacy@busy.app.

3.24 We do not read the content of your communications inside the app for marketing or AI-training purposes. See the “AUTOMATED SYSTEMS, AI, AND DECISIONS ABOUT YOU” section below.

3.25 When You Contact Support. When you write to us by email, fill in a form, or otherwise reach out:

• we receive the content of your message, any attachments you send, and your contact details;
• we keep a history of your support tickets and our replies so that we can resolve your issue and improve service quality.

3.26 Support data is processed by Flipper FZCO and, where the issue relates to an order, by Flipper Devices, Inc. on our behalf, using the customer-support tooling listed on our Subprocessors page (Annex 3).

3.27 Recruitment. Flipper FZCO handles recruitment for our group. If you apply, we collect what you send us – CV, cover letter, contact details, references – and process it to assess your application (Art. 6(1)(b) – pre-contractual steps). With your consent, we may keep your profile for future opportunities. We do not share your application outside the Flipper group except where you ask us to (for example, a reference you provided).

3.28 What We Receive from Third Parties. In a few situations we receive personal data about you from other sources:

• Sign-in providers. If you create your account using Apple, Google, or Microsoft sign-in, we receive an identifier and, depending on your settings, your name and email from that provider (see Section 3.4).
• Calendar and similar integrations. If you connect Google Calendar, the BUSY app receives the calendar metadata required to display your status correctly (such as event times, titles, attendee count). We do not use this data for advertising, and we do not use it to train AI models – see the “AUTOMATED SYSTEMS, AI, AND DECISIONS ABOUT YOU” section below. We do not retain it longer than needed to operate the integration.
• If you buy a subscription, we receive information about your purchase and subscription status from Apple or Google through RevenueCat.
• If you allow it, AppsFlyer and Meta provide us with information about the advertising campaign that led you to install the BUSY app.

3.29 Where we receive personal data from third parties, we use it for the same purposes for which we collect it directly and on the same legal bases.

4. LEGAL BASES (GDPR / UK GDPR)

4.1 Where we rely on legitimate interests. We have weighed our legitimate interests against your rights and concluded that the processing is necessary and proportionate. Our reasons:

4.2 Website and service operation. We need to serve you pages, process your requests, and maintain site and service functionality. This processing is inherent to the service and limited to operational data.

4.3 Security, fraud, and abuse prevention. We need to keep your account, our service, and our payment flow safe. Without this processing, the service is unsafe to operate. Data is limited to what is needed; we do not profile users for purposes beyond protection.

4.4 Diagnostics and improvement. We need to know when the device or the app fails, and how customers use BUSY, to fix problems and decide what to build next. Diagnostic and analytics processing runs on infrastructure we host ourselves.

4.5 Quality assurance for support. We use our own support interactions to coach our team and improve responses, not to evaluate individual users.

4.6 You can object to processing based on legitimate interests at any time (see Section 8 Your Rights). When we receive an objection we re-assess whether our interest overrides yours; if it does not, we stop.

4.7 Whether you must provide your data. Providing your personal data is not a statutory obligation. However, certain data – such as your email address, shipping address, or payment details – is necessary for us to create your account, process your order, or operate the service. If you choose not to provide it, we may not be able to provide the relevant part of the BUSY service to you.

4.8 Where we rely on consent. You can withdraw consent at any time, without affecting processing already carried out on that basis. We will not penalize you for withdrawing consent or opting out of analytics, advertising, or marketing emails.

5. HOW WE SHARE DATA

5.1 Within the Flipper group. Flipper Devices, Inc. and Flipper FZCO share data with each other where necessary to deliver the service. Each controller is independently responsible for what it processes; an Intra-Group Cooperation Agreement covers data sharing and Standard Contractual Clauses for cross-border flows (supplemented by the UK International Data Transfer Addendum where applicable).

5.2 Service providers. We use third-party service providers (“processors” and, in some cases, recipients) to operate the service, including:

• payment processing (Shopify Payments);
• in-app subscription management (RevenueCat);
• order fulfillment, shipping, and returns logistics;
• cloud hosting;
• crash and analytics infrastructure that we host ourselves;
• mobile advertising attribution and measurement in the BUSY app (AppsFlyer);
• communications and email delivery;
• consent management;
• security, anti-fraud, and abuse detection;
• customer-support tooling.

5.3 The current list of named service providers – together with their roles, locations, and the categories of personal data they process – is published on our Subprocessors page (Annex 3).

5.4 Advertising and analytics partners. We work with advertising and analytics partners to deliver and measure marketing on our website and in the BUSY app. The named partners are listed in our Cookie Policy, on our Controllers Page (Annex 1), and on our Subprocessors page (Annex 3). For CCPA opt-out rights, see our US States Privacy Notice (Annex 2).

5.5 App stores. When you buy a subscription in the BUSY app, we exchange purchase and subscription information with Apple or Google, which act as independent controllers for billing and payment processing.

5.6 Third parties at your direction. If you log in with a social identity provider, connect a calendar, or use a third-party integration, we exchange data with that provider as needed to operate the integration you asked for.

5.7 Legal, protective, and corporate-transaction disclosures. We may disclose personal data when we are legally required to do so – for example, in response to a lawful request from a public authority, to comply with a court order, or to protect the rights, property, or safety of users, Flipper, or others. We may also disclose personal data in connection with a merger, acquisition, financing, restructuring, or asset sale, subject to confidentiality and to the protections of this policy.

6. INTERNATIONAL TRANSFERS

6.1 Flipper FZCO is based in the United Arab Emirates; Flipper Devices, Inc. operates from the United States. Our service providers are based in several countries. Your personal data may therefore be transferred to, and processed in, countries outside your own.

6.2 For transfers out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum where applicable.

7. HOW LONG WE KEEP YOUR DATA

7.1 We keep personal data for as long as we need it for the purposes set out in this policy, and then we delete or anonymize it. How long that takes depends on the category of data and on the legal, contractual, and operational reasons we have to keep it.

7.2 For the most common categories:

7.3 Where we keep data for longer than the periods above – for example, to defend a legal claim, to comply with a regulator’s order, or because anonymized data no longer identifies you – we limit further use to that purpose only.

7.4 When you ask us to delete your data, we delete it from our active systems on the timelines required by law (typically within one month under the GDPR / UK GDPR, 45 days under the CCPA, extendable where permitted). Residual copies in backups age out on the cycle above and are not used during that window except for system restoration.

8. YOUR RIGHTS

8.1 Depending on where you live, you have rights over your personal data. We honor these rights for all our users globally where it is technically and legally practical, and in addition to the specific rights granted by the laws of your jurisdiction.

8.2 You generally have the right to:

• access the personal data we hold about you and obtain a copy;
• correct data that is inaccurate or incomplete;
• delete data we no longer need to keep;
• port data you provided to us, in a structured machine-readable format;
• object to processing based on our legitimate interests;
• restrict processing in specified situations;
• withdraw consent at any time, for processing that depends on consent;
• opt out of marketing emails at any time, using the unsubscribe link in any marketing email;
• lodge a complaint with your supervisory authority (see Annex 1 for the relevant authorities) and to seek a judicial remedy.

8.3 We respond to rights requests within the time required by your jurisdiction – typically within one month under the GDPR / UK GDPR and 45 days under US state laws, with extensions where permitted. We do not charge a fee unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act and tell you why.

8.4 How to exercise your rights:

• by email to privacy@busy.app.

8.5 You can delete your account in the BUSY app settings or by emailing us. Data export is currently handled on request – please email us and we will process your request within the timelines above.

8.6 Additional jurisdiction-specific instructions for US residents are in our US States Privacy Notice (Annex 2).

9. CHILDREN

9.1 The BUSY service is intended for general audiences and is not directed at children. We do not knowingly collect personal information from children under the minimum age set by applicable law in your region – generally 16 in the EEA / UK (subject to local variations under Art. 8 GDPR) and 13 in the United States under COPPA. We do not actively verify age.

9.2 If we learn that a user is below the applicable minimum age, we will delete their personal data without undue delay. If you believe a child has provided us with personal information, please contact privacy@busy.app.

10. HOW WE PROTECT YOUR DATA

10.1 We take appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. We use industry-standard encryption for personal data in transit (TLS). Some data at rest may not be encrypted; where that is the case, we apply other technical and organizational measures appropriate to the risk (including access controls, logging, and network segregation). Internal access to production data is limited to a small number of authorized personnel.

10.2 No security measure is perfect. If we become aware of a personal-data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and we will notify the relevant authorities on the timelines set by applicable law.

11. CHANGES TO THIS POLICY

11.1 We update this policy from time to time to reflect changes to the service, to our practices, or to the law.

11.2 Material changes will be notified to you before they take effect, by email or in-app notice.

11.3 Minor or clarifying changes are reflected in the “Last updated” date at the top of this policy.

12. CONTACT US

12.1 Privacy contact

12.2 Email: privacy@busy.app

12.3 US-state privacy requests – see our US States Privacy Notice (Annex 2).

12.4 Entity addresses – see the Controllers Page (Annex 1).

EU representative (Art. 27 GDPR): Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria

UK representative (Art. 27 UK GDPR): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom

12.5 You can also lodge a complaint with the data protection authority of your country. The European Data Protection Board publishes a directory of national authorities at edpb.europa.eu/about-edpb/about-edpb/members_en; UK users can contact the Information Commissioner’s Office at ico.org.uk.

13. AUTOMATED SYSTEMS, AI, AND DECISIONS ABOUT YOU

13.1 Automated decision-making with legal or similarly significant effects. We do not make decisions about you based solely on automated processing – including profiling – that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR / UK GDPR.

13.2 We use automated tools to operate the service – analytics, crash diagnostics, security and fraud-prevention checks, support routing, and spam filtering. These are operational tools, not decisions about you.

13.3 AI and machine-learning models. We do not use the content of your communications with us, your data in the BUSY app, or telemetry from your BUSY Bar to train generalized AI or machine-learning models, whether our own or those of any third party.