Privacy

flutterwatch is a small independent project. It keeps the least it can get away with: enough to tie engine downloads to an account and to know which apps ship the engine — and nothing at all about the people who use those apps.

What an account stores

Signing in uses GitHub OAuth, requesting only the user:email scope. That shows us your public GitHub profile and lets us read the email addresses on your GitHub account, and nothing else: it gives no access to your repositories, private or public. We look at those addresses only while you sign in, keep at most one of them, and do not keep the GitHub token. An account stores:

• Your GitHub numeric id and username.
• Your email address: the verified one GitHub shares when you first sign in, or one you enter in your console instead.
• For accounts that were offered them when they joined: the optional profile fields — name, company, position, and what you planned to build. New accounts are not asked for any of these.
• Any message you send through Support in your console, with its topic, and our answers to it. A copy of each message is emailed to the maintainers' own inboxes, so that someone reads it.

API tokens

A token is stored only as a SHA-256 hash. The plaintext is shown once — to the CLI when you sign in, or in your console when you create a key — and is never written to the database. Alongside the hash we keep a short non-secret prefix so you can tell your keys apart in a list, and the time a key was last used. A lost token cannot be recovered, only revoked and replaced.

On your own machine the token lives in ~/.flutter-watchos/credentials.json with file mode 600. flutter-watchos logout revokes it on the service, then deletes it.

Download records

Each engine-artifact request is logged with the engine version and file requested, the time, the account it belonged to — if there was one: the Simulator engine downloads without an account, and such a request is logged without one — and whether it succeeded or was refused. That log tells us which engine versions are actually in use so old ones can be retired without stranding anyone.

Release builds

When you build an app for release while signed in, the command-line tool registers that build with your account. It sends four things, once, from your machine, at build time: the app's bundle id, its version, the engine version, and the build mode. It prints a line when it does. That is what lists the app in your console, and it is how the project knows which apps ship the engine.

No source code, file names, dependency lists, or anything about your machine is sent, and debug, profile and simulator builds are never registered. It is on by default and flutter-watchos build-registry --disable turns it off — an app you would rather not name yet is reason enough. The full list of what is and is not sent.

Email

A new account gets a one-time welcome at its address. After that, accounts get the occasional announcement — a release, or something you need to know. Every announcement has a one-click unsubscribe, and the Account page of your console has the same switch.

The rest is correspondence, not a subscription, so that switch does not stop it: an answer to a message you sent us, and a note a maintainer writes to you personally about your account.

For every email we send, we keep the address, the subject, what kind of email it was, when it went, and whether it was delivered, bounced or reported as spam; we do not track opens or clicks. An address that bounces for good, or reports our mail as spam, goes on a do-not-send list with that reason, and nothing is sent to it again.

Mail you send us

Mail sent to hello@flutterwatch.dev, a reply to one of our emails included, is stored so that it can be answered, whether or not you have an account. We keep the sender's name and addresses (the From address and the envelope sender, which can differ), a separate Reply-To address if there is one, the address it was sent to, the subject, the text, the headers that thread a conversation, and the message's size. Attachments are not kept: only their names, types and sizes are recorded. If the sender's address is the one on an account, the message is linked to that account.

A copy of the text is emailed to the maintainers' own inboxes, so that someone reads it. Our answer goes to the address you wrote from, or to your Reply-To address, and is stored with your message.

What is not collected

• No passwords — sign-in is delegated to GitHub, which never shares your credentials with this service.
• No IP addresses or user agents are recorded in the service database. When flutter-watchos login starts, a keyed hash of the network it comes from (never the address itself) is kept with the sign-in code, to stop floods of sign-in attempts; it is cleared out with the old codes, an hour or so later. Cloudflare, which hosts the service, necessarily processes connection metadata in order to deliver the request at all.
• The command-line tool has no usage analytics. Apart from signing in and out, downloading engines, and the release-build registration described above, it sends nothing — not which commands you run, not how often, not what fails.
• The engine contains no telemetry. Apps you ship never phone home, and nothing whatsoever is collected from the people who use them.

This website

The site is pre-rendered static HTML and CSS. It sets no cookies unless you allow Google Analytics, and it runs three small scripts:

• Cloudflare Web Analytics counts visits on every page. It sets no cookies, stores nothing on your device and does not identify you; Cloudflare reports only totals, such as page views, referring sites, countries and how fast pages load.
• Google Analytics runs only if you allow it in the bar at the bottom of the page; until then nothing is requested from Google. If you allow it, it sets its cookies (_ga and _ga_<id>) and sends Google the pages you view, how you reached them, and your browser, device and approximate location. Advertising features and Google signals are off. Saying no later removes those cookies again.
• The front page asks GitHub's public API (api.github.com) for the number of the latest flutter-watchos release, so your browser connects to GitHub when that page opens.

Your answer to the analytics question is kept in your browser's local storage (fw-analytics-consent), so the bar does not come back on every page. If your browser sends Global Privacy Control, Google Analytics stays off and you are not asked.

Change your analytics choice

Who else sees this data

• Cloudflare — hosting, database, artifact storage, receiving mail sent to hello@flutterwatch.dev, and the anonymous visit statistics for this site (Web Analytics).
• Google — Google Analytics for this site, only if you allow it.
• GitHub — sign-in, and your browser's request for the latest release number when the front page opens.
• Resend — delivers every email the service sends, including the copies of your messages that reach the maintainers.
• The maintainers' own email providers — those copies land in the maintainers' personal mailboxes, where they stay until you ask for them to be deleted.

Nothing is sold, and nothing is shared for advertising.

Your choices

Much of this you can see and change yourself in your console: Usage lists your engine downloads, My apps your registered release builds, and API keys every key on the account, each of which you can revoke there. Account is where you change your email address and turn announcements off; the link in any announcement does the same. flutter-watchos build-registry --disable stops release builds being registered.

For anything else — a copy of what we hold about you, a correction, or deletion — write to hello@flutterwatch.dev from the address in question, or use Support in your console.

Getting your data removed

Ask as above, and we delete the account and what is tied to it: its profile fields, tokens, sign-in codes, download records and registered release builds; your Support messages and the mail you sent to hello@flutterwatch.dev from that address, with our answers and the copies in the maintainers' inboxes; and the log of the email we sent you. You do not need an account to ask: if you only ever wrote to us, ask from the address you wrote from, and your messages and our answers are deleted the same way.

Two things are kept. If your address ever bounced for good or reported our mail as spam, it stays on the do-not-send list with that reason: that entry is what stops us writing to it again. And the record of actions the maintainers took on the account stays, with your address taken out of it. Your username is left on one entry only, the one that records the deletion itself, so that we can show it was done; ask, and it comes off that one too.

Changes

The service is still moving. If what is collected changes, this page changes with it — and anything genuinely new will be called out in the release notes rather than quietly appearing here.

Contact

Write to hello@flutterwatch.dev about anything on this page. You do not need an account to ask.

Last updated 11 October 2026.