Privacy Policy
Last updated: [DATE]
**DRAFT — NOT YET REVIEWED BY COUNSEL.** This document reflects how Flare
actually works and what it actually stores. It must be reviewed by a
qualified attorney before publication. Bracketed items need completing.
---
1. Who we are
Flare is operated by Flare Inc., a corporation registered in Wyoming, United
States ("Flare", "we", "us").
Contact: [PRIVACY EMAIL ADDRESS]
Postal address: [REGISTERED ADDRESS]
This policy explains what we collect, why, who we share it with, how long we
keep it, and what control you have. It applies to the Flare mobile app, the
website at flareup.app, and everything connected to them.
---
2. Who can use Flare
Flare is for people aged 18 and over. We do not knowingly collect information
from anyone under 18. If we learn that an account belongs to someone under 18,
we terminate it and delete the associated data, except where we are required
to retain something for safety or legal reasons as described in section 8.
We collect your date of birth at signup and enforce this on our servers rather
than relying on a checkbox.
---
3. What we collect
Information you give us
Account information. Your email address, display name, username, and
profile photo.
Date of birth. Stored separately from your public profile. Only you and
our support staff can see it. It is never shown to other users.
Your confirmation that you are 18 or over, together with the date and time
you gave it.
Address. If you complete identity verification in order to host or join
public quests, the address on your identity document is added to your profile.
Only you and our support staff can see it. It is not shown to other users.
Because it must match your verified document, you cannot edit it yourself and
must contact support to change it.
Quest content. Quests you create, including titles, descriptions,
categories, cover photos, and the approximate area you set.
Messages and media. What you write in quest group chats, and any photos or
video you add to a quest's shared pool.
Location, only if you choose to share it. Location sharing inside a quest
is off by default and never automatic. When you do share, it defaults to an
approximate area rather than your exact position. You can choose to share a
precise location instead. Either way it expires automatically after 60 minutes
and is permanently deleted when the quest ends or if you are removed from it.
Support tickets and feature requests, including any photos you attach.
Reports. If you report another user, we keep what you reported, who you
reported, the reason you selected, and any detail or evidence you provided.
Information we collect automatically
IP address and device information. We log the IP address, device type,
operating system, and browser or app version associated with your activity. We
use this for security, fraud prevention, abuse investigation, and diagnosing
technical problems.
Usage information. Which features you use and how you move through the
app, so we can understand what works and improve it.
Cookies and similar technologies. See section 7.
Information from other people
Reports about you. If another user reports you, we hold that report.
Quest participation. When you join someone's quest, that is recorded
against both of you.
Information we derive
Reputation data. Your show-up rate, quest counts, reliability badge,
streak status, and Superhost progress. These are calculated from your actual
activity rather than stored as fixed values. Your show-up rate and badge are
visible to other users.
---
4. Identity verification
Before hosting or joining public quests, you must verify your identity. This
protects everyone attending.
Verification is carried out by a third-party identity verification provider.
**You upload your identity document to them, not to us. We never receive or
store your identity document.**
From a completed verification we keep only:
We keep your verified legal name because a self-declared display name is not
sufficient if a serious incident occurs and authorities need to identify
someone.
The provider handles your document under its own privacy policy. See
[PROVIDER PRIVACY POLICY LINK].
Verification is not required for quests between friends, because those people
already know each other.
---
5. Why we use your information
Legal bases, if you are in the UK, EU, or EEA
product improvement, and defending legal claims
verification
non-essential cookies and tracking. You can withdraw consent at any time.
---
6. Who we share it with
We do not sell your personal information for money. Some of the advertising
and analytics technologies described below may count as "sharing" or "selling"
under California law, and you can opt out as described in section 10.
Other users. Your display name, username, profile photo, spotlight photos,
show-up rate, reliability badge, and quest history that you choose to display.
Your date of birth, address, email, and private quest history are never shown
to other users.
Service providers who process data on our behalf:
If you receive tips, you will need a Stripe account and must accept
Stripe's own agreement. Stripe becomes an independent controller of your
information for that purpose, under its own privacy policy at
https://stripe.com/privacy
Law enforcement and legal requests. See section 11.
In a business transfer. If Flare is acquired, merged, or sells assets,
your information may transfer as part of that. We will tell you before it
becomes subject to a different privacy policy.
---
7. Cookies and tracking
We use cookies and similar technologies on flareup.app and in the app:
These cannot be turned off.
improve them.
audiences on advertising platforms.
Where required by law, we ask for your consent before setting analytics or
advertising cookies, and you can change your choice at any time through
[COOKIE SETTINGS LINK].
Your browser may also offer controls, and we honour Global Privacy Control
signals where required.
---
8. How long we keep it
Account information is kept while your account exists.
If you delete your account, it becomes invisible to everyone else
immediately and is permanently deleted after 180 days. Logging in during that
period restores it fully.
Quest messages and participation records are deleted 180 days after a
quest completes. At that point the conversation disappears from your Inbox.
Quest media: photos and video in a quest's shared pool are deleted 180
days after the quest completes, except for any photo someone has selected as a
spotlight photo. Spotlight photos remain until the person who selected them
removes them. When the last spotlight photo referencing a quest is removed,
the remaining quest data is deleted.
IP address and device logs are kept for 12 months, then deleted.
Support tickets are kept while your account exists and are deleted with
it, except as below.
Safety reports and their attachments are retained after account deletion.
This applies whether you filed the report or the report was about you. We keep
who reported whom, what was alleged, when, and any evidence provided, together
with a record of the names, usernames, and email addresses involved at the
time of deletion so the record remains meaningful.
We do this because a report may concern a serious allegation, and deleting the
evidence would mean anyone reported could erase their safety record simply by
closing their account. Our legal basis is our legitimate interest in the
safety of other users and in establishing, exercising, or defending legal
claims. This information is not deleted on request. Only Flare staff can
see it. Neither the person who reported nor the person reported can access it.
Financial records are kept as long as tax and accounting law requires,
typically seven years.
---
9. Where your information is stored
Flare operates from the United States and your information is processed there.
If you are in the UK, EU, or EEA, this means your information is transferred
outside your country. We rely on Standard Contractual Clauses or an equivalent
lawful transfer mechanism with our providers. You can request details using
the contact address above.
---
10. Your rights and choices
Everyone
If you are in the UK, EU, or EEA
You have the right to access, correct, delete, restrict processing of, object
to processing of, and receive a portable copy of your personal information,
and to withdraw consent where we rely on it. You can also complain to your
local data protection authority.
If you are in California
You have the right to know what we collect and why, to delete it, to correct
it, to opt out of its sale or sharing for cross-context behavioural
advertising, and not to be discriminated against for exercising these rights.
To opt out of sharing for advertising, use [OPT-OUT LINK] or send a Global
Privacy Control signal.
Making a request
Contact [PRIVACY EMAIL ADDRESS]. We will verify your identity before acting
and respond within the time the law requires. Some information cannot be
deleted, as described in section 8.
---
11. Law enforcement and legal requests
We require valid legal process before disclosing user information. A subpoena,
court order, warrant, or equivalent lawful request, appropriate to the
information sought.
We will tell you about a request for your information unless we are legally
prohibited from doing so, or where we believe telling you would create a risk
of harm.
We will preserve information on receipt of a valid preservation request while
legal process is obtained.
In an emergency involving a risk of death or serious physical injury, we may
disclose information without legal process where we believe in good faith it
is necessary to prevent that harm.
Requests should be sent to [LEGAL EMAIL ADDRESS].
---
12. Security
We protect your information with encryption in transit and at rest,
row-level database access controls so users can only reach their own data,
private file storage served only through short-lived signed links, and
restricted internal access.
No system is completely secure. If a breach affects your information we will
notify you and the relevant authorities as the law requires.
---
13. Changes
We may update this policy. If we make a material change we will tell you in
the app or by email before it takes effect. The date at the top shows when it
last changed.
---
14. Contact
[PRIVACY EMAIL ADDRESS]
Flare Inc., [REGISTERED ADDRESS]
You can also open a support ticket in the app under Settings.