GLOBAL PRIVACY POLICY

Version: 1.0.0 Effective Date: September 30, 2026 Last Updated: September 30, 2026 Jurisdiction Applicability: Global (with specific provisions for EU/EEA, UK, US/California, Turkey, and other major jurisdictions)

---

1. INTRODUCTION

Welcome to our dating and social discovery platform (the "App", "Platform", "we", "us", or "our"). We are committed to protecting your privacy and ensuring transparency about how we handle your personal data.

IMPORTANT NOTICE: This Privacy Policy is based strictly on the actual technical infrastructure of our App. We do not claim to offer features (such as end-to-end encryption) that are not currently implemented in our code. By using our App, you acknowledge the data practices exactly as described herein.

2. SCOPE AND DEFINITIONS

This Policy applies to all users of our App globally.

"Personal Data" means any information relating to an identified or identifiable natural person.
"Sensitive Data" (or Special Category Data) includes data revealing racial or ethnic origin, political opinions, religious beliefs, biometric data for unique identification, and data concerning a person’s sex life or sexual orientation.

3. ROLES AND RESPONSIBILITIES

Depending on your jurisdiction (e.g., under the GDPR or KVKK), we act as the Data Controller (Veri Sorumlusu) for the Personal Data collected through the App. Our third-party service providers (such as Google Cloud and RevenueCat) act as our Data Processors.

4. DATA WE COLLECT

We collect data strictly necessary to provide matchmaking services, ensure platform safety, and process payments.

4.1. Data You Provide Directly

Account & Identity Data: Name, Date of Birth (used strictly to verify you are 18+ and calculate age), Gender.
Authentication Data: Email address, or authentication tokens provided by Google Sign-In or Apple Sign-In. We use Firebase Authentication to generate a unique User ID (UID).
Profile Data: Biography (Bio) text, Profile Photographs (up to 6 images).
Dating Preferences & Sensitive Data: Your "Interested In" preference. Note: By providing this, you are revealing your sexual orientation. We process this Special Category Data based exclusively on your explicit consent to provide you with relevant matches.

Direct Communications: Messages sent to other users within the App. Technical Disclosure: Messages are not* end-to-end encrypted. They are stored securely in our Google Cloud Firestore database but may be subject to automated scanning for safety (spam/abuse) and may be accessed by authorized administrators in response to user reports or legal obligations.

4.2. Automatically Collected Data

Location Data: We request access to your device's precise GPS location. This is converted into geohashes (via GeoFlutterFire) to calculate distances between users and enable the core matchmaking feature. Without location access, the App cannot function.
Device & Technical Information: Device model, operating system version, unique device identifiers, IP address, and App version (collected via `device_info_plus`).
Usage & Analytics Data: Your interactions with the App, including swipes (likes/passes), matches, blocks, and reports (collected via Firebase Analytics).
Crash & Performance Data: Automated crash logs and stack traces (collected via Firebase Crashlytics) to diagnose technical issues.

4.3. Data from Third Parties

Financial & Subscription Data: If you purchase a premium feature or coins, the transaction is processed entirely by Apple (App Store) or Google (Play Store). We do not collect or store your credit card details. We only receive purchase state and subscription validation tokens via RevenueCat.

5. PURPOSES OF PROCESSING AND LEGAL BASES

We process your Personal Data based on the following legal grounds (under GDPR, KVKK, and equivalent frameworks):

6. DATA RETENTION, DELETION, AND "EVIDENCE VAULT"

Active Accounts: We retain your data for as long as your account is active.

Account Deletion: When you request account deletion within the App, we initiate a process to remove your Authentication profile. Technical Limitation Notice:* Complete cascading deletion of your Firestore messages, matches, and Firebase Storage photos may take up to 30 days due to backup cycles and database architecture.

The "Evidence Vault" (Moderation Retention): If you are reported by another user, or our automated systems detect potentially illegal media (e.g., suspected Child Sexual Abuse Material - CSAM, or non-consensual intimate imagery), the flagged media is copied to an isolated secure storage bucket (`evidence_vault`). This data is retained indefinitely strictly for the purpose of reporting to law enforcement (e.g., NCMEC) or defending against legal claims. It is immune to standard user deletion requests due to overriding Legal Obligations.

7. THIRD-PARTY SUBPROCESSORS AND DATA TRANSFERS

We do not sell your personal data. We share data only with the following subprocessors required to operate the App:

Google Cloud / Firebase (USA/EU): Hosting, database (Firestore), authentication, and analytics.
RevenueCat (USA): Subscription management architecture.
Google AdMob (Global): Advertising delivery network.

International Transfers: As a global platform utilizing cloud infrastructure, your data may be transferred to and processed in the United States or other countries. For users in the EU/EEA, UK, or Turkey, we rely on Standard Contractual Clauses (SCCs), UK Addendums, or adequacy decisions to ensure lawful data transfers.

8. LAW ENFORCEMENT AND EMERGENCY DISCLOSURE

We may disclose your data to courts, law enforcement, or governmental authorities if:

Required by a valid subpoena, court order, or search warrant.
We believe in good faith that disclosure is necessary to prevent imminent death or serious physical harm (Emergency Disclosure).
We are legally mandated to report specific content (e.g., suspected CSAM to the National Center for Missing & Exploited Children).

9. SECURITY MEASURES

We implement commercially reasonable security measures including HTTPS/TLS encryption in transit and Google Cloud's default encryption at rest. However, no digital platform is 100% secure.

No E2EE: We explicitly declare that private messages are not End-to-End Encrypted.
Access Control: Access to production databases is restricted to authorized administrative personnel via Role-Based Access Control (RBAC).

10. YOUR DATA SUBJECT RIGHTS

Depending on your location (e.g., GDPR, KVKK, CCPA), you have the right to:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate data.
Deletion (Right to be Forgotten): Request deletion of your account and data (subject to legal holds).
Withdraw Consent: Specifically regarding location tracking and targeted advertising (which can be adjusted in your device settings).
Data Portability: Receive your data in a structured, machine-readable format.

10.1. How to Request Account and Data Deletion

In compliance with Apple App Store and Google Play Store policies, we provide multiple ways for you to delete your account and associated personal data:

In-App Deletion: You can delete your account at any time directly within the App. Go to Profile > Settings > Account > Delete Account. This will immediately disable your profile.
Deletion via Email: If you no longer have access to the App, you can request account deletion by sending an email to support@amflint.com from the email address associated with your account. Please use the subject line "Account Deletion Request". Our support team will process your request within 14 days.

Please note that upon deletion, your data enters a 30-day grace period for legal compliance and safety reasons before being permanently purged from our servers, as detailed in Section 6.

To exercise any other data rights (such as access or correction), please contact us at support@amflint.com.

11. CHILDREN'S PRIVACY

The App is strictly restricted to individuals who are 18 years of age or older. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that a minor has bypassed our age-gating mechanisms, we will immediately suspend the account and delete the associated data, retaining only what is necessary to prevent the user from re-registering.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in our technical practices or legal obligations. We will notify you of material changes via an in-app notification or email prior to the changes taking effect.

---

Drafting Note for Counsel: This document accurately reflects the current technical capabilities of the Flutter/Firebase codebase (e.g., lack of E2EE, use of Geolocator, Firebase Auth, RevenueCat). Local counsel should review specific consumer rights phrasing based on the primary corporate entity's jurisdiction.