Privacy Policy
Effective date: 5 October 2026
This policy explains what information Flash collects, why, where it goes, how long we keep it, and what you can do about it. Flash is made by DRS Studios (DhruvRaj Studios), Ahmedabad, Gujarat, India ("we", "us"). It covers the Flash desktop app for Windows, the Flash Android app, and the website drsflash.com.
We wrote this to describe what the apps actually do today. When the apps change in a way that affects your data, we will update this page and its date.
1. The short version
- We collect what we need to run Flash: your account details, what you ask Flash, and how much you use it.
- To answer you, your questions (and a screenshot when you ask about your screen) are sent to Google's Gemini AI. Voice is converted to text by Google. Flash's spoken voice is produced by Microsoft's speech service.
- We do not sell your data. We do not show ads. We do not build advertising profiles.
- Flash never watches your screen, reads your files, or listens to your conversations in the background without you turning that on. The exceptions are explained below, with exactly what happens.
- You can delete your account and data at any time from inside the app.
2. Information you give us
Account details. When you sign up we store your name, email address and password (stored only as a one-way hash, never in readable form), an optional phone number, on the desktop app your state and profession if you enter them, and the date you accepted our Terms and this policy. Sign-up codes (OTPs) are emailed to you and stored only in hashed form for 5 minutes.
Payments. Payments are handled by Razorpay. We never see or store your card, UPI or bank details. We keep a record of each payment (what you bought, the amount, the date and Razorpay's payment ID) and, for subscriptions, the subscription ID, status and renewal date.
Feedback and support. If you send feedback, a support message or a feature request, we store what you wrote. If you rate one of Flash's replies, we store your rating, any correction you typed, and the text of that reply.
3. Information created when you use Flash
Your questions and Flash's replies.
- Android app: your conversation is kept only in the app's memory on your phone and is cleared when the app is closed. Your latest question, plus up to the last 3 back-and-forth exchanges, is sent with each request so Flash understands follow-ups. We do not save Android conversations on our servers.
- Desktop app: your chats and subject chats are saved on our servers so you can see your history. The message text is encrypted (AES-256-GCM) before it is stored. Chat titles, short summaries and topics are stored unencrypted so search and your chat list work. Our server holds the encryption key, so this protects your chats if our database or a backup is stolen; it is not end-to-end encryption, and we could technically decrypt them. Our admin tools have no screen for reading chats, and we do not read them.
Usage records. For each AI request we record the date and time, how many AI tokens it used and what it cost, which plan or allowance paid for it, your device name, and a rough feature category (for example "screen vision" or "web search"). These records do not contain the text of your questions. We use them for daily limits, billing, preventing abuse and understanding which features are used.
Logged-in devices. For each login we store a device name (for example "Android - Samsung SM-A155F" or your computer's name), when it logged in and when it was last used. This powers the device list in your account and the device limit.
Network data. Like almost every website and app, our server sees your IP address with each request. Our web server keeps standard access logs (IP address, time, address requested, browser or app type) for 14 days. Some security limits count requests per IP address in memory only; this resets regularly and is not saved.
4. Voice
Android: the wake word "Flash"
While Flash is running, the phone's microphone stays open so it can hear "Flash". This listening is done completely on your phone by an offline speech model. Nothing is sent anywhere until the wake word is heard or you tap the floating Flash button. After that, a short recording of your command (starting about 1.5 seconds before the wake word, so a command said without a pause is not cut off, and at most about 15 seconds long) is sent to our server and converted to text by Google's Gemini AI, with Google's speech service as a backup. We do not store the recording after it is converted. A notification shows whenever Flash is listening, with a Stop button.
Learning your voice. If you use "Flash ko apni awaaz sikhao", the app stores, only on your phone, which similar-sounding words your "Flash" is heard as. It does not store your voice recording.
Desktop app
When you talk to Flash, the recording of what you said is sent to our server and converted to text by Google's speech service. We do not store the recording.
Flash's own voice
- Android: the text of Flash's reply is sent to our server, which uses Microsoft's speech service to turn it into audio. Short, frequently repeated replies (such as "Torch on.") are kept as audio files on your phone so they play faster. If the service is unavailable, your phone's own text-to-speech is used.
- Desktop: the reply text is sent from your computer directly to Microsoft's speech service.
5. Your screen and camera
Android
Flash looks at your screen only when you ask (for example "screen pe kya hai", or about something the camera app is showing). It then takes a single screenshot and sends it with your question to Google's Gemini AI. Android asks for your permission before Flash can capture the screen and shows its own screen-sharing indicator while that permission is active. After you allow it, the permission stays active until you stop Flash, but no screenshots are taken unless you ask. You can turn screen vision off completely on the app's Permissions page. Screenshots are not stored on our servers.
Desktop
When your message mentions the screen, or asks about what is under your mouse ("Point Mode"), Flash takes one screenshot (or a crop around the cursor) and sends it with your question to Google's Gemini AI.
Auto-Watch is a study feature that is off by default. While you have it on, Flash takes a screenshot every 4 seconds and compares it with the previous one on your computer. When the screen has changed, it sends the latest screenshot to Google's Gemini AI to check your work, at most once every 8 seconds. Turning Auto-Watch off stops this immediately. Screenshots are not stored on our servers.
6. Android permissions and what they are used for
| Permission | Used for | What leaves your phone |
|---|---|---|
| Microphone | Hearing "Flash" (on the phone) and recording your command | Only the command recording, as described in section 4 |
| Contacts | Calling or messaging someone by name ("Rahul ko call karo") | Nothing. Names are matched on your phone. The name you say is part of your command recording, and Flash's spoken reply (for example "Rahul ko call kar raha hoon") goes through the voice service in section 4 |
| Phone calls | Placing the call you asked for | Nothing |
| Display over other apps | The floating Flash button and captions | Nothing |
| Notification access | Reading your notifications aloud when you ask, and knowing which song is playing | Nothing. Notifications are read out by your phone's own voice and are not sent to our servers or any voice service |
| Modify system settings | Brightness, auto-rotate and screen timeout commands | Nothing |
| Do Not Disturb access | Silent and Do Not Disturb commands | Nothing |
| Bluetooth | "Bluetooth on/off" commands | Nothing |
| Notifications | Showing that Flash is running, with a Stop button | Nothing |
| Screen capture (asked when Flash starts, if screen vision is on) | Screen vision, section 5 | One screenshot per request |
| Install unknown apps (only in the version downloaded from drsflash.com) | Installing Flash updates | Nothing |
Flash does not read your call history: "redial" opens your phone's own call log for you to tap. Phone commands such as torch, volume, alarms, timers, battery and Wi-Fi are handled entirely on your phone. Sending a WhatsApp message or SMS opens that app with the message filled in; you press send.
Android device check. Once per login, the Android app asks your phone's security hardware for a Google-signed certificate and sends it to our server. It confirms that the official Flash app is running on a genuine Android device, so the free Android allowance goes only to real phones. The certificate does not contain your name, phone number or contacts.
7. Files and other desktop features
Files. If you ask the desktop app to read or work with a file, its contents are read on your computer and the relevant part is sent with your question to Google's Gemini AI. Flash only accesses files when you ask and after you allow file access in its settings.
Web search. To answer questions about current events, Gemini may run a Google Search based on your question.
Spotify. When you ask Flash to play a song, the song name you said is sent to our server, which looks it up with Spotify. We do not connect to your Spotify account.
8. The website (drsflash.com)
- Live demo. The "Try Flash" demo on the downloads page sends what you type to Google's Gemini AI and returns a spoken reply made by Microsoft's speech service. Demo messages are not saved. To limit abuse we count how many questions each IP address asked that day; this count is kept only in memory and resets daily.
- Website login. If you log in on the website, your login token and basic account details are kept in your browser's local storage until you log out.
- No tracking. The website does not use advertising or analytics trackers.
9. Who we share data with
We share data only with the services that make Flash work, and only what each one needs:
| Service | What it receives | Why |
|---|---|---|
| Google (Gemini API) | Your questions, recent conversation context, screenshots and file contents you send, command recordings (Android) | Generating replies, understanding images, converting Android voice commands to text |
| Google (speech recognition) | Desktop voice recordings; Android recordings only if Gemini is unavailable | Converting speech to text |
| Microsoft (Edge speech service) | The text of Flash's replies | Producing Flash's voice |
| Spotify | Song names you ask to play | Finding the song |
| Razorpay | Payment and subscription details | Processing payments |
| Google (Gmail) | Your email address and name | Sending sign-up codes, receipts and account emails |
| Hostinger | All data stored on our servers | Our servers are hosted by Hostinger in Mumbai, India |
We use Google's paid Gemini API. Under Google's terms for paid API use, Google does not use your prompts, screenshots or Flash's replies to train or improve its products. Google may keep them for a limited time only to detect misuse and meet legal requirements.
These providers process data under their own terms and privacy policies, and some of them may process it outside India. We may also disclose information if Indian law, a court or a government authority requires it.
10. What we do with your information
We use your information to run Flash and answer your requests; manage your account, plan, daily limits and payments; send you sign-up codes, receipts and important account emails; prevent abuse and keep the service secure; understand how Flash is used so we can improve it; and answer your feedback and support requests.
Our team receives an internal email when someone signs up (account number, email, state, plan), subscribes, or deletes an account. Our admin dashboard shows each account's name, email, plan, profession, sign-up date, last-seen time and usage, plus feedback and support messages. It does not show your chats.
If you join a shared plan (pool), the pool owner can see the members' email addresses and each member's share of the pool's usage. The owner cannot see your conversations.
11. How long we keep it
| Data | Kept for |
|---|---|
| Account, desktop chats, usage records, feedback, support messages, logged-in devices | Until you delete your account (or remove that device or chat yourself) |
| Payment records | Kept after account deletion, as required for accounting and tax |
| Sign-up and password-reset codes | 5 minutes |
| Web server access logs | 14 days |
| Database backups | Up to 14 days. Data you delete may remain in a backup until that backup expires |
| Voice recordings and screenshots | Not stored after your request is answered |
| Data on your phone or computer | Until you log out, delete your account, or uninstall the app |
12. Deleting your account
You can permanently delete your account from inside the app: on desktop, Settings, Security, Danger zone, Delete my account; on Android, tap your profile picture, Manage account, Delete my account. You will need to confirm with your password.
If you have an active paid subscription, cancel it before deleting your account (desktop: Settings, Billing, Cancel subscription), or email us and we will cancel it for you.
Deleting removes your account and its records from our database: chats, subjects, usage history, feedback, support messages, feature requests and logged-in devices. On Android, the app also deletes what it stored on your phone. Payment records are kept as described above, and backups expire within 14 days. You can also email us from your account's email address and we will delete it for you.
13. Security
All connections between the apps and our servers are encrypted (HTTPS). Passwords and one-time codes are stored only as hashes. Desktop chat messages are encrypted when stored. Login and code-entry attempts are rate-limited, each account has a device limit, and logging in on a new device beyond that limit needs a code sent to your email. No system is perfectly secure; if a breach affects your personal data, we will inform you and the authorities as required by law.
14. Your rights
Under India's Digital Personal Data Protection Act, 2023, you can:
- ask what personal data we hold about you and how we use it,
- ask us to correct or complete it,
- ask us to delete it, or delete your account yourself,
- withdraw consent by stopping use and deleting your account (this does not affect what we did before),
- nominate someone to exercise these rights if you die or become unable to,
- raise a complaint with us and, if we do not resolve it, with the Data Protection Board of India.
To use any of these rights, email us at the address below. We will reply within 30 days.
15. Children
Flash is intended for users aged 18 and over. If you are under 18, you may use Flash only with the consent and supervision of a parent or legal guardian. We do not verify the age of users. If you believe a child has given us personal data without that consent, contact us and we will delete it.
16. Changes to this policy
When we change this policy we will update the effective date above. For significant changes, such as sending your data to a new kind of service, we will tell you in the app or by email before the change takes effect.
17. Contact and grievance officer
Grievance Officer: Gaurang Taunk, DRS Studios, Ahmedabad, Gujarat, India
Email: flash.dhruvrajstudios@gmail.com
You can also use the Support tab in the desktop app (Settings, Support).