Trust
Frequently asked questions
Straight answers about where your secrets live, what FlickFly can and cannot see, and how to use pairing and backups safely.
Can you read my secrets?
What does the server see?
Are flicks encrypted?
Is the browser my vault?
Shared computers
Cloud backup
Forgot PIN / lost phone
QR vs code
Independent audit
- Can FlickFly staff read my passwords?
- No. Your vault stays on your phone in on-device secure storage. When you flick a secret, it is encrypted on the sender before it reaches our signaling service. We do not host a readable cloud copy of your vault, and we cannot unlock it for you.
- What does the server see?
- The signaling API may see operational metadata needed to pair and route: session IDs, short pairing codes, device display names you choose, device identifiers, public keys, WebSocket connection IDs, and wake/push signals. It is not designed to see password text, note bodies, document bytes, or other secret values — those travel as ciphertext. Website hosting may also keep ordinary access logs (IP, User-Agent, time). See the Privacy Policy for detail.
- Are flicks end-to-end encrypted?
- Yes. Paired devices establish their own keys, then each flick is sealed on the sender with modern, widely trusted encryption before it reaches our relay. Transport to the API also uses TLS. End-to-end protection means the relay is not designed to read your secret — only the paired peers can.
- Is the flickfly.app browser page my vault?
- No. The receive page shows only what you choose to flick, then clears the on-screen card (about two minutes unless you clear sooner). Pairing material for that browser is stored locally so the tab can reconnect — it is not a full vault sync. Use Forget this device when you are done on a machine you do not control.
- Your own work laptop is fine — leave it paired like a home computer and flick when you need to. For a shared or public machine, pair only while you need it, then click Forget this device on the site. If you left it paired by mistake, open Paired devices in the FlickFly app and remove that peer — that unpairs it remotely even if you never return to the browser.
- Is optional cloud backup safe?
- Yes. When you back up, FlickFly encrypts your vault on the phone before it leaves the device, then stores the file in your iCloud or Google Drive — FlickFly never keeps a copy and cannot open it. New backups are protected with your recovery code (a long random code you save at setup), and your PIN confirms it is you. Restore uses that same recovery code (older backups may still use PIN). Keep the recovery code somewhere safe offline, and you stay in control end to end.
- What if I forget my PIN or lose my phone?
- Your recovery code resets a forgotten PIN — we cannot do that for you, which is how your vault stays private. If the phone is lost, restore from your encrypted cloud backup with the recovery code (and set a new PIN on the new device). Store the recovery code somewhere safe and separate from the phone so you are covered either way.
- Should I use the QR code or the short pair code?
- Prefer scanning the QR in person when you can — you see both screens. The short code is for convenience when devices are apart; treat it like a brief pairing secret and let it expire if unused.
- Has FlickFly been independently audited?
- Not yet. We document the architecture openly on Security and How it works, and we do not claim “certified secure.” If you believe you found a vulnerability, email help@flickfly.app.