Flutor · Privacy policy
udyan.mePrivacy Policy for Flutor
Effective Date: 9 August 2026
Last Updated: 9 August 2026
Applies to: Flutor for Android (package com.ironfist.flutor), distributed through Google Play.
1. Summary
Flutor is a BitTorrent client and media player that runs entirely on your device. It has no user accounts, no login, and no Flutor-operated server. Your downloads, settings, and file names never reach us.
Three things do leave your device, and only these:
| What | Where it goes | Can you turn it off? |
|---|---|---|
| Your IP address and the content identifiers you download | Directly to BitTorrent peers, trackers and the DHT network — inherent to how BitTorrent works | Yes — don't add torrents; or route traffic through a proxy in Settings |
| Anonymised crash, performance and usage diagnostics | Google Firebase (Crashlytics, Performance, Analytics) | Not currently in-app; see §7 |
| Advertising requests | Google AdMob | Personalisation is controlled by your consent choice; see §6 |
We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA, nor do we operate any advertising exchange of our own.
2. Who We Are (Data Controller)
Developer: IronFist
Contact e-mail: ironfist.apps@gmail.com
Postal address: Gujarat, India.
Website: https://udyan.me
For privacy questions or to exercise any right in §11, contact the e-mail above. We aim to respond within 30 days.
3. Data We Collect
3.1 Data that never leaves your device
Flutor stores the following locally, in the app's private storage and in your chosen download folder. It is not transmitted to us or to any third party:
- Torrent metadata: info-hashes, magnet links,
.torrentfiles, file lists, trackers, and per-torrent settings - Download and upload progress, session statistics, and queue order
- Your app settings, including proxy configuration, IP-filter rules, and interface preferences
- RSS/feed source URLs and their fetched item lists, if you configure feeds
- Downloaded files themselves, in the folder you select
- Ad frequency counters (see §6.4)
Uninstalling the app removes the app's private data. Files saved to a shared or user-chosen folder remain until you delete them.
3.2 Data shared with the BitTorrent network
This is inherent to the protocol and is not something Flutor adds:
- Your IP address and listening port are visible to every peer you connect to, to trackers you announce to, and to nodes on the DHT (Distributed Hash Table) network
- The info-hashes of torrents you add are announced to trackers, the DHT, Local Service Discovery (LSD), and Peer Exchange (PEX)
- Pieces of the content you have are advertised to peers so they can request them from you
Flutor does not operate any tracker, DHT bootstrap node, or peer server. We do not receive, log, or have any way to observe this traffic.
Controls available to you in Settings:
- Proxy — route peer and/or tracker connections through a SOCKS/HTTP proxy, including proxying hostname lookups (
proxyHostnames,proxyPeerConnections,proxyTrackerConnections) - Anonymous mode — suppresses identifying information in outbound protocol traffic
- DHT / LSD / PEX — each can be disabled individually to reduce network exposure
- Encryption mode — controls protocol encryption for peer connections
- IP filter — block ranges of addresses from connecting
3.3 Diagnostics and analytics (Google Firebase)
Flutor uses Firebase Crashlytics, Firebase Performance Monitoring, Firebase Analytics, and Firebase App Check. Firebase is disabled entirely in debug builds and initialises only after the app's first screen is drawn.
Collected:
- Crash reports — stack traces, exception type and message, Android version, device model, app version, and a small set of breadcrumb events preceding the crash
- Performance traces — durations of app start and of specific internal operations
- Analytics events — a fixed, enumerated list:
app_launched,engine_started,permission_step,setting_changed,torrent_added,torrent_add_failed,torrent_action,stream_started,player_error, and ad-lifecycle events (ads_bootstrap,ads_consent,ads_impression,ads_load_failed,ads_breaker_open). Parameters are limited to non-identifying values such as a source type (file/magnet), a file count, an error code, or a setting name. - Firebase installation ID / app-instance ID — a pseudonymous identifier Google assigns to this app installation. It is reset when you clear app data or uninstall.
- App Check attestation — Flutor uses Google Play Integrity to verify that requests come from a genuine, unmodified app instance.
Redaction before transmission. All diagnostic text is passed through a sanitiser before it is sent. It removes magnet links, URLs and URIs, file-system paths, 32–40 character hex strings (info-hashes), and IP addresses, and truncates the remainder. Analytics parameter names are normalised and truncated. This is enforced in a single telemetry module and covered by automated tests.
We therefore do not receive: file names, folder paths, torrent names, magnet links, info-hashes, tracker URLs, feed URLs, or peer IP addresses.
3.4 Advertising data
See §6.
3.5 Data we do not collect
Flutor does not collect, and does not request permission to access: precise or coarse location, contacts, calendar, SMS or call logs, microphone, camera, photos or media libraries, health data, biometric data, or any account or profile information. There is no sign-up, and we do not ask for your name or e-mail to use the app.
4. Android Permissions
Flutor requests only the permissions below. Each is used solely for the stated purpose.
| Permission | Why it is needed | Data leaving the device |
|---|---|---|
INTERNET | BitTorrent peer, tracker and DHT traffic; ad requests; diagnostics | Yes — see §3.2, §3.3, §6 |
ACCESS_NETWORK_STATE | Detect connectivity type (Wi-Fi / mobile / metered / VPN) so transfers and ad requests can respect your network rules | No |
WAKE_LOCK | Keep the CPU awake while a transfer is actively running | No |
FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC | Run the torrent engine as a visible foreground service so Android does not kill an in-progress transfer | No, by itself |
POST_NOTIFICATIONS | Show transfer progress, completion and error notifications | No — notifications are rendered locally by Android |
READ_EXTERNAL_STORAGE (Android 12L / API 32 and below only) | Read .torrent files and existing downloads you point the app at | No |
WRITE_EXTERNAL_STORAGE (Android 10 / API 29 and below only) | Write downloaded files to the folder you choose | No |
On Android 13 and above, Flutor uses the Storage Access Framework: you pick a download folder through the system picker and Flutor holds a persistable grant to that folder only. Flutor does not request MANAGE_EXTERNAL_STORAGE ("All files access") and has no broad filesystem access.
Flutor explicitly removes the READ_MEDIA_IMAGES, READ_MEDIA_VIDEO and READ_MEDIA_AUDIO permissions that some bundled libraries would otherwise declare, so the app cannot read your media library.
5. How and Why We Use Data
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Provide the download, streaming and playback features you request | Local data (§3.1), BitTorrent traffic (§3.2) | Contract — Art. 6(1)(b) |
| Keep the app stable and diagnose crashes | Crash and performance diagnostics (§3.3) | Legitimate interests — Art. 6(1)(f) |
| Understand which features are used, in aggregate | Analytics events (§3.3) | Legitimate interests — Art. 6(1)(f) |
| Protect against abuse and fraudulent API use | App Check attestation (§3.3) | Legitimate interests — Art. 6(1)(f) |
| Serve non-personalised advertising | Ad request data (§6) | Legitimate interests — Art. 6(1)(f) |
| Serve personalised advertising | Advertising ID and ad interaction data (§6) | Consent — Art. 6(1)(a) |
Where we rely on legitimate interests, we have assessed that our interest in operating and improving a free application does not override your rights, in part because the diagnostic data is redacted before it reaches us (§3.3). You may object to this processing at any time (§11).
6. Advertising
6.1 What we use
Flutor displays advertising supplied by Google AdMob (publisher ID pub-5764447516567914) in four places: a small native ad inside the download lists, a banner on empty screens and the add-torrent preview, an occasional full-screen ad after adding torrents, and an optional full-screen ad before playback that you can always decline.
6.2 What advertising partners may collect
Google and its ad partners may collect and process:
- Advertising ID (a resettable identifier you control in Android Settings)
- IP address, and coarse location inferred from it
- Device and app information (model, OS version, app package, screen size)
- Ad interactions: impressions, clicks, and viewability
- Signals used for frequency capping, fraud prevention and measurement
This data is processed by Google as an independent controller or as a processor depending on your region and consent state. See Google's Privacy Policy and How Google uses information from sites or apps that use our services.
6.3 Consent and your choices
- In the EEA, UK and Switzerland, Flutor presents a Google-certified User Messaging Platform (UMP) consent form, compatible with the IAB Transparency & Consent Framework, before any ad is requested. No ad is requested until you have made a choice. Declining means you continue to see ads, but non-personalised ones.
- In US states with applicable privacy laws, Flutor presents the corresponding UMP regulations message.
- You can change your choice at any time via Settings → Privacy → Ad Privacy Options. Withdrawing consent immediately stops further ad requests in the current session and clears Flutor's local ad counters.
- Independently of Flutor, you can delete or reset your Advertising ID in Android Settings → Privacy → Ads, and manage Google-wide ad settings at adssettings.google.com.
The Google Mobile Ads SDK is initialised only after the consent state has been resolved. Flutor's ad content rating is capped at Teen (T), and the app is not tagged as child-directed (see §9).
6.4 Ad frequency counters
To limit how often ads appear, Flutor stores a handful of integers on your device (number of torrents added since the last ad, number of playbacks since the last ad, a timestamp, and daily impression counts). These are stored locally only, are never transmitted, and are erased when you withdraw consent or clear app data.
7. Third Parties and Processors
| Service | Role | Data | Policy |
|---|---|---|---|
| Google AdMob / Google Mobile Ads SDK | Advertising delivery and measurement | §6.2 | https://policies.google.com/privacy |
| Google User Messaging Platform (UMP) | Consent collection and storage | Consent state | https://policies.google.com/privacy |
| Firebase Crashlytics | Crash diagnostics | §3.3 | https://firebase.google.com/support/privacy |
| Firebase Performance Monitoring | Performance diagnostics | §3.3 | https://firebase.google.com/support/privacy |
| Firebase Analytics | Aggregate usage analytics | §3.3 | https://firebase.google.com/support/privacy |
| Firebase App Check / Play Integrity | Anti-abuse attestation | §3.3 | https://firebase.google.com/support/privacy |
| Google Play Services / Google Play | App distribution and platform services | Handled by Google | https://policies.google.com/privacy |
We have no other processors. We do not use any third-party SDK for attribution, mediation, tracking, or user profiling beyond those listed.
BitTorrent peers, trackers and DHT nodes (§3.2) are not our processors — they are independent parties on a public network, and we have no contractual relationship with them.
8. Data Retention
| Data | Retention |
|---|---|
| Torrent data, settings, downloads (on device) | Until you delete them or uninstall the app |
| Ad frequency counters (on device) | Until reset, consent withdrawal, or app data is cleared |
| Crash reports | Retained by Google per Firebase Crashlytics defaults (currently 90 days) |
| Analytics events | Retained by Google per the configured Firebase Analytics retention window |
| Performance traces | Retained by Google per Firebase Performance defaults |
| Advertising data | Retained by Google per its own policies |
We do not maintain any database of our own, so we hold no copy of your data beyond what Google retains on our behalf in the consoles listed above.
9. Children's Privacy
Flutor is not directed to children. It is rated for a general or teen audience and is not published in Google Play's Designed for Families programme. We do not knowingly collect personal information from children under 13 (or the applicable age of digital consent in your jurisdiction, up to 16 in parts of the EEA).
Flutor does not set the child-directed treatment flag on ad requests, because the app is not intended for children. If you believe a child has used the app and you wish to have any associated data removed, contact us at the address in §2 and we will act promptly.
10. International Transfers
Google processes data in the United States and other countries. Where personal data is transferred out of the EEA, UK or Switzerland, Google relies on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US / UK / Swiss-US Data Privacy Framework. Details are in Google's own policies linked in §7.
11. Your Rights
Depending on where you live, you may have the right to:
- Access the personal data held about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict or object to processing, including processing based on legitimate interests
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time, without affecting processing carried out before withdrawal
- Opt out of sale/sharing and of targeted advertising (CCPA/CPRA, and comparable US state laws) — note that Flutor does not sell or share personal information as defined by those laws
- Non-discrimination for exercising any of these rights
- Lodge a complaint with your local supervisory authority (in the EEA/UK) or applicable regulator
How to exercise them, in practice:
| You want to… | Do this |
|---|---|
| Withdraw or change ad consent | Settings → Privacy → Ad Privacy Options |
| Reset your advertising identifier | Android Settings → Privacy → Ads → Delete advertising ID |
| Delete everything Flutor holds locally | Android Settings → Apps → Flutor → Storage → Clear data, or uninstall |
| Request access to, or deletion of, diagnostic data | E-mail us at the address in §2, including your Firebase app-instance ID if you can provide it |
| Object to analytics or crash reporting | E-mail us at the address in §2 |
Because the diagnostic data we receive is pseudonymous and redacted (§3.3), we may be unable to link it to you individually. In that case, under GDPR Art. 11 we may ask for additional information to locate it, or explain why we cannot.
12. Security
- No Flutor-operated backend exists, so there is no central store of user data to breach.
- All traffic to Google services uses TLS.
- Firebase App Check with Play Integrity is used to reject requests from tampered or emulated app instances.
- Diagnostic payloads are redacted at source before transmission (§3.3).
- Release builds are code-shrunk and obfuscated.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. Lawful Use and Content Responsibility
Flutor is a general-purpose BitTorrent client. It does not host, index, supply, or recommend any content, and it has no catalogue, search, or discovery of copyrighted works. The developer cannot see what you download and does not inspect, scan, or store your files.
You are solely responsible for the content you access, download, share or seed, and for complying with copyright, intellectual-property and all other laws applicable to you. Do not use Flutor to infringe the rights of others.
14. Changes to This Policy
We may update this policy as the app evolves or as legal requirements change. Material changes will be reflected in the Last Updated date at the top and, where the change is significant, surfaced in the app or in the Google Play release notes. Continued use after an update constitutes acceptance of the revised policy.
15. Contact
Developer: IronFist
E-mail: ironfist.apps@gmail.com
Address: Gujarat, India.
Website: https://udyan.me
If you are in the EEA or UK and are dissatisfied with our response, you may complain to your national data protection authority.