Who we are
Fireloom is an independent product run from the United States by its developer. The person responsible for your data (the “controller”) can be reached at [email protected], and a real person answers.
For your account, billing, support and website use, we're the controller. For the data in the databases you connect, we're your processor; see “Data in your databases” below.
Where your data is
Fireloom's server, its database and its backups are in a data center in Nuremberg, Germany (EU). Some service providers listed below are in the United States.
What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address; Google account ID if you use Sign in with Google | Creating your account, signing you in, service emails (sign-in links, sync failure alerts, billing) | Contract, Art. 6(1)(b) |
| Connection settings: Firestore service account keys, Postgres connection strings, project and host names | Running your syncs. Stored encrypted (AES-256-GCM), never shown again | Contract, Art. 6(1)(b) |
| Sync configuration, status, history, document counts and error messages | Running syncs, the dashboard, alerts and support | Contract, Art. 6(1)(b) |
| Billing: plan, subscription status, Stripe customer and subscription IDs | Subscriptions and invoices. Card details go to Stripe and never reach us | Contract, Art. 6(1)(b); tax law, Art. 6(1)(c) |
| Support messages | Answering you | Contract, Art. 6(1)(b) |
| IP addresses and request details, briefly | Rate limiting, abuse prevention and security; admin actions are kept in an audit log | Legitimate interests (security), Art. 6(1)(f) |
| Website and product usage through Google Analytics | Understanding which pages and steps help people, and where they get stuck | In the EU, EEA, UK and Switzerland: consent, Art. 6(1)(a). Elsewhere: on unless you turn it off |
Cookies and analytics
- Strictly necessary:
fireloom_sessionkeeps you signed in;fireloom_google_flowprotects Sign in with Google for ten minutes. Browser storage remembers your cookie choice and small interface settings. - Analytics: Google Analytics 4 sets
_gaand_ga_*cookies (up to 14 months).- If you visit from the EU, EEA, UK or Switzerland (or we can't tell where you are), we ask first, and the Google Analytics script isn't loaded at all until you accept.
- Elsewhere, analytics is on unless you reject it in Cookie settings. We also treat your browser's Global Privacy Control signal as an opt-out.
We use Google's Consent Mode with advertising storage always denied and Google signals off: we don't run ads, and we don't sell or share your data for advertising. Your country is worked out by our network provider, Cloudflare, from your IP address; we don't store it. You can change your choice any time with Cookie settings at the bottom of every page; rejecting deletes the analytics cookies we can reach.
What analytics measures: page views, and events such as sign-up, sign-in, connecting a database, a first sync going live, starting checkout, starting a subscription, clicks on sign-up buttons and playing the product video. We never send your email address, connection details, document data or account IDs to Google Analytics, and we strip sign-in tokens and other query parameters (except campaign tags such as utm_source) from the page addresses it receives. If analytics is on for you, the anonymous Google Analytics client ID from your browser is attached to a checkout so the subscription can be counted when Stripe confirms it.
Data in your databases
When you connect Firestore and Postgres, Fireloom reads documents from Firestore and writes them to your Postgres. Documents pass through our server in memory and aren't stored by us. For this processing we act on your instructions as your processor under Art. 28 GDPR, under the data processing terms in our terms of service. You remain the controller of that data and are responsible for having a legal basis for it.
Who we share data with
We use these service providers (sub-processors, for your database data) and nobody else. We don't sell personal data.
| Provider | What for | Location |
|---|---|---|
| Server hosting | The server that runs Fireloom and stores its database and backups | Nuremberg, Germany (EU) |
| Cloudflare | Network, TLS, the secure tunnel to our server, and visitor country; all traffic passes through it | Global network; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Stripe | Payments, subscriptions, invoices | Stripe Payments Europe (Ireland) and Stripe, Inc. (US); Data Privacy Framework and Standard Contractual Clauses |
| Resend | Sending email (sign-in links, alerts, support replies) | United States; Standard Contractual Clauses |
| Sign in with Google (if you use it); Google Analytics (as described above) | Google Ireland / Google LLC; Data Privacy Framework and Standard Contractual Clauses |
Your own Firestore and Postgres providers are chosen by you and process data under your agreements with them. Fireloom is operated from the United States, so the operator accesses the server from there to run and support the service.
How long we keep data
- Account, connection, sync and support data: until you delete your account (Account → Delete account), which deletes everything it owns immediately. Backups of our database roll over after 30 days.
- Unused sign-in links expire after 15 minutes; sessions expire on their own or when you sign out.
- Billing records: as long as tax law requires.
- Google Analytics data: 14 months.
- Server logs: kept briefly for troubleshooting and rotated automatically.
Security
Credentials are encrypted at rest with a key kept separately from backups. The service runs unprivileged behind a deny-inbound firewall, reachable only through Cloudflare's tunnel. Sign-in uses one-time links or Google, with no passwords to leak. Admin access is limited to one address, uses one-time links and is audit-logged.
Your rights
Wherever you are, you can ask us for a copy of your data, to correct it, or to delete it, and you can delete your account yourself at any time. Email [email protected]; we answer within one month.
EU, EEA, UK and Switzerland: under the GDPR you also have the rights to data portability, to restrict processing, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. You can complain to the data protection authority where you live.
California and other US states: we don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer anything about you. You can ask to know, correct or delete the personal information we hold, and we won't treat you differently for asking. We honor Global Privacy Control as an opt-out of analytics.
Children
Fireloom is a tool for businesses and developers and isn't directed at children under 16.
Changes
We'll update this page when our practices change and email account holders about material changes before they take effect.