Governance document

CA-D-000688

Fly.io Privacy Policy

Fly.io

Last change detected August 7, 2026 Privacy policy

SHA-256: bae6d90946ef6a187b4… 3 versions captured 2 changes documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Fly.io ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

53 Total

16 High severity

28 Medium severity

9 Low severity

Key Facts

What governs over the terms of the Privacy Statement in any conflict between the two?

Fly.io's Data Privacy Framework (DPF) Principles govern over the terms of the Privacy Statement in any conflict between the two.

Do Fly.io's Data Privacy Framework Principles govern over the terms of the Privacy Statement?

Fly.io's Data Privacy Framework (DPF) Principles govern over the terms of the Privacy Statement in any conflict between the two.

May Fly.io share User Personal Information in the event of a merger or sale?

Fly.io may share User Personal Information in the event of a merger, sale, or acquisition, under terms that preserve the confidentiality of that information.

May Fly.io disclose personally-identifying information to law enforcement in response to a valid subpoena or court order?

Fly.io may disclose personally-identifying information or other collected information about users to law enforcement in response to a valid subpoena, court order, warrant, or similar government order.

Does Fly.io automatically delete inactive accounts?

Fly.io retains user account information indefinitely unless the user chooses to delete their account, because Fly.io does not automatically delete inactive accounts.

How will Fly.io notify users of material changes to its Privacy Statement?

Fly.io will notify users of material changes to its Privacy Statement at least 30 days before those changes take effect, by posting a notice on its home page or sending email.

When will Fly.io notify users of material changes to its Privacy Statement?

Fly.io will notify users of material changes to its Privacy Statement at least 30 days before those changes take effect, by posting a notice on its home page or sending email.

Will Fly.io notify users of material changes to its Privacy Statement at least 30 days before those changes take effect?

Fly.io will notify users of material changes to its Privacy Statement at least 30 days before those changes take effect, by posting a notice on its home page or sending email.

Can children under the age of 13 hold an account on fly.io?

Fly.io prohibits children under the age of 13 from holding an account on fly.io and does not knowingly collect information from or direct content specifically to children under 13.

Does Fly.io knowingly collect information from children under 13?

Fly.io prohibits children under the age of 13 from holding an account on fly.io and does not knowingly collect information from or direct content specifically to children under 13.

Stay ahead of the changes

Track Fly.io and get the diff the day its terms change.

Monitor Fly.io + up to 20 platforms — $4.99/mo →

Summary

Fly.io's Privacy Policy explains what information it collects about you, how it uses it, and who it can share it with. Fly.io will not sell or trade your personal information to third parties for their commercial purposes, but it can share it during a merger or acquisition, or hand it over to law enforcement under a valid legal order. Your account information is kept indefinitely unless you actively delete your account, and Fly.io must give you at least 30 days' notice before making significant changes to this policy.

Analysis

This Privacy Statement establishes Fly.io's obligations and limitations regarding the collection, use, retention, and sharing of User Personal Information. Fly.io limits data use to stated purposes and requires user permission before expanding those uses; it does not sell, rent, or trade User Personal Information to third parties for commercial purposes. Account information is retained indefinitely absent user-initiated deletion, and data stored on Fly.io's servers is held on US-based infrastructure, with the act of uploading sensitive data constituting implied consent to that arrangement. In any conflict between the Privacy Statement and Fly.io's Data Privacy Framework Principles, the DPF Principles govern. Users are afforded self-service access, correction, and deletion rights, and are entitled to at least 30 days' advance notice of material policy changes.

What this means for you

As a Fly.io user, your personal information is used only for purposes stated in the Privacy Policy, and Fly.io must obtain your permission before using it for anything else. Your account data is retained forever unless you take action: you can delete your account using the simple deletion methods Fly.io provides, which is the direct way to stop ongoing retention. Storing sensitive personal information on Fly.io's servers constitutes your consent to that data being held on servers in the United States. Law enforcement can obtain your data through a valid subpoena, court order, or warrant without your prior notice or consent, and Fly.io cannot guarantee absolute security of your data.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor Fly.io + up to 20 platforms — $4.99/mo → Get the research letter, free

2 important changes detected

3 versions captured · Last updated: August 2026

August 7, 2026

medium

What changed Fly.io revised its privacy policy to clarify third-party data collection on its platform. Previously, the policy stated that third-party tracking was not permitted except for described analytics, which users could opt out of. The updated policy now discloses a second category of third-party data collection: fraud and abuse prevention services that collect device and browser signals to detect automated abuse. This fraud prevention processing is mandatory and cannot be opted out of, and Fly.io states its legal basis is its legitimate interest in protecting the platform.

Why this matters The updated policy now explicitly discloses that Fly.io uses third-party fraud-prevention services that collect device and browser signals (such as device identifiers and browser fingerprints) when you create an account or sign in. The policy states this data collection is mandatory and cannot be opted out of, distinguishing it from analytics collection, which remains optional. The company asserts its legal basis is its legitimate interest in protecting the platform and its users.

View full change record →

July 21, 2026

low

What changed Fly.io's privacy policy, effective July 20, 2026, now explicitly discloses the use of two analytics services: Google Analytics and PostHog. The policy previously described only Google Analytics tracking. The updated policy clarifies that PostHog operates on public, logged-out pages only (marketing, blog, and documentation), stores data in the EU, does not enable session recording or capture keystrokes, and deletes analytics events after 12 months. For EU, UK, and Switzerland users, both services require explicit cookie consent with withdrawal options.

Why this matters The updated policy discloses that Fly.io uses PostHog in addition to Google Analytics on public, logged-out pages (marketing pages, blog, and documentation). PostHog stores a random identifier and pageview data in first-party cookies, with data retained for no more than 12 months. The policy states that PostHog does not track authenticated activity or link identifiers to account information. For users in the EEA, UK, or Switzerland, PostHog remains off unless you accept the cookie banner, and you can withdraw consent anytime using the 'Cookie preferences' link in the page footer.

View full change record →

Featured, High severity

Data sharing in merger or acquisition Compare →

A change of corporate ownership is a legally recognised trigger for data transfer to a new entity; the confidentiality preservation requirement is the only stated constraint on that transfer.

Added July 10, 2026 Standard Seen across 288 platforms
Disclosure to law enforcement under legal compulsion Compare →

This clause establishes a direct pathway by which government authorities can obtain user data from Fly.io through legal compulsion, without user consent or notice.

Added July 10, 2026 Standard Seen across 273 platforms
DPF Principles govern over Privacy Statement conflicts Compare →

This hierarchy clause means that the Privacy Statement's terms are subordinate to the DPF Principles, so the operative data-protection rules in a conflict scenario are those of the DPF framework rather than the Privacy Statement.

Added July 10, 2026 Standard Seen across 267 platforms
Indefinite retention of inactive accounts without deletion request Compare →

Absent any user-initiated deletion request, account information is retained without any time limit, meaning data persists through extended periods of inactivity.

Added July 10, 2026 Standard Seen across 275 platforms
Material Privacy Statement changes notified 30 days prior Compare →

The 30-day advance notice requirement for material changes gives users a defined window to review and respond to significant policy shifts before they become operative.

Added July 10, 2026 Standard Seen across 289 platforms
No accounts for children under 13 Compare →

The prohibition establishes a hard age threshold for account eligibility and places an affirmative restriction on Fly.io's data collection and content direction practices toward that age group.

Added July 10, 2026 Standard Seen across 265 platforms
No guarantee of absolute data security Compare →

This clause is a direct disclaimer of any absolute security guarantee, meaning users bear the residual risk of data exposure that security measures cannot eliminate.

Added July 10, 2026 Standard Seen across 287 platforms
No sale of User Personal Information to third parties Compare →

This is an explicit prohibition on commercial monetisation of user data through third-party transactions, covering a broad range of transfer mechanisms.

Added July 10, 2026 Standard Seen across 288 platforms
User consent implied by storing sensitive data Compare →

This clause establishes implied consent through conduct — the act of uploading sensitive data itself serves as the legal consent mechanism for US-based storage, without requiring a separate affirmative consent step.

Added July 10, 2026 Standard Seen across 296 platforms
User Personal Information use limited to stated purposes Compare →

This clause creates a defined boundary on Fly.io's data use and imposes an affirmative permission requirement before any use outside that boundary, limiting scope creep in data processing.

Added July 10, 2026 Standard Seen across 279 platforms
User responsible for application content compliance Compare →

This clause assigns compliance responsibility to the user rather than to Fly.io for application content, meaning users bear the risk of Terms of Service violations arising from their application data.

Added July 10, 2026 Standard Seen across 282 platforms
User right to access, correct, or delete data Compare →

This clause affirms that users have a practical, self-service pathway to exercise access, correction, and deletion rights over their data held by Fly.io.

Added July 10, 2026 Standard Seen across 290 platforms