Privacy policy
Effective October 27, 2026 · Version 2026-10-27.1
This policy explains the current Flipbook Studio pilot: you prepare content in your browser, send it for assembly, download the finished release, and retain your own copy. Assembly does not automatically publish your uploads. Customer hosting is not currently offered. Any future hosting will require a separate arrangement and review of all submitted media before publication.
Privacy contact
Flipbook Studio is operated under Balloon Bear Expeditions from Calgary, Alberta, Canada. Privacy officer: the Flipbook Studio operator (Les). Contact support@balloonbearexpeditions.com with the subject “Flipbook Studio privacy”. This contact handles requests about collection, service providers, access, corrections, retention and complaints.
What information moves through the service
| Information | Purpose and handling |
|---|---|
| Draft text and selected files | Held in browser memory while you work. The application does not implement persistent draft autosave or account recovery. Browser previews and the file check run locally; checking alone does not send your selected files to the assembly server. |
| Release title, text, teaching material, images, video, audio and original filenames | Used to format the reader and teaching companion and assemble your requested download. Content and metadata can identify you or people shown or named in it. |
| Pilot access code and temporary job token | Authorize assembly and access to its temporary files. The application stores a hash of the job token rather than its plaintext value in job state. The supplied pilot code is checked against the configured secret and is not copied into the acceptance record. |
| Acceptance and assembly records | A private record contains the assembly ID, release title, server acceptance time, agreement version, agreement text and fingerprint, and the acknowledgement. Successful assembly also records generated file names, fields, sizes and content fingerprints. It does not retain uploaded media in that record. File names and titles may contain personal information. Records identify a submitting session, not a verified individual. |
| Network and operational information | Cloudflare necessarily handles network requests, including IP addresses and browser/request information. The application does not deliberately add IP addresses to acceptance records and Worker observability is disabled in the supplied configuration. This does not mean Cloudflare keeps no platform, account, security or operational records. |
| Support messages | If you contact us, your email address, message and any attachments are handled in our support mailbox to respond and resolve the matter. Do not email sensitive source files unless needed and requested. |
Retention and deletion
Temporary assembly media: deletion is attempted after completed transfer, cancellation or a terminal assembly error. Abandoned jobs have a 60-minute expiry, with cleanup retries if deletion fails. These are operational targets, not a guarantee of exact physical erasure at a minute boundary. A failed or interrupted connection can leave files until expiry cleanup. Small job-state remnants may remain until the expiry alarm clears them.
Acceptance and assembly records: the standard retention period is 365 days from each record’s creation. A daily cleanup checks eligible records and deletes them, with retries on later runs if needed. Limited records may be kept longer when reasonably necessary for a specific complaint, dispute, investigation or legal obligation. A documented legal hold prevents scheduled deletion until the hold is released. The purpose is to document service use, agreement acceptance and related disputes; the period is not a statement about legal limitation periods.
Support correspondence: we review closed support matters after one year and delete or anonymize personal information that is no longer reasonably needed. This is a manual mailbox process. Relevant material can be retained longer for a documented legal obligation or unresolved matter.
Your downloaded release: includes an acknowledgement, title, assembly ID, acceptance time, agreement snapshot and fingerprints. If you publish or share the package, recipients may see that information. Your copy and copies held by recipients are under their control and are not deleted by our server cleanup. Cloudflare’s independent records and infrastructure disposal are governed by its applicable arrangements and policies.
Cloudflare and processing outside Canada
Cloudflare provides the website, Worker processing, temporary storage and private record storage. We do not promise Canada-only storage or processing. Processing may occur in the United States and other countries where Cloudflare and its relevant providers operate, and information may be subject to lawful access there. Locations depend on the account configuration, network routing and providers. See Cloudflare’s privacy policy and customer subprocessor information. Ask the privacy officer for information about the countries and providers applicable to your request before submitting material if location is important to you.
Use, access and disclosure
We use information to operate the requested assembly, secure the service, document acceptance, answer support requests and handle disputes or legal obligations. We do not use submitted material for advertising, sell it, or use it to train an AI model through this application. Authorized operators may access limited information when necessary for support, security, a complaint or a legal obligation. Assembly is automated; it is not a promise that every submission is manually reviewed.
We may disclose necessary information to service providers acting for us or when permitted or required by law. Public examples are deliberately published separately and are not a public listing of customer uploads. Merely creating a book does not enrol you in marketing.
Payments, analytics and browser storage
The service can operate in free pilot mode, PayPal Sandbox test mode or Live payment mode. Live mode takes real payments at the displayed CAD price; Sandbox does not. There is no customer account system. PayPal checkout sends the selected offer, CAD price, a checkout identifier and the fact that it is an assembly purchase to PayPal; it does not send your book title or uploaded media to PayPal. PayPal independently processes the checkout information you enter there. Our application verifies order and capture IDs, amount, currency and recipient merchant and retains a minimal payment receipt. It does not deliberately retain your PayPal payer name, email, card details or full API response. PayPal may process those details under its own privacy policy. The supplied assembler interface has no advertising tracker or third-party analytics script. Infrastructure security features may operate separately. If analytics or other material processing changes are introduced, this policy will be updated before the changed processing begins.
The supplied readers and teaching companions may use browser storage to remember reading position or progress on the device where they are opened. This does not create a central student progress account. External links, including example books and third-party resources, send ordinary web requests to their destination when opened and may be governed by that destination’s policies.
Checkout and financial records
Checkout session state contains the release title, file descriptors, acceptance snapshot and access tokens required to resume the same checkout. Private receipts contain checkout, order and capture identifiers, price, currency, payment environment and payment time. Operational checkout session state and lookup indexes are deleted after 365 days through a scheduled alarm, subject to documented legal holds. Sandbox receipts are also deleted at that time. Minimal Live financial receipts are retained separately from uploaded media and are excluded from automatic one-year deletion, for bookkeeping, refunds and disputes. The operator reviews financial records for deletion after the applicable retention period, generally at least six years after the end of the last tax year to which they relate, and longer where required for an unresolved matter or legal obligation. This financial-record review and any accounting exports are manual operator processes. Uploaded media is not retained for that financial-record period. PayPal keeps its own transaction records under its policies.
Your choices and requests
Do not submit confidential, sensitive or third-party personal information unless you have an appropriate lawful basis and it is needed for your project. Educators should avoid uploading student identifiers when a blank learner record will do. Educators or guardians should supervise children’s use and obtain any permissions required for children’s material.
You may ask the privacy officer to explain our practices, request access to or correction of your personal information, or request deletion or withdrawal of consent, subject to applicable exceptions and reasonable identity verification. Include the assembly ID from your acknowledgement if available; do not send the pilot code or job token. Withdrawal may prevent a new assembly but does not automatically require destruction of records reasonably retained for a legal purpose. We will explain any applicable restriction and respond within the periods required by applicable law. You may also raise an unresolved privacy concern with the Office of the Information and Privacy Commissioner of Alberta or another regulator with jurisdiction.
Safeguards and incidents
Temporary media and acceptance records are kept in separate private buckets, with controlled application access and encrypted HTTPS connections. No system is risk-free. We assess reported incidents, take appropriate action and provide notifications required by applicable law.
Changes
Material changes will be reflected in the version and date. A new agreement version is required for new assemblies after this update; previous records retain the agreement snapshot accepted at their creation.