flōw — Privacy Policy

1. Who We Are

Flow-Entertainment is the data controller for personal data processed through the App. Registered details: a sole proprietorship of Frank Jeuring, registered office Loperstraat 147, 7891 JS Klazienaveen, the Netherlands, KvK 91360811, VAT NL004885355B38. Data protection contact: privacy@flow-entertainment.com.

2. Information We Collect

• Account and profile information: name, date of birth, gender, sexual/relationship preferences, bio, photos, and other information you choose to add to your profile.
• Government-issued ID document and selfie/liveness data captured during identity verification, processed by our verification partner (see Section 5).
• Messages and media you exchange with other users. Message content is end-to-end encrypted (see Section 10) and is not readable by us in transit.
• Location data (only if you enable location features such as the live map or location-sharing on a planned date).
• Device and log data: IP address, device model, operating system, app version, crash and diagnostic logs.
• Subscription and purchase data processed by Apple App Store / Google Play and our subscription management provider (RevenueCat); we do not receive or store your card number.
• Content you submit for moderation, e.g. reports, blocked users, and support messages.

3. How We Use Your Information

• To create and operate your account and provide core App features (profiles, meet requests, chat, live map, stories, pick-a-card rewards).
• To verify that you are 18 years or older and that your account is genuine.
• To maintain safety: content moderation, fraud prevention, abuse detection, and enforcement of our Community Guidelines and Moderation & Strike Policy.
• To process subscriptions and entitlements for Premium features.
• To communicate with you about your account, safety notices, and — only with your consent — promotional messages.
• To analyse aggregated, non-identifying usage trends so we can improve the App.
• To comply with legal obligations and respond to lawful requests from authorities.

4. Legal Bases (EEA/UK users)

• Performance of a contract — to provide the App and features you request.
• Legitimate interests — safety, fraud prevention, and service improvement, balanced against your rights.
• Consent — location sharing, marketing communications, and processing of verification/biometric data under Article 9 GDPR (explicit consent is requested before any such processing).
• Legal obligation — responding to lawful requests and record-keeping duties.

5. Identity Verification

To reduce fake accounts and verify you meet our minimum age requirement, we use a third-party identity verification provider (Didit) that requires a scan of a government-issued ID document and a live selfie/liveness check. Your ID document and biometric data are processed directly by our verification partner and are not stored on our own servers — we receive only the verification outcome (pass/fail and a session reference). The document and biometric comparison are handled by our verification partner under its own data protection safeguards and deleted from their systems in line with their retention schedule.

This verification is carried out solely to confirm that you are the person shown on your document and that you meet our minimum age requirement; it is not used to identify you against any external database. The verification decision is made automatically. If your verification fails and you believe this is a mistake, you can request a human review — see Section 6.

6. Content Moderation and Automated Decisions

To keep the App safe, some decisions are made by automated systems.

Photo screening: every photo you upload — profile photos, story images, and photos you send in chat — is automatically screened before it becomes visible to anyone else. This screening is performed by Anthropic's Claude AI, our third-party content-moderation provider, which checks for content such as child sexual abuse material or apparent minors in a sexual context, explicit nudity, and graphic violence. The check runs immediately after upload; photos that fail are removed and never appear on your profile or in chat. Our moderation provider receives only the image itself — never your name, email address, or other account details.

Optional AI writing assistant: flōw offers an optional AI assistant that can help draft or improve your profile bio. It generates text only when you ask it to and does not make any decision about you. We do not use emotion-recognition technology, and we do not use AI profiling to rank or match users based on inferred personal characteristics.

Human review of automated decisions: because an automated system can occasionally be wrong, you have the right to a human review of a decision that significantly affects you — for example a rejected photo or a failed identity verification. To request one, contact support@flow-entertainment.com or use in-app support, and a member of our team will review the decision.

When you report another user, our app automatically attaches a snapshot of the reported content (such as their profile details and photos, or the recent messages in a reported conversation) to your report. This snapshot is captured on your own device at the moment you submit the report and is visible only to our moderation team for the purpose of reviewing your report — never to other users. We cannot decrypt other users' conversations in bulk or on demand; the only message content our moderation team sees is what a user has chosen to include in a report or in an in-app support conversation.

7. Sharing Your Information

• We do not sell your personal data.
• Service providers acting on our behalf: Supabase (database/hosting), our identity-verification partner (Didit), our content-moderation provider (Anthropic), RevenueCat and the Apple/Google app stores (billing), crash/analytics tooling, and customer-support tooling.
• Advertising partners: Google AdMob and, via mediation, Meta Audience Network — see Section 8, Advertising, for what they collect and how to opt out of personalized ads.
• Other users see the profile information, photos, and content you choose to share, and any messages you send them.
• Law enforcement or regulators, where required by law or to protect the rights, property, or safety of flōw, our users, or the public.
• In connection with a merger, acquisition, or asset sale, subject to this Policy continuing to apply to your data.

8. Advertising

Free-tier users see advertising served through Google AdMob, which may use mediation to serve ads from other ad networks, including Meta Audience Network. These partners may collect and use advertising identifiers (Android Advertising ID / Apple IDFA), coarse or precise device and usage data, and ad interaction data (impressions, clicks) to select and measure ads. On iOS, we request App Tracking Transparency (ATT) permission before any tracking-enabled ad request is made; if you decline, you are served non-personalized ads instead. Premium subscribers do not see ads.

9. International Transfers

Where personal data is transferred outside the EEA/UK, we rely on adequacy decisions or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Security

Direct messages are protected with end-to-end encryption using elliptic-curve key exchange (X25519), authenticated encryption (XChaCha20-Poly1305), and HKDF-SHA256 key derivation, so message content cannot be read by us in transit or at rest. See our Data Security Policy for further detail.

11. Data Retention

We retain personal data for as long as your account is active and as needed to provide the App, comply with legal obligations, resolve disputes, and enforce agreements. Accounts inactive for 24 consecutive months are deleted, subject to any longer retention required by law. See our Data Retention Policy and Data Deletion & Portability Policy for details.

12. Your Rights

• Access a copy of your personal data.
• Correct inaccurate or incomplete data.
• Delete your account and associated data.
• Receive your data in a portable, machine-readable format.
• Object to or restrict certain processing, and withdraw consent at any time.
• Request human review of an automated decision that significantly affects you, such as a rejected photo or a failed verification (see Section 6).
• Lodge a complaint with your local data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

13. Children

The App is restricted to users aged 18 and over. We do not knowingly collect data from anyone under 18; accounts found to belong to a minor are suspended and deleted.

14. Cookies and Similar Technologies

See our separate Cookie Policy for details on the trackers and analytics identifiers used in the App and any companion website.

15. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified in-app, and continued use of the App after the effective date of an update constitutes acceptance.

16. Contact Us

Questions about this Policy or your data: privacy@flow-entertainment.com. To request a human review of an automated decision, contact support@flow-entertainment.com or use in-app support.