Updated 21 October 2026
Operator and contact
UECFlow is operated by an individual based in the Czech Republic. For privacy requests, contact Rasoul.Safaeian@gmail.com. Operator identification details are being completed; this notice is not a certification of regulatory compliance.
Data processed on your device
After you confirm the start notice and grant browser folder permission, UECFlow reads selected Star Citizen game files locally to derive account activity. Account names, transaction amounts and times, corrections, manual entries, settings and a folder handle are saved in browser storage (IndexedDB and localStorage). The application does not upload these game files or transaction records to its server. No RSI password or visitor account is required.
Local data remains until you clear it or your browser removes it. Removing an account from the list retains its underlying records and corrections; it is not a complete erasure. Use your browser's site-data controls for complete local removal. Backups contain private activity and preferences, exclude folder permission, and remain under your control. A different domain or browser has separate storage.
Feedback, email and optional screenshots
Sending feedback transmits your category, message, optional email, submission time and a random anti-spam identifier. You may attach up to three PNG, JPEG or WebP screenshots, 5 MiB each. Images are stored privately with feedback and are accessible through owner-authorized tools. Review screenshots for private content and metadata before sending. Nothing is attached automatically.
Text drafts are saved locally until successful submission or browser-data removal; selected images stay only in page memory until sent. Feedback is stored in Cloudflare D1 and screenshots in private R2 storage. No automatic deletion period is currently enforced. Request deletion or access by email, including your feedback reference when available. Direct emails are processed by Gmail.
Purposes and legal bases
We process feedback and correspondence to respond to requests and improve the service, and use necessary security measures to prevent abuse. Where personal data is involved, the intended basis is legitimate interests under GDPR Article 6(1)(f): maintaining, protecting and improving this service. You can object to processing based on those interests. Browser folder permission authorizes local file access; it is not consent to advertising or unrelated tracking. Providing feedback, screenshots and an email is optional; without a reply address we cannot reply by email.
Cookies and preferences
The necessary first-party ta_feedback cookie contains a random identifier lasting up to 24 hours to limit feedback spam. It is not an advertising profile. Local preferences remember columns, account visibility, limits, privacy mode and your start-notice choice. Public visitors do not need sign-in. Owner access uses the hosting platform's protected sign-in.
Aggregate page views
When a public page becomes visible, the application sends its public page path to a first-party endpoint. It stores daily counts and the first collection time, with no analytics cookies or browser identifiers. The analytics database does not store IP addresses, user agents, query strings, referrers, account names or transaction details. Counts are page loads, not unique people; reloads count again. Global Privacy Control and Do Not Track skip collection. Aggregate totals currently have no automatic expiry.
Providers and international processing
Hosting is provided through Sites on Cloudflare; Google provides the contact mailbox. Providers may process network addresses and request/security information to deliver and protect their services. Such provider processing is separate from the application's aggregate counters. Depending on provider infrastructure, processing may occur outside the EEA. Applicable transfer safeguards and locations depend on provider terms and configuration; the operator must verify them before treating this notice as a completed compliance assessment.
Form protection
If configured, Cloudflare Turnstile loads for feedback submission and processes browser/network information for bot protection. An optional edge rate limiter may use a hashed network address. The application does not add that address to feedback records. These features do not receive your local account activity or folder handle.
Payments and advertising
Donation links open an external payment provider only when clicked. That provider handles payment details and its own privacy practices. UECFlow does not collect card credentials. Advertising space is reserved; Google AdSense scripts are not currently active. A verification meta tag or ads.txt entry does not itself load advertising trackers. Advertising activation requires updated disclosures and applicable consent controls first.
Your rights and choices
You may request access, rectification, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Requests are normally answered within one month, subject to lawful extensions. Contact Rasoul.Safaeian@gmail.com; proportionate identity verification may be needed. You may complain to the Czech Office for Personal Data Protection or your competent supervisory authority.
Close the page to stop monitoring, revoke folder permission or clear local site data in browser settings. We cannot remotely erase data stored solely in your browser. The privacy display toggle hides information on screen; it does not encrypt stored data. No automated decisions producing legal or similarly significant effects are made by the accounting estimates.