Privacy Policy

This Privacy Policy explains how Flirty collects, uses, shares and protects personal data when you use the Flirty mobile app, website and related services. It is written to match the app as it operates today. If a feature is not described here, you should not assume we collect data for it.

Flirty is for adults only. You must be 18 or older to use the Service.

1. Who We Are

In this Policy, “Flirty”, “we”, “us” and “our” means FLIRTY LTD, a company registered in England and Wales under company number 14409571, which operates the Flirty app and flirtyapp.com. Where UK or EU data protection law applies, we are the controller of personal data we process for the Service.

Our address is Unit 82A, James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, United Kingdom.

Privacy contact: privacy@flirtyapp.com. General support and security concerns:support@flirtyapp.com.

We have not listed a Data Protection Officer or EU representative in this Policy. If applicable law requires us to appoint one, we will publish those details before relying on them.

2. Information We Collect

We collect the information needed to create accounts, run a dating/social app, provide paid features, keep users safe, comply with law, and improve reliability.

• Account and contact data: Email address, phone number if provided, sign-in provider identifiers, user ID, date of birth or age. Used to create and secure your account, check that you are 18+, communicate with you and prevent abuse.
• Profile and public content: Display name, photos, videos, bio, prompts, interests, gender, sexual orientation or dating preferences if you choose to provide them, city/country and public activity. Used to show your profile, help other users discover you, personalize matching and discovery, and moderate content.
• Messages and interactions: Messages, media, voice notes, reactions, read receipts, flirts, likes, skips, follows, blocks, reports, profile views (we record which users viewed your profile and when), online status and monthly activity statistics (such as counts of profile views, flirts and conversations). Used to deliver conversations, show app activity, prevent spam and abuse, and investigate reports.
• Location data: Approximate device location, coarse city/country, geohash or travel-mode location. The iOS privacy manifest currently lists precise and coarse location because device permissions and platform SDKs may expose those categories. Used for nearby discovery, local content, fraud prevention and account security.
• Device, app and security data: Device model, OS, app version, Firebase installation ID, push token, App Check token, IP address, IP-derived location label, hashed IP, session records, crash and performance data where enabled. Used to operate the app, keep sessions secure, diagnose bugs, prevent fraud and stop automated abuse.
• Purchases: Product ID, entitlement state, renewal status, purchase token and billing country from Apple, Google and RevenueCat. Used to provide paid features, handle subscription status and respond to support requests.
• Advertising and analytics data: Ad identifiers or app/device identifiers where allowed, ad interactions, usage events, screen views and consent choices. Used to show ads on free tiers, measure performance, understand feature use and respect consent settings.
• Support, legal and safety records: Support messages, report details, evidence files, moderation decisions, appeals, legal requests and account enforcement history. Used to respond to you, enforce rules, comply with legal duties and protect users.

• We do not receive your full payment card number, CVV or bank account details from Apple, Google or RevenueCat.
• We do not perform background checks on users.
• Current Flirty messages are not end-to-end encrypted. Messages are protected in transit and at rest by our infrastructure providers, but authorised Flirty systems and personnel may access them where needed for delivery, support, safety, abuse prevention, legal compliance or troubleshooting.
• We do not use face recognition to identify users. If we introduce age estimation or stronger age assurance, we will update this Policy.

3. Sensitive Information

Some profile fields, such as sexual orientation, dating preferences, sex life information or similar self-described information, may be sensitive or “special category” data under UK/EU law, or sensitive personal information under some US state laws. We only ask for this data where it helps provide the dating/social features you choose to use.

Where explicit consent is legally required, we rely on your separate consent for those fields. You can change or remove the field, or withdraw consent in the app’s privacy settings. Withdrawal does not affect processing that happened before withdrawal, and we may keep limited records where needed for safety, legal claims, accounting, security or compliance.

4. How We Use Information

• Provide the app: Account, profile, discovery, chat, media, subscriptions, support and app settings. Typical UK/EU legal basis: contract.
• Safety and security: Moderation, fraud prevention, rate limits, account integrity and security logs. Typical UK/EU legal basis: legitimate interests, or legal obligation where law requires action.
• Personalization: Discovery, ranking and recommendations. Typical UK/EU legal basis: contract and legitimate interests; consent where required for a specific data type.
• Sensitive profile fields: Sexual orientation, sex-life related information or similar fields if you provide them. Typical UK/EU legal basis: explicit consent where required, plus a standard lawful basis such as contract or consent.
• Notifications, analytics and ads: Push notifications, marketing emails and optional analytics or advertising choices. Typical UK/EU legal basis: consent where required; legitimate interests for limited service messages.
• Legal and business administration: Tax, accounting, legal requests, disputes and enforcement of our terms. Typical UK/EU legal basis: legal obligation and legitimate interests.

We do not make decisions that have legal or similarly significant effects about you solely by automated means. Automated signals may help rank profiles, detect spam, prioritize reports or flag unusual activity, but account bans and serious moderation outcomes may be reviewed by people where appropriate.

5. What Other Users Can See

Other users may see the profile information and content you choose to make visible, such as your display name, age or age range, photos, videos, bio, interests, prompts, gender, city/country, story content and app interactions shown by the Service.

If you provide your sexual orientation, it is shown on your profile and used for matching. You can hide it from your profile at any time using the “Show on profile” setting or withdraw consent in Privacy Settings; we keep a record of your consent choices. Other users with an active subscription may also see that you viewed their profile, and users you interact with may see your online status. We do not publish your raw date of birth, email address, precise coordinates, authentication identifiers or payment details to the public profile collection.

Messages are visible to you, the recipient, and to Flirty only as needed to operate, secure, moderate and support the Service. A recipient may keep copies of messages or media you send them.

6. Advertising, Analytics and Tracking

Free versions of the app may show advertising through Google AdMob and related consent tools, including Google User Messaging Platform (UMP). Paid tiers may reduce or remove ads where the app says so. Our ad behavior depends on your region. In the UK and the EEA, where UK GDPR or the GDPR applies, ad personalization is gated by your UMP choice: if you accept personalization, the ad request is sent in personalized form; if you decline, withdraw or are not asked, the request is sent as non-personalized. Outside those regions (including in the United States), every ad request is sent as non-personalized and under Restricted Data Processing using the AdMob “rdp=1” signal, so Google must treat the request as not a sale or share under US state privacy laws.

Firebase Analytics, Crashlytics and Performance Monitoring may be used to understand app use, crashes and reliability. These follow the same regional split as ad requests. In the UK and the EEA they are off by default and only collect data after you opt in through the in-app telemetry controls in Privacy Settings. Outside those regions they are on by default and you can turn them off at any time using the same controls. Where we cannot determine your region, we treat you as if UK/EU rules apply and collect nothing until you opt in. Some essential Firebase, authentication, messaging, security and App Check processing is required for the app to function and is not optional. Google Consent Mode v2 ad signals (ad storage, ad user data, ad personalization) follow the same regional logic as ad requests: enabled only for EU/UK users who consent through UMP, off for everyone else.

We do not sell personal data for money. Because every ad request from non-GDPR regions is sent as non-personalized and under Restricted Data Processing, we do not consider our advertising practices a “sale”, “share” or cross-context behavioral advertising under US state privacy laws such as CPRA, and the app therefore does not provide a per-user “Do Not Sell or Share” toggle. If we change those defaults — for example, by enabling personalized ads in a US state or any other practice that would qualify as sale, share or targeted advertising — we will update this Policy and provide the legally required opt-out controls before that change takes effect. You can also exercise device-level controls (such as iOS App Tracking Transparency or Android Limit Ad Tracking) and app-store privacy controls, or contactprivacy@flirtyapp.com.

7. Who We Share Information With

• Other users, when you make profile content visible, send messages, react, report, follow, match or otherwise interact through the Service.
• Service providers that host or run the app, including Firebase/Google Cloud, Cloud Functions, Cloud Firestore, Cloud Storage, Firebase Authentication, Firebase Cloud Messaging, App Check, analytics/crash/performance services, RevenueCat, Apple, Google Play, api.video, SendGrid or other transactional-email providers, maps/geocoding providers, IP-geolocation providers (currently ipapi.co and ipwho.is, which receive your IP address to derive an approximate city/country for session security), content-moderation providers (currently Sightengine, which analyses photos and videos you upload to detect content that breaks our rules) and advertising/consent SDK providers.
• Sign-in providers you choose to use, such as Google, Apple or Facebook (Meta). If you sign in with one of these providers, they process the sign-in under their own privacy policies, and their SDKs may be included in the app.
• Moderation, safety, legal and professional advisers where needed to investigate reports, handle disputes, enforce our terms or protect rights and safety.
• Law enforcement, regulators, courts or other authorities where we believe disclosure is legally required or necessary to prevent harm, fraud, abuse or illegal activity.
• A buyer, successor or adviser if we sell, merge, reorganize or transfer all or part of the business.

We require service providers to process personal data only for the services they provide to us, unless they act as independent controllers under their own terms, such as app stores or payment platforms.

8. Retention

We keep personal data for as long as needed for the purposes described in this Policy, including as long as your account is active, as long as needed to provide the Service, and as long as needed for legal, safety, tax, accounting, dispute, fraud-prevention or security reasons.

• Account deletion normally starts with a 48-hour deactivation/grace period, and we email you a confirmation when deletion is requested. During that period, you can restore the account by logging back in. If you want a temporary break instead, use the pause (“Take a Break”) feature, which deactivates your account without deleting it.
• After the grace period, we delete or anonymize account data from active systems unless we need to keep limited records for legal, safety, fraud-prevention, chargeback, tax, accounting or dispute purposes.
• Messages and content already sent to another user may remain in that user’s conversation or device copy. We may replace your profile identity with a deleted-user label where technically possible.
• Data export links are temporary and may expire after a short period, such as 7 days.
• Backups are overwritten on a rolling schedule. We do not restore deleted data from backups except for disaster recovery, security or legal needs.

9. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict or object to the use of your personal data, withdraw consent, opt out of sale/share or targeted advertising, limit use of sensitive personal information, and appeal or complain to a regulator. We will not discriminate against you for exercising privacy rights.

You can use in-app controls for profile edits, privacy choices, ad/analytics choices where available, blocking, reporting, account deletion and self-service data export. Self-service exports provide a portable copy of common account data. Broader access requests may require support review and identity verification.

To make a request, email privacy@flirtyapp.com. We may need to verify your identity and may refuse or limit a request where the law allows, such as to protect another user’s privacy, preserve safety records, comply with law or prevent fraud.

If you think we have got something wrong with your data, tell us first — we would rather put it right. You can also take it up with the UK Information Commissioner’s Office (ICO), the regulator for data protection in the UK, atico.org.uk or on 0303 123 1113. If you are in the EEA, you can go to your local data protection authority instead.

10. International Transfers

We and our providers may process personal data in the United Kingdom, United States, European Economic Area and other countries. Where UK or EU transfer rules apply, we use safeguards such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum and security measures appropriate to the transfer.

11. Security

We use technical and organizational measures designed to protect personal data, including transport encryption, infrastructure access controls, Firebase and cloud security controls, App Check, rate limits, monitoring, restricted administrative access and deletion workflows. No online service is perfectly secure, and you should use care when sharing sensitive content with other users.

12. Children

Flirty is not for anyone under 18. We do not knowingly allow minors to create accounts. If you believe a minor is using Flirty, report the account in the app or contact safety support. If we reasonably determine an account belongs to a minor, we will remove it.

13. Changes

We may update this Policy when the app, law or our providers change. If changes are material, we will provide notice in the app, by email or through the website where required. The effective date shows when this version applies.