This analysis describes what Fly.io's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause establishes implied consent through conduct — the act of uploading sensitive data itself serves as the legal consent mechanism for US-based storage, without requiring a separate affirmative consent step.
The updated policy now explicitly discloses that Fly.io uses third-party fraud-prevention services that collect device and browser signals (such as device identifiers and browser fingerprints) when you create an account or sign in. The policy states this data collection is mandatory and cannot be opted out of, distinguishing it from analytics collection, which remains optional. The company asserts its legal basis is its legitimate interest in protecting the platform and its users.
View change record →If you store sensitive personal information on Fly.io, you are treated as having consented to that data being stored on servers in the United States.
How other platforms handle this
We will only collect, use and disclose your personal data with your consent, unless otherwise permitted or required by law. Your consent may be given expressly or implied, depending on the circumstances and the sensitivity of the information involved.
You may give us your Identity Data, Contact Data, Financial Data, Profile Data, and other information by filling in forms or by corresponding with us by post, phone, e-mail or otherwise.
telemetry information collected includes: (i) microservice settings, (ii) usage data and (iii) hardware environment.
"If you store any sensitive personal information on our servers, you are consenting to our storage of that information on our servers, which are in the United States.Excerpt from Fly.io's Privacy Policy
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This clause establishes implied consent through conduct — the act of uploading sensitive data itself serves as the legal consent mechanism for US-based storage, without requiring a separate affirmative consent step.
If you store sensitive personal information on Fly.io, you are treated as having consented to that data being stored on servers in the United States.
ConductAtlas has identified this type of provision across 296 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Fly.io.