Scratch For Fluxer
Log in with Fluxer

Privacy

Scratch For Fluxer is a learning tool. It keeps what it needs to log you in, remember your bots and run them, and nothing else. This page lists all of it.

When you log in

  • Fluxer tells us your user ID, username, display name and avatar. We save them so we can show who is logged in and keep your bots under your account.
  • We don't ask for your email address, your servers or your messages.
  • Fluxer's access token is used once, to read that profile, and is revoked straight away. We never store it.

About your bots

  • For each bot we keep its name, its Fluxer application name, its username and its avatar, so we can show it in your list.
  • The bot token is stored encrypted. The last four characters are kept as they are, so you can tell tokens apart. Your browser is never sent the token back; it is decrypted only on the server, when your bot runs or when you replace the token.
  • When your bot runs, the token is sent over HTTPS to the server that runs bots. That server keeps it in memory, never on disk, and lets go of it when the bot stops.
  • We keep the blocks you build and the files you upload (images, JSON and so on).
  • The console shows what your bot writes while it runs. The server that runs bots holds that output in memory, for the latest run of each bot only, and drops it about an hour after the bot stops (or sooner, if you start the bot again or that server restarts). It is never saved to the database.

Cookies

  • sff_session keeps you logged in for up to 14 days. JavaScript can't read it. Logging out removes it and signs you out on every device, so a copied cookie stops working too.
  • sff_oauth exists for a few minutes while you log in. It protects the login from being forged.
  • No analytics, advertising or tracking cookies, and no analytics scripts.
  • To limit abuse, the server briefly remembers how often each address has made requests. That is held in memory and is not saved to the database.

Who else is involved

  • Fluxer. It handles the login, we check bot tokens with it, and a running bot talks to Fluxer like any other bot. Avatars are loaded straight from Fluxer's servers into your browser.
  • Hosting. The site runs on a cloud platform and keeps its data in a hosted database. Bots run on a separate server. Fonts and icons come from this site, not from a font or icon CDN.

Deleting your data

  • On My bots, Delete my data stops your running bots and removes your account, every bot, saved token, block layout and uploaded file from this site, at once and for good. You can also remove one bot at a time.
  • Copies in the hosting provider's routine backups expire on its own schedule.
  • This doesn't change anything on Fluxer. Your Fluxer account and your bot stay as they are; manage those in Fluxer.

Questions

Questions about the site or your data can also go to the community server on Fluxer. Nothing from this site is sent there; it is a normal Fluxer server, with Fluxer's own rules.