Privacy policy.

Mockupflo (mockupflo.com) is operated by [operator legal name], [registered address]. For anything in this policy, write to hi@support.mockupflo.com. We are the controller of the personal data described here.

• Your media never leaves your machine. Rendering, animation and video encoding run in the browser tab. The one exception is opt-in: if you connect an AI agent through our hosted endpoint, the files you ask it to move pass through us briefly (see “AI agents”).
• We run no analytics, advertising or tracking scripts, and we do not sell or share data for marketing.
• We process your account details when you sign in, subscription facts if you buy a plan, a short-lived pairing signal when you use the phone remote, and ordinary server logs.

Your account

Opening the editor requires signing in with Google or with an email address and password. Our authentication provider, Supabase, stores your email address, a user id, sign-in timestamps and, if you use Google, the name and avatar Google shares with us. We use this to keep you signed in and to attach a subscription to you. Legal basis: performance of our contract with you.

Subscriptions and payments

Paid plans, when offered, are sold through Polar, our merchant of record. Polar collects your payment details directly; we never see card numbers. Polar tells us the plan, its status and period, and a customer id that we link to your user id so the editor can unlock your plan. Legal basis: performance of our contract; retention as required by tax and accounting law.

Hands-free phone remote

Pairing your phone exchanges one connection offer and one answer through our signalling endpoint, keyed by a short pairing code. These few kilobytes are held on our server for minutes and then discarded; after pairing, your phone and computer talk to each other directly over WebRTC. No screenshots, recordings or exports pass through us. Legal basis: performance of our contract.

AI agents (optional, Pro)

If you create an access token and connect an AI client to mockupflo.com/api/mcp, we store a one-way hash of the token with your user id and when it was last used. The agent's requests and your editor's answers (small descriptions of your project and, when the agent asks, snapshots of the frame on screen) are relayed between your AI client and your open editor tab through Supabase Realtime; they are passed along in transit and not stored. Screenshots or recordings you ask the agent to put in the editor, and exports it downloads for you, are held in a private storage bucket behind short-lived links and deleted within a day. Revoking the token in the editor ends access. In private / local mode the connector runs on your own computer and none of this passes through us. Legal basis: performance of our contract.

Server logs

Like any website, our hosting provider (Cloudflare) records requests: IP address, user agent, requested URL and time. We use these logs to keep the service secure and running, and keep them only as long as that takes. Legal basis: our legitimate interest in operating a secure service.

Data that stays on your device

Your projects, media, autosaves, export settings and preferences are kept in your browser's storage (IndexedDB and local storage) on your own device. We cannot read them. Clearing the site's data in your browser removes them, so keep your own copies of anything you care about.

We use a small number of providers that process data on our behalf, each under its own terms:

• Supabase, authentication, our account database and, if you connect an AI agent in hosted mode, the relay and short-lived file storage.
• Polar, checkout, invoicing and subscription management, as merchant of record.
• Cloudflare, hosting, content delivery and the short-lived pairing store.
• Google, only if you choose to sign in with Google.

Some of these providers operate outside your country. Where data leaves the European Economic Area or the United Kingdom, it does so under standard contractual clauses or an equivalent safeguard.

• Account data: until you ask us to delete your account.
• Subscription records: for as long as tax and accounting rules require after the subscription ends.
• Pairing signals: minutes.
• Server logs: a short rolling window set by our hosting provider.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. To exercise any of them, or to delete your account, email hi@support.mockupflo.com. We answer within a month.

Mockupflo is not directed at children under 16, and we do not knowingly collect their data.

When this policy changes, we update the date at the top of the page. Material changes to what we collect will be announced in the editor before they take effect.