Privacy Policy

1Who we are & scope

Flick'd Up is a friends-only, invite-based iOS app for capturing a shared night out with your crew and reliving it together the next morning. This Policy covers the Flick'd Up app and this website. It does not cover third-party services you may reach through the Service, which have their own privacy practices.

The operator is the "data controller" (or the "business," under U.S. state privacy laws) responsible for your information. You can reach us any time at dpulido@flickdup.com.

2Age requirements

You must be at least 13 years old to use Flick'd Up. The Service is not directed to and may not be used by anyone under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will block the account and delete the associated data. If you believe a child under 13 is using the Service, contact us at dpulido@flickdup.com.

If you are between 13 and 17 years old, you represent that you have permission from a parent or legal guardian to use the Service, and that your parent or guardian has reviewed this Policy and our Terms on your behalf. Some features are limited for teens — see Protections for teens.

We collect your date of birth once, shortly after you first sign in, to confirm you meet the minimum age and to apply age-appropriate protections. Your date of birth is stored securely, is not shown to other users, and generally cannot be changed after it is set. If your date of birth indicates you are under 13, your account is blocked and its data is removed.

3Information we collect

Information you provide

Phone number (stored hashed)

We use your mobile phone number to create your account and sign you in, verifying it with a one-time code sent by SMS. We store your number only as an irreversible SHA-256 hash used to recognize your account and match contacts — we do not keep your phone number in readable form.

Date of birth

Collected once to confirm you meet the minimum age and to enable teen protections.

Profile information

A display name, an optional unique username (@handle), and an optional profile photo (avatar) you choose to add.

Content you capture

The photos and "moments" you create in a group — including dual-camera (front + back) captures — plus any optional caption, and the reactions and comments you add to moments.

Messages

The direct and group chat messages you send within the app, and who they are sent to. See Messages & content visibility.

Events / groups you create or join

A group name, a venue or city label you choose, timing, cover image, and who is invited or attending.

Safety reports

If you report a user, moment, message, or group, we collect your report and the reason you provide.

Email & name (only if you use social sign-in)

If you choose to sign in with Apple or Google where offered, we receive the email address and name associated with that account from Apple or Google to create or link your account.

Information collected automatically

Device & usage information

Basic technical information needed to operate the app (such as device type and a device identifier used for security and push notifications), and information generated as you use features (such as the groups you join, moments you create, and app activity).

Push notification token

If you enable notifications, your device's Apple Push Notification token, so we can send you alerts (for example, when it's your turn to capture, or when your night is ready to reveal).

Approximate location (optional)

If you allow location access, an approximate location used to suggest your city and nearby venues, and to rank nearby public events. We do not collect continuous or background GPS, and we do not store your precise device coordinates. See Location information.

Security & anti-abuse data

Hashed technical values (such as hashed device and network identifiers) used to rate-limit sign-in attempts and prevent abuse.

Information from your contacts (only if you allow it)

If you choose to use "find friends from your contacts," the app reads the phone numbers in your device contacts on your device, converts them into irreversible hashed values on your device, and sends only those hashed values to our servers to check which of your contacts already use Flick'd Up. We do not receive or store the actual phone numbers or the names from your contacts. You can decline contacts access and still use the Service. See Contacts & finding friends.

4How we use information

We use the information we collect to:

• Create and secure your account and sign you in (phone or, where offered, Apple/Google verification);
• Provide the core Service — creating groups, the timed capture window, the delayed group reveal, reactions, comments, messaging, your Memories archive, and the automatic expiry and deletion of content;
• Help you find friends who already use Flick'd Up (via the hashed-contacts feature you opt into) and let you invite others;
• Show relationship features such as friends, friend requests, and a "nights together" ranking of the people you share the most nights with;
• Send you service notifications (such as capture and reveal alerts) if you enable them;
• Maintain safety and integrity, enforce age requirements, review reports, prevent abuse, and enforce our Terms;
• Respond to your requests and communicate with you about the Service;
• Comply with legal obligations and protect our and others' rights.

Legal bases (EEA/UK users). Where the EU or UK GDPR applies, we process your information to perform our contract with you (providing the Service), based on your consent (for contacts access, location, and push notifications, which you can withdraw), for our legitimate interests (keeping the Service safe, secure, and functioning, and preventing abuse), and to comply with legal obligations.

5How your content is shared, revealed & expires

Flick'd Up is built around sharing moments within a group you are part of.

Moments you capture in a group are revealed to the other members of that group at the scheduled reveal time. Before then, the night is sealed: no one — including you — sees the full moments, and any preview is a deliberately degraded, low-resolution teaser. Reactions and comments on a moment are visible to the members of that group.

Timing. By default, a night is sealed for about 12 hours after the group starts, then unlocks to the group. A revealed night stays visible for about 24 hours and is then automatically deleted from the Service — unless you or a group member saves it to Memories. Exact timing may change as the Service evolves.

Memories. If you save a night (up to a limited number of saved nights) or an individual moment, that content — and its reactions and comments — is kept until you delete it or your account. Moments you capture are also kept in your own personal saved moments so you don't lose your own shots.

Public events. If a group is set to public, its name, city, cover image, creator's name, and how many of a viewer's friends are going may be shown to nearby people who aren't members, to help them discover and request to join. You control whether a group is public or private.

6Messages & content visibility

Flick'd Up includes direct (1:1) and group messaging with people you're connected to. You can message friends, and group chats mirror the members of a night. Blocked users cannot message you.

Messages are not end-to-end encrypted. Message content is transmitted over encrypted connections and stored on our secured servers, but we are technically able to access message content — for example, to operate the Service, respond to a valid legal request, or investigate a safety report. Do not use Flick'd Up messaging to share highly sensitive information. When you delete your account, the messages you sent are deleted from our chat records.

7Contacts & finding friends

Using your contacts is optional. If you turn it on:

• The app reads your device contacts' phone numbers on your device and hashes them (SHA-256) before anything is sent;
• Only the resulting hashed values (never the raw phone numbers, and never contact names) are sent to us, to check which are already on Flick'd Up;
• Contact names remain on your device and are used only locally to label people you might invite;
• People who aren't on Flick'd Up are shown to you only as invite suggestions — inviting them uses your device's standard share sheet and sends only invite text, not their contact details.

You can decline or revoke contacts permission any time in your device settings; the matching feature simply won't run.

8Location information

Location is optional and used only for convenience:

• If you allow it, we use an approximate device location to prefill your city and to bias venue suggestions to places near you;
• When you set up a night, venue search uses Google Places. Your typed search text and, if available, an approximate location are sent to Google to return matching venues. The Google Places request is made through our server; our Google API key is never shipped in the app.
• For nearby public-event discovery, your device's approximate location is used momentarily to rank events by distance and is not stored for that purpose.

We store the venue and city labels you choose for a group, and the coordinates of the selected venue — not your personal or precise device location. We do not track your location in the background.

Google's handling of Places requests is governed by Google's privacy policy.

9Service providers we share with

We share limited information with third-party companies that help us run the Service, only as needed to provide it, and they are not permitted to use it for their own purposes:

Twilio

Sends the SMS one-time codes used to verify your phone number.

Amazon Web Services (AWS)

Hosts our backend and stores photos and media in private storage, accessed only through short-lived signed links.

Google (Places API)

Returns venue suggestions for the search text (and optional approximate location) you provide when setting up a night.

Apple & Google (sign-in, optional)

If you use "Sign in with Apple" or Google Sign-In where offered, they verify your identity and provide your email and name.

Apple Push Notification service (APNs)

Delivers push notifications to your device if you enable them.

Error monitoring (if enabled)

A crash/error-monitoring provider may receive technical error information to keep the Service reliable. This is used for stability, not advertising or profiling.

We may also share information in the limited circumstances described below, and in connection with a business transfer (such as a merger, acquisition, or sale of assets), in which case we will require the recipient to honor this Policy or notify you of any material change.

10Legal & safety disclosures

We may access, preserve, or disclose your information if we believe in good faith that it is reasonably necessary to: comply with a law, regulation, legal process, or governmental request; enforce our Terms; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of our users, the operator, or the public — including responding to an emergency involving a risk of harm.

11What we don't do

• We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws;
• We do not serve third-party advertising in the app, and we do not use third-party advertising, marketing, or product-analytics trackers (such as ad SDKs or analytics like Firebase Analytics, Amplitude, Mixpanel, or Segment);
• We do not collect your precise GPS location or track your location in the background;
• We do not store your phone number or your contacts' phone numbers in readable form.

12Data retention

• Account information (hashed phone number, date of birth, profile) is kept while your account is active;
• Moments and revealed nights are kept only for their ephemeral window (about 12 hours sealed, then about 24 hours visible) and then automatically deleted, unless saved to Memories — in which case they are kept until you or your group delete them, or you delete your account;
• Messages are kept until you delete your account (which removes the messages you sent) or as otherwise needed to operate the Service and enforce safety;
• Hashed contact values are used to compute matches and are not retained as your contacts' phone numbers (we never have the raw numbers);
• Safety reports are retained indefinitely as moderation and safety records — an intentional exception to the ephemeral model — which may include preserving reported content that would otherwise expire;
• After you delete your account, we delete or de-identify your personal data and remove your media from storage. We may retain a one-way hashed identifier and limited de-identified records where reasonably necessary for security, to enforce bans and prevent abuse, to comply with legal obligations, and for system integrity, and backups may persist for a limited period before they age out.

13Your choices & rights

Controls in the app and on your device

• Profile: edit your display name, username, and photo in the app;
• Contacts, location & notifications: grant or revoke these permissions any time in your device settings;
• Blocking & reporting: block users and report content or behavior that violates our Terms;
• Delete your account: delete your account and associated data from within the app (Profile → Settings → Delete account), subject to the retention described above.

U.S. state privacy rights (including California)

Depending on your state, you may have the right to know or access the personal information we hold about you, to request correction or deletion, and to not be discriminated against for exercising these rights. Because we do not sell or "share" personal information for cross-context behavioral advertising, and do not use it for targeted advertising, there is no such activity to opt out of. To exercise a right, email dpulido@flickdup.com; we will verify your request using information associated with your account, and you may use an authorized agent where permitted by law.

EEA, UK & other regions

If the GDPR or a similar law applies to you, you may have rights to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your local data protection authority. To exercise these rights, contact dpulido@flickdup.com.

Do Not Track / Global Privacy Control

Because we do not track users across third-party services for advertising, we do not respond differently to browser "Do Not Track" or Global Privacy Control signals; there is no cross-site tracking to disable.

14Security

We take reasonable measures to protect your information, including transmitting data over encrypted connections; storing media in private storage accessed only via short-lived signed links; hashing your phone number and your contacts' numbers so raw numbers are not stored; rate-limiting sign-in; and protecting accounts with phone-based verification and short-lived session tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.

15Push notifications & SMS

Push notifications. If you opt in, we send push notifications for events like your capture turn opening or your night being ready to reveal. You can turn these off any time in your device settings.

SMS. We send SMS solely to deliver one-time verification codes when you sign in. These are transactional messages, not marketing. Standard message and data rates from your carrier may apply.

16Protections for teens (13–17)

Flick'd Up is designed so that interaction happens with people you are connected to. For users aged 13–17, we apply additional protections: teen accounts are excluded from public event discovery, from friend suggestions, and from contact matching, and are discoverable in search only by an exact username match — not by browsing or partial search. We do not require or store precise location, and we provide the ability to block and report. We do not show a teen's date of birth to others. We encourage parents and guardians to review this Policy and our Terms with their teen.

17International users

The Service is operated from the United States, and your information is processed in the United States. If you use the Service from outside the U.S., you understand that your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

18Third-party links & services

The Service may reference or connect to third-party services (such as Apple, Google, and Twilio). Their handling of your information is governed by their own privacy policies, and we are not responsible for their practices.

19Changes to this Policy

We may update this Policy as the Service evolves or as required by law. We will revise the "Last updated" date above and, where appropriate, provide additional notice within the app. Your continued use of the Service after a change takes effect means you accept the updated Policy.

20Contact us

Questions or requests regarding this Policy or your information:

David Pulido — Flick'd Up
Email: dpulido@flickdup.com