Privacy Policy
Last updated: September 27, 2026
Contents
- 1. Who is responsible for your data
- 2. What data we collect
- 3. Special categories of data
- 4. Why we use data and on what legal basis
- 5. Who else receives data
- 6. International data transfers
- 7. How long we keep data
- 8. What happens when you delete your account
- 9. Your rights
- 10. Security
- 11. Age
- 12. Cookies and browser storage
- 13. Changes
We take privacy seriously: Flirra is designed to store as little about you as possible, for as short a time as possible. This page explains what data we collect, why, how long we keep it and what rights you have. This document has been prepared in line with Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
Data controller (veri sorumlusu / controller): The Flirra service (flirra.app). The operator’s full legal name and address will be published on this page before the public launch.
For any questions about your data, email hello@flirra.app with the subject "Data."
2. What data we collect
Account data
- email and password (the password is stored only as a secure hash; we cannot see it);
- interface language, sign-up date, time of your last visit.
Profile and ad data (what you choose to provide)
- who you are (woman, man, couple, other), age, height;
- who you are looking for, sexuality, turn-ons (interests), languages;
- your ad text and photos.
Location
- If you allow it, the app sends your device's coordinates. We immediately round them to about 300 meters and store them only in that form. Other users see only a distance ("2 km") or a city, never a point on a map.
- Instead of using geolocation, you can pick your city manually.
Communications
- likes, matches, messages, stickers, photos and location pins you send in chats;
- reports and blocks.
Technical data
- IP address, device and browser type, session data (cookies), error logs;
- a push notification token, if you have turned notifications on;
- the result of the "I'm not a robot" check (Cloudflare Turnstile).
Purchases
- which features you received or bought, when and through which store. We do not receive your bank card details: payments are processed by Google Play or the App Store.
Newsletter subscription on flirra.app
- email, language, country (based on IP) and the date of consent.
3. Special categories of data
Information about your sexuality and intimate preferences belongs to the special categories of personal data (Art. 6 KVKK, Art. 9 GDPR). You provide it voluntarily, and we process it only on the basis of your explicit consent, which you give when you sign up. You can remove this information from your profile at any time or withdraw your consent by deleting your account.
The mere fact that you use a dating service may also be considered sensitive information. That is why we do not show your profile to search engines and do not share information about you with advertising networks.
4. Why we use data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create your account, show your ad, tailor the Feed by distance and filters, deliver likes and messages | performance of a contract (the Terms) |
| Process information about your sexuality and intimate preferences | your explicit consent |
| Determine distance using geolocation | your consent (device permission) |
| Send push notifications | your consent (you can turn them off at any time) |
| Protection against spam, bots and fraud; handling reports; user safety | our legitimate interest and compliance with the law |
| Meeting legal requirements, responding to lawful requests from authorities | compliance with a legal obligation |
| Emails about the launch and news (website subscription) | your consent |
We do not use your data for targeted advertising, we do not sell it, and we do not make automated decisions about you that have legal effects. Automated filters help moderators find spam and prohibited content, but any account ban is confirmed by a human.
5. Who else receives data
We share data only with those without whom the Service cannot work:
- Cloudflare, Inc.: hosting, database, photo storage, protection against attacks and bots (Turnstile), delivery of email to our address;
- Google LLC (Firebase Cloud Messaging): delivery of push notifications on Android; notifications contain no photos of you and no information about your sexuality;
- Apple Inc.: delivery of notifications on iPhone, once the iOS app is released;
- Google Play / App Store: payments, once paid features are introduced;
- browser push notification services (Google, Mozilla, Apple, Microsoft): if you have turned on notifications on the website;
- government authorities: only upon a lawful request or to protect people's life and health.
Other users see what you publish: your ad, photos, profile details, approximate distance and your "online" indicator (which you can hide with the invisibility hat), and the people you chat with see your messages.
6. International data transfers
Our providers' servers (Cloudflare, Google, Apple) are located in various countries, including outside Türkiye and the EU, for example in the United States. Transfers take place using standard contractual clauses (for KVKK, standard contracts notified to the Personal Data Protection Authority; for GDPR, the EU Standard Contractual Clauses) and other safeguards provided by law.
7. How long we keep data
| Data | Retention period |
|---|---|
| Likes | visible for 24 hours, deleted from the database after 7 days |
| Chats, messages and photos in them | deleted 24 hours after the chat opens unless you both saved the chat; "view once" photos are destroyed after viewing |
| Saved chats | until one of you deletes the chat or their account |
| Ad, photos, profile | until you delete them or delete your account |
| Sign-in session | 30 days |
| Technical logs | up to 30 days |
| Reports and violation data | up to 2 years after review, or longer if needed for an investigation or required by law |
| Purchase records | as long as tax and accounting laws require (usually up to 10 years) |
| Newsletter subscription | until you unsubscribe |
8. What happens when you delete your account
When you delete your account, we immediately:
- delete your ad, all photos, likes, sessions and push tokens;
- erase your email, password, location, and information about your sexuality and turn-ons;
- close all your chats; the messages in them are deleted along with the chat.
What remains is an anonymized record with no contact details, so that links in the database keep working, plus any violation data. Backups are overwritten within 30 days. Details are on the Delete account page.
9. Your rights
Under Art. 11 KVKK and Chapter III GDPR, you have the right to:
- find out whether we process your data and get a copy of it;
- correct inaccurate data (most of it you can correct directly in your profile);
- request deletion of your data (or delete your account yourself);
- restrict processing or object to it;
- receive your data in a machine-readable format (portability);
- withdraw your consent at any time; this does not affect the lawfulness of processing before withdrawal;
- find out who your data has been shared with, including abroad;
- claim compensation for damage caused by unlawful processing.
Email hello@flirra.app from the address registered to your account. We will respond free of charge and within 30 days at the latest. You can also file a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr) or with the data protection supervisory authority of your country in the EU.
10. Security
- The connection is always encrypted (HTTPS).
- Passwords are stored as salted PBKDF2 hashes.
- Only a limited number of people who need it for their work have access to the database.
- Sign-in is protected against password guessing and bots.
No system is completely secure. If a breach occurs that could harm you, we will notify you and the supervisory authority within the time limits set by law.
11. Age
Flirra is only for people aged 18 and over. We do not knowingly collect data from minors. If we learn that an account belongs to someone under 18, we will delete it. You can report this to hello@flirra.app.
12. Cookies and browser storage
We use only essential cookies and browser storage:
- a session cookie to keep you signed in;
- settings: language, layout (desktop or mobile), filters;
- Cloudflare cookies for bot protection.
We do not use any third-party advertising or analytics cookies, so no consent banner is needed.
13. Changes
If we change this Policy, the new version will appear on this page with a new date. We will notify you of material changes in the Service or by email.