Last updated: 2026-05-25

South African Information Regulator Information-Officer registration: 2026-019452 (Stefan Hodgman trading as Gigateq, sole proprietor, registered 2026-05-25). PAIA Manual available at https://gigateq.github.io/fluxbit/paia/.

FluxBit is a Windows network speed monitor. This notice describes what data FluxBit observes on your device, what data is transmitted off your device (and when), and your rights.

Short version

• No background telemetry. FluxBit does not collect analytics, does not send crash reports, and contains no marketing or third-party SDKs.
• The only off-device transmission is the speed test, and only when you (or the optional scheduled tester) explicitly run one. The speed test connects to FluxBit’s own OpenSpeedTest server; details below.
• No accounts. There is no FluxBit account, no login, no user identifier.
• Your data stays on your device. Network history, peer lists, gateway capacity records, and configuration are stored locally in SQLite at %LOCALAPPDATA%\FluxBit\.

What FluxBit observes locally

FluxBit’s network monitoring uses Event Tracing for Windows (ETW), or as a fallback the Windows interface-totals table (iftable), to observe TCP and UDP traffic produced by the Windows kernel. The ETW path captures:

• Remote IP addresses of TCP/UDP flows on your machine
• Per-flow byte counters (sent and received)
• Local LAN devices discovered via ARP-table inspection and via multicast HELLO/STATS messages on 239.255.42.99:19999 (LAN-scope only, TTL 1)
• Process IDs are read from each ETW event but are not currently resolved to process names or stored in the database

The ETW provider used is Microsoft-Windows-TCPIP. ETW captures system-wide. On multi-user Windows installations (RDP servers, kiosks, shared workstations) this means FluxBit observes the remote IPs and byte counts of every signed-in user’s connections, not only the user running FluxBit. If this is not appropriate for your environment, do not install FluxBit or use the iftable fallback backend (which observes only per- interface totals and does not see per-flow remote IPs).

ETW capture also continues while the screen is locked or another user is fast-switched, until FluxBit exits.

This locally-observed data is used for display and history. It is not transmitted anywhere by FluxBit.

LAN peer discovery (off by default in Public networks)

When peer discovery is enabled, FluxBit broadcasts a JSON message on the local-network multicast group every 30 seconds. Each broadcast contains:

• Your machine’s hostname
• The MAC address of the network interface FluxBit chose for discovery
• A randomly-generated peer ID for this install
• A self-chosen friendly name (only if you set one)
• The current observed download and upload speeds

Other FluxBit instances on the same LAN receive these messages. The broadcast does not leave the local subnet (multicast TTL 1).

FluxBit additionally inspects the local ARP table and performs reverse DNS lookups on the IP addresses it finds, in order to populate the “local devices” list. The reverse-DNS lookup uses the system resolver.

If you do not want any of this, disable peer discovery in the FluxBit settings. We recommend disabling peer discovery on networks classified by Windows as Public (coffee shop / airport / hotel WiFi).

Speed tests (the one off-device transmission)

When you start a speed test - either manually or via the optional scheduled tester - FluxBit’s client makes HTTP requests to FluxBit’s own server, currently at:

• http://84.8.137.101/ (Oracle Cloud Infrastructure A1 ARM instance, region af-johannesburg-1 (South Africa))

We are in the process of moving this to https://speedtest.fluxbit.app with Let’s Encrypt TLS. Until that migration completes, speed-test traffic crosses the public Internet in cleartext - your ISP and any on-path observer can see that you are running a FluxBit speed test.

The server runs OpenSpeedTest (MIT-licensed) behind Traefik. It receives:

• Your public IP address (visible to any HTTP server you contact)
• Your User-Agent string (the Go HTTP client default)
• The bytes of the test payload (zeros or random fill, no personal data)

OpenSpeedTest’s “save result” feature is disabled and the IP-info lookup is disabled. The Traefik access log is disabled. The OpenSpeedTest nginx container’s stdout logging is rate-limited and not persisted to disk.

The server is operated by FluxBit’s licensor in their capacity as a data controller. The server is physically located in South Africa.

• For users in South Africa (the only market FluxBit is currently sold in), this is local processing - your public IP does not leave the country during a speed test.
• For users elsewhere who have nonetheless obtained FluxBit (sideload, travel, future market expansion), this constitutes an international transfer. The applicable transfer mechanism (EU SCCs, UK IDTA, or migration to a local-region replica) will be put in place before FluxBit is offered in the relevant market on the Microsoft Store.

You can override the speed-test server URL in settings to point at your own self-hosted OpenSpeedTest endpoint. FluxBit does not transmit any identifier, licence key, or other personal data along with the test request beyond what is necessary for the HTTP connection itself.

FluxBit explicitly does NOT use Speedtest.net (Ookla LLC) or Cloudflare’s internal speed-test endpoints. Those services have ambiguous or restrictive commercial-use terms; FluxBit removed all dependencies on them.

Local files

The following local files may be created by FluxBit on your device:

• %LOCALAPPDATA%\FluxBit\fluxbit.db - SQLite history database. Schema notes: the samples table holds per-minute throughput points and is pruned to a rolling 7-day window. The gateway_capacity table records, for each gateway you connect through, the gateway MAC address, the Wi-Fi SSID (if any), and the highest observed download/upload capacity seen on that gateway. Entries are kept until you delete them or uninstall FluxBit.
• %LOCALAPPDATA%\FluxBit\fluxbit.log - rolling debug log
• %LOCALAPPDATA%\FluxBit\config.json - user settings
• A speed-test log file when a speed test runs. (We are moving this to %LOCALAPPDATA%\FluxBit\ - older versions write it to the working directory.)

To remove all FluxBit data, uninstall FluxBit and delete the %LOCALAPPDATA%\FluxBit\ directory.

Controller and contact

The data controller for the speed-test server, the support mailboxes, and any personal data FluxBit Ltd holds about you (e.g. a refund-request email exchange) is the FluxBit licensor identified in the EULA shipped with the software (see LICENSE and installer\License.rtf in your install directory). A geographic postal address is available on the checkout page and on request from legal@fluxbit.app.

Contact:

• Privacy questions and data-subject-rights requests: privacy@fluxbit.app
• Refund requests: refunds@fluxbit.app
• General support: support@fluxbit.app
• IP / copyright notices: legal@fluxbit.app
• Formal PAIA requests: see https://gigateq.github.io/fluxbit/paia/ for the full procedure, prescribed Form C, and applicable fees.

If you are in South Africa, you have the right to lodge a complaint with the Information Regulator (https://inforegulator.org.za) under POPIA s.74. If you are in the UK or EU, you have the right to lodge a complaint with your supervisory authority - in the UK that is the Information Commissioner’s Office (ico.org.uk); in an EU member state it is the national data-protection authority of your habitual residence.

Legal basis (POPIA, GDPR / UK GDPR)

For users in South Africa, processing is governed by the Protection of Personal Information Act 4 of 2013 (POPIA). FluxBit’s licensor is the “responsible party” for any personal information FluxBit Ltd processes about you (refund and support emails, and the public IP your client sends to the speed-test server during a speed test). The lawful grounds for processing under POPIA s.11 are: performance of a contract you have entered into (the paid licence), the licensor’s legitimate interests (operating the speed-test service and responding to support requests), and your consent (where you initiate optional features such as peer discovery).

For users outside South Africa (EU, UK, or elsewhere), to the extent the General Data Protection Regulation (EU 2016/679) or the UK GDPR applies, we process personal data on the following bases:

• Local-device monitoring (your own machine’s network metadata, MACs of devices on your LAN, hostnames resolved via reverse DNS): legitimate interest (Art. 6(1)(f) UK/EU GDPR) - the legitimate interest is that this is the core function of the product you have chosen to install, and the processing happens entirely on your own device.
• Speed-test requests to the FluxBit server: performance of the contract you entered into when you bought the FluxBit licence (Art. 6(1)(b)) - the speed-test feature is a paid feature.
• Refund and support emails: legitimate interest, contract performance, and where applicable compliance with consumer-protection law (Art. 6(1)(c)).

Where FluxBit processes data about other people on your LAN (peer hostnames, MACs, IPs), you are the controller of that data; FluxBit is the software you are using to perform that processing. The licensor does not receive any of that data.

We do not rely on your “consent” as a legal basis, because consent under GDPR must be freely given, specific, informed, and unambiguous, and clicking “Install” or “I accept the EULA” is not specific consent to processing in the GDPR sense. If you object to legitimate-interest processing, you can disable peer discovery and/or uninstall FluxBit.

Your rights

You have the rights of access, rectification, erasure, restriction, objection, and portability under UK GDPR / EU GDPR.

For local-device data:

• Access / portability: the SQLite file at %LOCALAPPDATA%\FluxBit\fluxbit.db is the entire data set, and SQLite is an open and well-documented format. You may copy or open the file with any SQLite tool.
• Erasure: uninstall FluxBit and delete the %LOCALAPPDATA%\FluxBit\ directory.

For data held by FluxBit’s licensor (refund-request emails, support correspondence): email privacy@fluxbit.app with your request. We will respond within one month under Art. 12(3) GDPR.

We do not sell or share your personal information for advertising purposes, as those terms are defined under the CCPA / CPRA, GDPR, or any other privacy regime.

Children

FluxBit is a Windows network-administration tool and is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us (through a support email, for example), contact privacy@fluxbit.app and we will delete it.

Changes to this notice

If this notice changes, the “Last updated” date above will change. Where the change is material - for example, a new category of data, a new recipient, or a change of data-controller identity - we will summarise the change at the top of this document, and (where we hold an email address for you) we will email the address you used.

A note on what changed in this version

The previous version of this notice asserted “no telemetry… does not call any FluxBit-operated server” in the short summary, then a few paragraphs later described the speed-test reachout to the FluxBit server. That was an inadvertent contradiction. This version reflects the arrangement accurately: the speed test is the one feature that transmits data off-device, it happens only when you start a test, and FluxBit does nothing else off-device in the background.