Your answers, never your name

Who we are

Flare is an iPhone app, a matching service run on Cloudflare, and this website. It’s operated by Colin Gillingham. In this policy “Flare”, “we” and “us” mean the people who build and operate it. You can reach us at privacy@downloadflare.app.

What we process for guests

Guests don’t create accounts. Your phone is a pseudonymous device.

Your device registration

• When you first use event features, the app proves it’s a genuine copy of Flare on a real iPhone using Apple’s App Attest. We store the App Attest public key and a counter that stops replayed requests.
• We derive a random-looking device ID from the App Attest key ID using a secret only our server knows. The key ID itself is never stored in readable form.
• We also store the registration date, the platform (iOS) and the app version, and issue a device token that expires after 30 days and renews while you use the app.
• A device ID isn’t linked to your name, Apple ID, email or phone number. If you delete Flare and reinstall it, you start as a new device.

Your answers, while you’re at an event

• When you join an event, the app sends the matching answers for the context you chose (dating, friendship or professional), including any questions from the host, the match level you chose, an age assurance level, and stable but opaque IDs of people you’ve already met or cleared so you aren’t matched again. It never sends your profile name. Please don’t put identifying information in free-text answers.
• The optional “about” line and “in your own words” answers are cleaned before use: links, email addresses, phone numbers and @handles are removed, and they’re cut to 140 and 300 characters. They can include things you’d rather avoid and your dealbreakers. They’re used only for matching and are never shown to anyone you meet.
• These answers live in that event’s room on our server. They’re deleted when you leave or your participant session expires, at most 12 hours after you join or when the event ends, whichever comes first. They aren’t written to our logs or another database. Event-scoped hashed check-in and exclusion records can remain until the event ends, to enforce capacity and prevent repeat introductions.

Your match

• When you’re matched, both phones receive a shared light signature, a conversation starter and a pairing secret. The phones use that secret to find each other nearby over Bluetooth and, where available, Ultra Wideband. Anything they exchange is encrypted with a key from the pairing secret and passed through our server without being read.
• How close you are is worked out on the two phones. Distances and directions never leave the pair, and our server never receives or stores a position.
• We record what happens to a match (met, couldn’t find them, cleared, timed out) to run rest timers and to give the organizer totals. These records are linked only to your pseudonymous device and are deleted when you delete it. Organizers only ever see totals.

Notifications

• If you allow notifications, we store your Apple Push Notification service token and, for the Lock Screen display, a Live Activity token. They’re stored only with your device and deleted with it.
• We use them to tell you when your light has found someone while the app is in the background. Notifications go through Apple and never contain your answers.

Security and abuse prevention

• Our server uses your IP address briefly to limit how often requests can be made (for example, ten registrations per IP address per minute). We don’t keep IP addresses with your device record.

How matching uses your answers

Matching happens only among people in the same event and the same context. Hard rules (everyone is an adult, the same context, no one you’ve excluded) are applied by our own code. To rank how well people fit, we send answers to Cloudflare’s Clef AI models through Cloudflare Workers AI, and we create text embeddings of the “about” line.

• The model sees only the answers relevant to that context, labelled with placeholders like “c1”. It never sees names, IDs or whether you confirmed your age.
• Your “about” line and “in your own words” answers are passed to the model as quoted data, with an instruction never to treat them as instructions and to ignore any preference about race, ethnicity, nationality, disability, body or looks. A clash with a dealbreaker you wrote can stop an introduction.
• We don’t use your answers to train models and don’t keep them after the room ends. Requests may pass through Cloudflare AI Gateway, which handles retries, caching and usage limits.

If you set up your profile by talking

Talking it through is optional, and you can always type instead. If you choose it:

• Your voice and what you say are sent through our service to OpenAI, which holds the conversation and transcribes it. When it ends, the transcript is sent to OpenAI once more to turn it into draft profile answers.
• We don’t store the audio or the transcript. They pass through our service only while the conversation runs, and the app discards the transcript once your draft answers are back. We ask OpenAI not to store the session. OpenAI’s API terms apply, including limited retention for abuse monitoring, and they say API data isn’t used to train their models by default.
• Nothing goes on your profile until you’ve reviewed it and tapped Save. Who you are and who you’d like to meet are never filled in from a conversation.
• Your microphone is used only during this conversation.

Blocks and reports

Blocking and reporting protect other people, so they work a little differently.

• A block stores a one-way hash of the two device IDs, so the two of you are never matched again at any event. It contains no answers.
• A report stores the category you chose, the time, the event and the reported participant’s pseudonymous ID. It goes to the event’s organizer and to us. It has no free text, answers or messages.
• Blocks and reports are kept, hashed, for 1 year. Because they protect others, they’re kept even if you delete your device.

Optional diagnostics and metrics

Both are off unless you turn them on in the app.

• Crash reports: Apple’s crash and performance reports (MetricKit), with the app and iOS versions. They’re written to our Cloudflare Worker logs to help fix problems and aren’t stored anywhere else. Logs are kept only for the short period Cloudflare retains them.
• Usage counts: counts of moments like “lit”, “matched” and “met”, with the context and the time. They’re added to totals and never include your answers.
• “How did it go?” If you rate a meeting, we store the event, context, tier, outcome and rating as aggregate counts, with no device, pair or participant IDs, to calibrate how strong a match each tier really is. Thumbs-up or thumbs-down feedback in your Connections log stays on your phone.

What we process for hosts

Hosting from your iPhone

If you host in the app, we attach a host identity to your registered phone, with no name or email. We store your events, venues, schedules, reusable template questions and matching rules so you can use them again. Templates are separate from guests’ answers. Existing events keep their own template snapshots when a saved template is edited or deleted. Hosting can’t currently be recovered on another device.

You see live totals, the report queue (category, time and a pseudonymous participant ID) and a summary of results. You never see guests’ answers, names or who matched with whom.

Purchases

Apple processes event purchases. We store the Apple transaction ID, product ID, purchase environment and delivery or revocation state with the event, plus a random event purchase token. We don’t receive your payment-card details. Apple-signed refund notifications can remove capacity and pause an event. Apple keeps its own purchase records under its own policies.

The web organizer dashboard

If we set you up with our optional web dashboard, we also process your email address and any name you add, a sign-in code valid for 10 minutes, and a session cookie that keeps you signed in for 14 days. It’s used only for signing in, not for tracking.

Visits to this website

When you browse this website, a small script we run ourselves counts page views and shows us who’s on a page right now. It records the page (never anything after a ?), the site you came from, and the approximate city and country Cloudflare infers from your connection. It sets no cookies, doesn’t store your IP address, keeps a random ID only until you close the tab, and isn’t connected to the app. We delete these records after 90 days.

If you email us, the message is routed through Cloudflare and kept in our mailbox, hosted by Google, for as long as we need it to help you.

What we never do

• No ads, and no advertising or tracking SDKs.
• We don’t sell or rent personal data, or share it for advertising.
• No location tracking. Flare doesn’t use GPS, and our server never receives your location or distances.
• No photos, no chat and no access to your contacts.
• Your profile name is never sent to our server.

Who processes data for us

We share data with these providers only so that Flare can run. We require them, through their data processing terms, to protect it with the same or equal protection as this policy describes.

Cloudflare operates globally, so data may be processed outside your country. Where required, transfers rely on Cloudflare’s data processing terms and standard contractual clauses.

How long we keep it

Your choices and rights

• Delete everything: in the app’s Settings. This deletes your device record, push tokens, any presence in an event room and your outcome records, and erases your profiles from the phone. For hosts, it also ends and deletes hosted events, saved templates and our event purchase records. Apple’s payment records are separate. Hashed blocks and reports that protect other people remain for up to a year, and event-scoped check-in and exclusion hashes can remain until the event ends. More on deleting your data.
• Export my data: also in Settings. You get everything stored about your device: registration date, whether a push token is stored, active rooms, the blocks you made (hashed) and the reports you filed (category and time).
• Leave at any time: turning off your flare or leaving an event removes your answers from the room straight away.
• Withdraw permission: notifications, usage counts, crash reports and the voice conversation are all optional and can be turned off or skipped at any time.
• Hosts using the web dashboard can ask us to delete or export their account and events by emailing us.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, and to complain to a data protection authority. Because we don’t know who guests are, the in-app tools are the way to act on your device’s data. We can’t look you up by name or email.

Age

Flare is for adults 18 and over. You confirm you’re 18 or older, and where Apple’s Declared Age Range is available, the app shares only whether you’re in an adult range. Some events also check ID at the door. If we learn that a device belongs to someone under 18, we remove it.

Changes and contact

If we change how Flare handles data, we’ll update this page and the date at the top, and tell you in the app before significant changes take effect.

Questions or requests: privacy@downloadflare.app.