Privacy Policy

Effective Date: March 4, 2026 — Last Updated: March 4, 2026

1. Data Controller

The data controller responsible for your personal data is:

• Company: Stormace B.V.
• Address: Amsterdam, the Netherlands
• Email: support@flickt.app

2. What Data We Collect

2.1 Data You Provide

Data Category	Examples	Purpose
Phone number	Your mobile number	Account creation, OTP verification
Profile information	Name, date of birth, gender, bio, photos	Profile display, matching
Extended profile	Job title, company, education, height, zodiac, lifestyle choices	Profile enrichment, matching
Preferences	Interested-in gender, age range, distance, looking-for intent	Candidate filtering
Hobbies	Selected hobby categories	Matching algorithm, profile display
Photos and videos	Profile photos, feed posts, chat media	Profile display, content sharing
Messages	Chat messages, heart letters	Communication between users (end-to-end encrypted)
Location data	GPS coordinates	Distance-based matching, location sharing in chat

2.2 Data Collected Automatically

Data Category	Examples	Purpose
Device information	Device type, OS version, app version	App functionality, push notifications
FCM device token	Firebase Cloud Messaging token	Push notification delivery
Usage data	Swipes, matches, post views, interactions	Service operation, feed algorithm
Activity timestamps	Last active time, login times	Online status display
Purchase history	Subscription tier, consumable purchases	Feature access, billing

2.3 Data We Do NOT Collect

• Message content: Your messages are end-to-end encrypted. We cannot read them.
• Email address: We do not collect or require an email address.
• Social media accounts: We do not use social login.
• Contacts: We do not access your phone's contact list.
• Browsing history: We do not track your activity outside the app.

3. Third-Party Services

We share limited data with trusted third-party service providers who process data on our behalf:

Provider	Data Shared	Purpose
Twilio	Phone number	SMS delivery for OTP verification
Firebase (Google)	Device token	Push notification delivery
Google Maps Platform	Location queries (proxied server-side)	Location search and map display
Azure (Microsoft)	Public post media	Content moderation (NSFW detection)
Apple App Store / Google Play Store	Purchase receipts	In-app purchase verification

All service providers are bound by data processing agreements and may only use data for the specified purposes. We do not share your data with advertisers, data brokers, or social media platforms.

4. End-to-End Encryption

Stormace uses end-to-end encryption (E2EE) for all private messages and heart letters:

• Protocol: X25519 ECDH key agreement + AES-256-GCM encryption
• Key storage: Your private encryption key is stored only on your device (in secure storage)
• Server role: The server acts as a temporary relay — messages are queued for delivery (up to 30 days) and deleted after acknowledgement
• What we can see: Message metadata (sender, recipient, timestamp, conversation ID). We cannot see message content
• Media encryption: Photos and videos shared in chat are encrypted with a per-file key before upload. The server stores opaque encrypted bytes

5. Data Retention

Data Type	Retention Period
Account data (profile, preferences)	Until account deletion + 30-day grace period
Queued messages (relay)	30 days or until delivered + 24 hours
Local messages	On your device indefinitely (you control local storage)
Encrypted chat backups	7 days on server
Feed posts	Until deleted by user or account deletion
Post view history	30 days
OTP codes	5 minutes (expiry) or until verified
Payment records	As required by tax law (up to 7 years)

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data via your profile
• Erasure: Request deletion of your data (delete your account in Settings)
• Data Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time (e.g., location, notifications) via device settings

For EU/EEA users, these rights are guaranteed under the General Data Protection Regulation (GDPR). For California residents, similar rights are provided under the CCPA/CPRA. We respond to requests within 30 days.

7. Account Deletion

You may delete your account at any time through the app (Profile → Settings → Delete Account). Upon deletion:

• Your account is deactivated immediately
• A 30-day grace period allows you to reactivate by logging back in
• After 30 days, all data is permanently and irreversibly deleted, including profile data, photos, posts, matches, and media files

8. Children's Privacy

Stormace is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If we discover that we have collected data from a user under 18, we will immediately delete their account and associated data.

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• End-to-end encryption for all private messages (X25519 + AES-256-GCM)
• Encrypted backups with PBKDF2-derived AES-256-GCM encryption
• BCrypt hashing for OTP codes (never stored in plaintext)
• JWT authentication with token rotation and expiry
• HTTPS/TLS for all data in transit
• Image compression and EXIF stripping (removing metadata from uploaded photos)
• Server-side relay cleanup (messages deleted after delivery acknowledgement)

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification at least 30 days before the effective date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, requests, or complaints:

• Email: support@flickt.app
• Company: Stormace B.V., Amsterdam, the Netherlands