Security and data
How Floot handles your code, your data, and your users' data.
This page covers data ownership, the security measures behind the platform, and who can see what.
Data ownership
You own 100% of your app:
- Code
- Complete code ownership.
- Data
- All app data belongs to you.
- IP
- Full intellectual property rights.
You can export your database at any time, and code download is included on every paid plan — see Code, data, and exports, or Self-hosting if you want to run the app yourself.
Security measures
- Encrypted in transit
- All traffic is served over HTTPS/TLS.
- Encrypted at rest
- Stored data is encrypted on disk.
- Secret handling
- API keys and secrets are collected through a secure dialog, stored encrypted, and never shown to the AI or included in chat history.
- Access controls
- Role-based access to internal systems.
Privacy and visibility
Your projects
| Setting | Who can see it |
|---|---|
| Private (default) | Only you, your collaborators, and authorized Floot staff for support |
| Public | Anyone — and other users can remix it |
For a private project:
- Code and prompts are not visible to other users
- It cannot be remixed by anyone else
- Access is limited to you, your collaborators, and Floot staff as needed for support
Project visibility is not app visibility
Making a project public exposes its source and chat history — it does not change your published app's URL. A published app is reachable by anyone with the link either way, unless your app requires login.
Your app's user data
Data your app collects — accounts, form submissions, uploads — is:
- Stored securely in your app's database and file storage
- Accessible to you, and to the Floot AI agent when your prompts require it
- Your responsibility to handle in line with applicable law
Handling sensitive data
If your app handles healthcare, financial, or otherwise regulated data:
- Consult legal counsel about your compliance requirements
- Contact Floot to discuss your specific needs before you launch