Privacy Policy
Last updated: 4 November 2026
This policy explains which personal data the Flagg app (iPhone and Android) and the getflagg.com website process, why, for how long, who it is shared with and what your rights are. It applies under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.
- We do not sell your data and show no targeted advertising.
- Your location is rounded to about 1 km; other members never know your exact address.
- Your exact date of birth stays private: other members only see the month and year.
- Religion is entirely optional: it is only shown and filterable if you turn it on yourself.
- You can delete your account at any time from within the app.
1. Data controller
Benjamin Taieb, sole trader, 11 rue Jacques Duchesne, 75019 Paris, France — SIRET 528 074 370 00032.
Contact for any question about your data: privacy@getflagg.com.
2. The data we process
Data you give us
- Account: email address, password (stored hashed, we never see it), or the identifier provided by Apple or Google if you use “Sign in with Apple” or “Sign in with Google”. With Apple, you may hide your email: we then receive a relay address.
- Profile: first name, date of birth (to check that you are at least 18), gender (optional), photos, bio, job and company (optional), interests, languages, what you are looking for on Flagg (professional network, outings, friendships…), your community (country of origin and flag) and your status (“I live here”, “I'm here”, “I'm coming here from … to …”).
- Religion (optional): see section 3.
- Content: Wall posts and photos, tags, likes, comments, contact requests (“Say hello”) and their short note, private messages, “Coffee break” invitations.
- Reports and correspondence: content of your reports, reasons, and emails you send us.
Data generated when you use the app
- Approximate location: if you allow it, your location is rounded to about 1 km before being stored. It is used to show you nearby members of your community, with an approximate distance only.
- Notification tokens: a technical identifier provided by Apple (APNs) or Google (Firebase Cloud Messaging) to send you notifications, if you accept them.
- Subscription: if you subscribe to a paid plan, your subscription status (active, expired) and a purchase identifier. Payment itself is handled by Apple or Google: we never see your card.
- Crash reports: when the app crashes, a technical report (device model, OS and app version, error trace). These reports contain neither your name, nor your email, nor your IP address.
- Blocked members list and preferences (language, filters, notifications).
The getflagg.com website sets no cookies and uses no analytics or tracking tools. Our host keeps technical logs (IP address, requested page) for security purposes, for a short period.
3. Religion: sensitive data, based on explicit consent
Religion is a “special category of data” under Article 9 GDPR. On Flagg:
- it is entirely optional: you can use the whole app without ever entering it;
- it is only stored if you choose it yourself, and it is shown on your profile and usable in other members' filters only if you turn that option on;
- the legal basis is your explicit consent (Article 9(2)(a) GDPR), given when you turn the option on;
- you can remove or hide it at any time in “Edit my profile”: it is then erased from our servers or hidden, as you choose;
- it is never used for advertising, never sold and never passed on to third parties.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
4. Why we use your data (purposes and legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your account, show your profile to your community, the Wall, contact requests, messaging, Coffee break, travel mode | Performance of the contract (the Terms of Use) |
| Check that you are at least 18 | Performance of the contract and legitimate interest (protection of minors) |
| Show nearby members based on your rounded location | Consent (location permission, can be withdrawn at any time) |
| Show and filter religion | Explicit consent (Art. 9(2)(a)) |
| Send notifications | Consent (notification permission) |
| Translate a message or post when you ask | Performance of the contract |
| Manage your subscription | Performance of the contract |
| Moderation, fighting abuse, fraud and illegal content, member safety | Legitimate interest and legal obligations |
| Fix crashes and improve stability | Legitimate interest |
| Answer your requests and those of authorities | Legal obligation and legitimate interest |
We make no automated decisions with legal effects on you. We do no advertising profiling.
5. Who sees your data
- Other members see your profile: first name, photos, age calculated from your month and year of birth, community, status, bio, and the optional information you chose to fill in (religion only if you turned it on). They see an approximate distance, never your exact location. Your posts and comments are visible to members of the community concerned. Your private messages are only visible to the person you are talking to.
- Our moderation team accesses reported content and the information needed to handle reports.
- Our processors, only to run the service (section 6).
- Authorities, when the law requires it or to protect a person in danger (in particular a minor).
6. Our processors
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, accounts, photo storage | European Union (Frankfurt, Germany) |
| Apple | Notifications (APNs), Sign in with Apple, in-app purchases | USA / worldwide |
| Notifications (Firebase Cloud Messaging), Sign in with Google, on-demand translation (Google Cloud Translation), Google Play purchases | USA / worldwide | |
| RevenueCat | Subscription status tracking | USA |
| Sentry | Crash reports | USA |
| Vercel | Hosting of the getflagg.com website | USA / global network |
For translation, only the text you ask to translate is sent to Google, at the time of the request; it is not linked to your profile. When data is transferred outside the European Union, the transfer is covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.
7. How long we keep your data
| Data | Period |
|---|---|
| Account, profile, photos, posts, comments, messages, contact requests | As long as your account exists. Erased as soon as you delete your account; backup copies are overwritten within 30 days at most. |
| Content you delete yourself (post, photo, comment) | Erased immediately (backups: 30 days at most). |
| Religion | Until you remove it or delete your account. |
| Rounded location | Replaced at each update; erased if you turn location off or delete your account. |
| Notification tokens | Until logout, refusal of notifications or account deletion. |
| Reports and moderation decisions | 1 year after the case is closed; up to 3 years for a banned account (to prevent re-registration). |
| Illegal content reported to authorities | As long as required by law or the investigation. |
| Crash reports | 90 days. |
| Emails exchanged with us | 3 years after the last exchange. |
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, to withdraw your consent at any time, and to set instructions for what happens to your data after your death.
- In the app: edit your profile, download a copy of your data (Profile → Settings → Export my data (GDPR)), delete your account (Profile → Settings → Delete my account).
- By email: privacy@getflagg.com, from the address linked to your account. We answer within one month at most.
You may also lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr, or with the data protection authority of your country of residence.
9. Phone permissions
- Location: optional, for nearby members. Can be revoked in your phone or app settings.
- Photos and camera: to add photos to your profile and posts, only the ones you choose.
- Notifications: optional.
10. Security
Traffic between the app and our servers is encrypted (HTTPS/TLS). Access to data is restricted by database-level security rules, passwords are stored hashed, and our team's access is limited to moderation and support needs. As no system is infallible, we will inform you and the CNIL of any data breach that poses a risk to you.
11. Minors
Flagg is for people aged 18 and over. We delete any account we learn belongs to a minor. See also our child safety standards.
12. Changes
We may update this policy. In case of a significant change, we will notify you in the app before it takes effect. The last update date is shown at the top of this page.
13. Contact
Questions about your data: privacy@getflagg.com. Any other question: contact@getflagg.com.
The French version of this policy prevails in case of discrepancy.