Privacy Policy
Last updated: April 2026
About this site
flexwarp.com hosts a small set of personal apps under subdomains (e.g. music.flexwarp.com, memes.flexwarp.com). The site is operated by Eishem Naik as a personal project; access is limited to a small allowlist of users.
Identity & sign-in
Sign-in is via Google OAuth. We receive your name, email address, and Google profile picture (only what the Google "openid email profile" scopes provide). We do not request any further Google scopes.
- Your email is used to check against our access allowlist.
- Name and profile picture are displayed in the app UI while you're signed in.
- Sessions are issued as signed JWT cookies scoped to
.flexwarp.com; no third-party session store is used.
Data each app stores
music.flexwarp.com (wrap_spotify):
- Your Spotify display name, email, and Spotify user ID, once you connect Spotify.
- Recently played tracks polled from Spotify (every hour at most), stored to compute play counts and listening statistics.
- Liked songs and followed artists, cached locally to speed up page loads.
- Your Spotify refresh token, encrypted with AES-256-GCM, stored on our server. It is never exposed in logs, client code, or transmitted to third parties.
memes.flexwarp.com:
- Search queries and any custom templates / composed memes you upload (planned). Currently no user-generated content is stored.
- Search proxies talk to Giphy and Klipy server-side; their API keys never leave our server.
How data is stored
All data is stored on a DigitalOcean droplet running Ubuntu, with encrypted-at-rest storage. The database (PostgreSQL) runs inside a Docker container bound to localhost only. Backups are not currently sent off-site. No data is shared with analytics services or advertising networks.
Third-party services
- Google — for OAuth sign-in. Subject to Google's Privacy Policy.
- Spotify Web API — used by wrap_spotify to fetch listening data and control playback. Subject to Spotify's Privacy Policy.
- Giphy & Klipy — used by memes for GIF search. Searches are proxied through our server; no personal information is forwarded.
- Cloudflare — DNS and TLS termination. Subject to Cloudflare's Privacy Policy.
- DigitalOcean — server hosting. Subject to DigitalOcean's Privacy Policy.
Your rights
You can revoke this site's access from your Google account permissions or your Spotify account apps at any time. You may also request deletion of all stored data by contacting the site owner.
Contact
For questions about data handling, contact the site owner via flexwarp.com.