Companion Document to the Flaeti Privacy Policy Effective Date: September 24, 2026 Entity: Flaeti Inc., a Delaware corporation
Flaeti is an end-to-end encrypted messaging and content-sharing platform. Understanding what Flaeti can and cannot access is essential to understanding how we respond to law enforcement requests.
What this means technically:
Message content, shared files, and images transmitted through Flaeti are encrypted on the sender's device before transmission and decrypted only on the recipient's device. Flaeti requires Android 12 (API level 31) or higher as a condition of installation. Devices running earlier versions of Android cannot install or use Flaeti. Flaeti does not operate a lower-security mode for older devices. Encryption and decryption occur on user devices, using key agreement performed through the Android Keystore system. Private keys are generated and held on the user's device and are not transmitted to or stored on Flaeti's servers.
Flaeti's servers store and transmit ciphertext — encrypted data that Flaeti cannot read without private keys held only on user devices. This is a feature of how Flaeti is built. It is not a setting that Flaeti can switch off in response to a request or order.
What Flaeti holds:
Flaeti retains limited metadata associated with account operation. A complete description of retained metadata is set forth in Section 2 of these Guidelines and in Section 2 of the Flaeti Privacy Policy.
What Flaeti does not hold and cannot produce:
No legal process — including subpoena, court order, search warrant, or national security letter — can compel Flaeti to produce data it does not possess. We will not represent to any court or law enforcement agency that we can produce plaintext content. We cannot.
When served with valid legal process that satisfies the requirements of Section 4 of these Guidelines, Flaeti can produce the following categories of data:
Flaeti does not collect, log, or retain user IP addresses at the application layer. Our hosting provider may briefly process network routing information at the infrastructure layer as part of standard internet operations and for abuse prevention. This information is not accessible to Flaeti, is not stored in Flaeti's databases, and cannot be produced by Flaeti in response to legal process.
All producible data is limited to what Flaeti actually holds at the time of the request. Flaeti does not create records that do not exist in response to legal process. Retention periods are described in the Flaeti Privacy Policy, and Flaeti does not guarantee that any specific category will be available at the time a request is received.
Flaeti cannot produce the following regardless of the legal process presented:
If legal process requires production of any of the above categories, Flaeti will inform the requesting authority in writing that the requested data does not exist within our systems and cannot be produced. Flaeti will respond through counsel to any challenge to that position.
Flaeti takes law enforcement requests seriously. We also take our users' legal rights seriously. We require that all requests satisfy the following requirements before we will begin processing them.
4.1 Valid Legal Process
All requests must be accompanied by valid legal process appropriate to the jurisdiction and the category of data sought. Flaeti recognizes the following as valid legal process under United States law:
Informal requests, badge numbers, email requests without accompanying legal process, and telephone requests do not constitute valid legal process and will not be honored, except as described in Section 5 (Emergency Requests).
4.2 Specificity Requirement
All requests must specifically identify:
Flaeti will not respond to requests that are facially overbroad, that seek categories of data Flaeti does not collect, or that appear designed to conduct generalized surveillance of Flaeti's user base. We will notify the requesting authority in writing of any deficiency and provide a reasonable opportunity to cure.
4.3 Proportionality Review
Flaeti reviews all legal process for proportionality. A legally valid subpoena or order is a necessary but not sufficient condition for compliance. Flaeti reserves the right to object to, move to quash, or seek to narrow any legal process that:
Where practicable and permitted by law, Flaeti will notify the requesting authority in writing of any proportionality objection before taking action to challenge or limit compliance, and will provide a reasonable opportunity to narrow the request voluntarily before seeking judicial intervention.
4.4 Response Timeline
Upon receipt of valid legal process satisfying the requirements of Sections 4.1 through 4.3, Flaeti will endeavor to acknowledge receipt within three business days and to respond substantively within fourteen business days of receipt, unless a shorter deadline is imposed by court order or applicable law.
Flaeti will not artificially delay responses to valid legal process. We will not artificially accelerate responses in a manner that compromises our ability to conduct meaningful legal review. Timeline extensions may be requested and will be granted where operationally necessary.
4.5 User Notice
Where Flaeti is legally permitted to do so, our default practice is to notify affected users of the existence of legal process directed at their account before producing any responsive data. This notice will be provided sufficiently in advance of production to allow the affected user to seek legal counsel and, where applicable, to challenge the legal process through appropriate judicial channels.
Flaeti will not provide advance user notice where:
Where notice is legally prohibited, Flaeti will document that prohibition internally and will disclose the existence of non-disclosure orders in aggregate in its annual Transparency Report to the extent permitted by law.
4.6 Preservation Requests
Upon a valid request from a governmental entity under 18 U.S.C. § 2703(f), Flaeti will preserve records in its possession relating to the identified account for 90 days, and for one additional 90-day period upon a renewed request. Preservation applies only to data Flaeti holds at the time of the request. It does not create data that does not exist and does not extend to encrypted content, which Flaeti cannot read. Preservation does not constitute production; production requires valid legal process under this Section.
4.7 Civil and Private Party Requests
These Guidelines are directed to requests from government authorities. Subpoenas and discovery requests from private parties in civil litigation should be directed to [email protected]. Flaeti will review them for legal sufficiency and will object to requests that are overbroad, that seek content Flaeti does not possess, or that are otherwise improper. Flaeti can produce, at most, the categories of data described in Section 2, and will do so only where required by valid legal process.
Flaeti recognizes that law enforcement may occasionally face circumstances involving a credible, imminent threat to human life where standard legal process timelines are not feasible. We take these situations seriously.
5.1 Emergency Disclosure Standard
Flaeti will consider voluntary emergency disclosure of available metadata — and only metadata, as Flaeti cannot produce plaintext content — where all of the following conditions are met:
Emergency disclosure requests that do not satisfy all four conditions will not be honored on an emergency basis. The requesting agency will be directed to obtain standard legal process.
5.2 Limitations of Emergency Disclosure
Emergency disclosure does not expand what Flaeti can produce. Even in genuine emergencies:
Flaeti will document all emergency disclosures internally. Emergency disclosures will be reported in aggregate in the annual Transparency Report.
5.3 Submitting Emergency Requests
Emergency requests must be submitted to [email protected] with the subject line: EMERGENCY REQUEST — [AGENCY NAME] — [DATE]
Flaeti does not currently maintain a telephone emergency line. Emergency requests are reviewed as promptly as reasonably practicable after receipt, including outside business days where reasonably possible. Flaeti's decision whether to make any voluntary emergency disclosure is made in its discretion, in good faith, and in accordance with applicable law.
6.1 MLAT Requirement
Flaeti is a United States company subject to United States law. Flaeti does not respond directly to demands, requests, or orders issued by foreign governments, foreign law enforcement agencies, or foreign courts.
Foreign authorities seeking data held by Flaeti must use the applicable Mutual Legal Assistance Treaty process between their jurisdiction and the United States, resulting in valid legal process issued by a United States court or federal authority. Flaeti will respond to that US-issued process in accordance with these Guidelines.
Requests that do not comply with this requirement will not be honored regardless of their stated urgency, except in the narrow emergency circumstances described in Section 5, where Flaeti retains sole discretion to evaluate the credibility and immediacy of the stated emergency.
6.2 Jurisdictions Without Meaningful Judicial Oversight
Flaeti may decline data demands from governments or law enforcement agencies operating in jurisdictions that do not provide meaningful, independent judicial oversight of law enforcement access to private communications data.
The existence of a government demand does not establish its legitimacy. Flaeti evaluates all legal process — domestic and foreign — for compliance with applicable law, specificity, and proportionality before responding.
6.3 Data Localization and Foreign Access Laws
Flaeti has not built, and does not maintain, any mechanism that would give a government ongoing or real-time access to user data, any technical backdoor or surveillance capability, or any means of undermining the end-to-end encryption architecture described in Section 1. Flaeti will oppose, through lawful means, any demand that it do so, and reserves the right to discontinue service in any jurisdiction that imposes such a requirement.
6.4 EU, UK, and GDPR Jurisdiction
Flaeti acknowledges that the European Union General Data Protection Regulation and its UK equivalent — the UK GDPR as retained in domestic law following Brexit — impose specific obligations with respect to cross-border data transfers and law enforcement access to personal data of EU and UK residents. Flaeti's response to law enforcement requests involving data of EU or UK residents will be consistent with these obligations, including:
Because of Flaeti's end-to-end encryption architecture, Flaeti holds only the account, connection, and delivery metadata described in Section 2 with respect to EU and UK resident users, together with ciphertext it cannot read. The practical scope of any law enforcement production involving EU or UK resident data is limited accordingly.
Flaeti is committed to transparency about how it responds to law enforcement demands. We believe our users have a right to understand, in aggregate, the volume and nature of legal process directed at Flaeti and how we respond.
7.1 Reporting Commitment
Flaeti will publish an annual Transparency Report covering the following information:
Where applicable law prohibits disclosure of specific categories — including National Security Letter gag provisions — Flaeti will publish aggregate figures to the maximum extent the law permits.
7.2 Reporting Schedule
Flaeti's first Transparency Report will cover the period from September 24, 2026 through December 31, 2027, and will be published no later than March 31, 2028. Subsequent reports will cover each calendar year and will be published no later than March 31 of the following year.
8.1 Governing Law
These Guidelines are governed by the laws of the United States of America, including applicable federal statutes governing law enforcement access to electronic communications data, including but not limited to the Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq., the Stored Communications Act, 18 U.S.C. § 2701 et seq., and the Foreign Intelligence Surveillance Act, 50 U.S.C. § 1801 et seq.
To the extent state law applies, these Guidelines are governed by the laws of the State of Delaware, the jurisdiction of incorporation of Flaeti Inc., without regard to conflict of law principles.
8.2 Legal Process Submission
All legal process directed at Flaeti must be served on Flaeti's designated legal process address. Informal requests, badge numbers, and telephone requests do not constitute valid legal process and will not be honored, except as described in Section 5.
Flaeti Inc. Legal Process Contact [email protected]
Service by email to [email protected] constitutes valid service for purposes of these Guidelines. Flaeti reserves the right to require physical service for legal process in any jurisdiction where electronic service is not recognized as legally effective. Requesting agencies uncertain about service requirements should contact [email protected] in advance to confirm.
8.3 Updates to These Guidelines
Flaeti reserves the right to update these Guidelines at any time to reflect changes in applicable law, Flaeti's technical architecture, or Flaeti's legal process practices. The current version of these Guidelines will always be available at flaeti.com/law-enforcement. The effective date of the current version is stated at the top of this document.
Material changes to these Guidelines will be noted in the version history maintained at flaeti.com/law-enforcement.
8.4 Relationship to Privacy Policy
These Guidelines are a companion document to the Flaeti Privacy Policy and should be read together with it. In the event of any conflict between these Guidelines and the Privacy Policy with respect to law enforcement matters, these Guidelines govern.
8.5 Compliance With Law; No Third-Party Rights
These Guidelines describe Flaeti's practices and are provided for informational purposes. Nothing in these Guidelines limits Flaeti's ability to comply with applicable law or a valid court order, or creates any right or remedy enforceable by any person other than Flaeti. Where these Guidelines conflict with applicable law or a binding court order, the law or order controls.
Flaeti Law Enforcement Guidelines — Version 1.0
Effective Date: September 24, 2026
Flaeti Inc., a Delaware corporation
[email protected] · flaeti.com