Privacy Policy

This Privacy Policy explains what Flair Systems Ltd, trading as Flair Social, collects when you use the Flair mobile app and the website at useflair.app, why we use it, who we share it with, and the choices you have.

Flair is operated by Flair Systems Ltd, a private limited company registered in England and Wales (company number 17548028), with its registered office at Suite RA01, 195-197 Wood Street, London E17 3NU, United Kingdom, trading as Flair Social. For UK GDPR and the Data Protection Act 2018, Flair Systems Ltd is the data controller. Flair Systems Ltd took over Flair on 28 October 2026 from its founder, who ran it as a sole trader before then. Your account and data moved with the service, and how we use them has not changed.

Contact for privacy and data-rights requests: privacy@useflair.app
General support: support@useflair.app

1. Who this policy covers

This policy covers the Flair iOS app and useflair.app. Android is not available yet. If we add it later, we will update this policy before that launch.

The website waitlist form is provided by Beehiiv. Beehiiv’s own privacy notice also applies to that form.

2. What we collect

Account information

• Email address, used to create your account, sign you in, and send account emails (confirmation, password reset, and similar service messages).
• If you sign in with Apple, we receive an identity token and, if you choose to share them, your name and email. Apple may give us a private relay email instead of your real one. We do not receive your Apple password.
• If you sign in with Google, we receive your email address, name, and profile picture from Google. We do not receive your Google password.
• Username (required), optional bio, and optional profile picture (still image or a short video note).
• Optional account settings, including whether your account is private and whether you hide your own friend counts from yourself.

Content you create

• Notes (videos of up to 10 seconds), captions, and the privacy tier you choose for each note.
• Comments, comment votes, and pinned-comment choices on your own notes.
• Direct messages you send (text and shared notes). DMs are only available between people who have added each other.
• Follows, follow requests, close-friends list, blocks, reposts, saves, and notes you share in a DM or through the system share sheet.

Activity information

• Which notes you watched and roughly how long you watched them. This powers your weekly recap, stops For You and Explore showing you the same note again, and feeds private Creator insights (shown only to the note’s author).
• Actions you take in the app: reposts, comments, saves, follows, blocks, reports, and similar.
• Basic technical logs from our hosting providers, such as IP address, timestamps, and request metadata, used for security, abuse prevention, and debugging.
• Device and app information needed to run the app (for example operating system version). We do not collect advertising identifiers and we do not run third-party advertising or analytics trackers.

Find friends from contacts (optional)

This feature is optional. Nothing happens unless you tap Find friends from contacts during onboarding or later in Settings.

• If you allow access, Flair reads contacts on your device to see which of them already have a Flair account, then shows those matches so you can add them if you want.
• We do not publish your address book. We do not create accounts, public profiles, or “shadow profiles” for people who are not on Flair.
• Phone numbers and email addresses of people who are not Flair users are not stored by us for marketing or later targeting.
• You can refuse the permission in your phone’s settings. The rest of Flair still works.

Website

• If you join the waitlist on useflair.app, Beehiiv collects the email address you submit and any cookies or similar storage that form needs to work. See our Cookie Policy.
• The website loads fonts from Google Fonts. Google may see your IP address when the page loads.

We do not collect precise GPS location, browsing activity outside Flair, face or voice analysis, or inferences about race, religion, health, political opinions, or sexual orientation.

3. Device permissions

Flair asks for a permission only when you use a feature that needs it. You can refuse any permission. Features that need it will not work until you allow access. We do not use the camera, microphone, photo library, or contacts in the background.

• Camera — to record notes. Video is uploaded when you post.
• Microphone — to record sound with a note. Audio is stored as part of the video file when you post.
• Photo library — to pick a video you choose to upload as a note. We access only the item you select. Profile photos are a separate, optional still image.
• Contacts (optional) — only for Find friends from contacts, as described above.
• Notifications (optional) — if you allow them, we store a device push token so we can send alerts about activity such as messages and follows. We ask after you have used the app for a while, not at sign-up. You can turn notifications off in your phone’s settings at any time.

4. Information stored on your device

The app keeps some data locally (for example sign-in session material, theme, onboarding flags, and short-lived prompt state). That local data stays on the device unless the feature also needs to sync it to our servers to work (for example your account and your notes).

5. Why we use it and legal bases

We use personal information to:

• Provide the service you asked for: accounts, posting, feeds, messages, recap, and Creator insights (contract).
• Keep the service secure and deal with abuse, reports, and legal duties (legitimate interests and, where relevant, legal obligation).
• Send essential account emails (contract).
• Improve reliability and fix faults using technical logs (legitimate interests).
• Run optional features you choose, such as contacts matching or push notifications (consent for the device permission; contract for the feature once you use it).
• Comply with UK online-safety and child-protection duties, including taking down and reporting child sexual exploitation and abuse material when we become aware of it (legal obligation).

We do not use your information to sell advertising, to build an advertising profile, or to sell or rent your data.

6. Privacy tiers and who sees your notes

Every note has an audience you choose:

• Public — anyone on Flair can see it. It may appear in For You and Explore, can be reposted, and can be shared outside the app as a link.
• Friends — visible only to people you have added and who have added you back (mutual follow). This is different from the Friends feed tab, which shows public notes from people you follow even if they have not added you back.
• Close friends — visible only to people on your close-friends list. That list is private; people are not told they are on it.
• Just me — visible only to you.

Notes that are not Public are stored in private storage and served through short-lived links issued only to people in that audience. Changing a note’s tier changes who can reach it from then on. We cannot pull back copies someone already saved, screenshotted, or recorded.

New uploads go to private storage first and are checked before a Public note is copied to our public media host. Reports do not automatically hide a note. We can restrict, remove, or escalate a note after review.

If you turn on a private account, people who do not follow you see a limited profile and must request to follow you.

7. Who we share information with

We do not sell personal information. We do not share it for cross-context advertising. We use other companies only to run Flair:

• Supabase — database, authentication, and related backend. Project region: eu-west-2 (London).
• Cloudflare — media storage (R2), content delivery for public media on media.useflair.app, bot protection on sign-in (Turnstile), and website hosting/DNS. Public media may be cached on Cloudflare’s network outside the UK.
• Resend — account and service emails.
• Apple — if you use Sign in with Apple, and for push notifications and App Store review prompts on iOS.
• Google — if you choose Google sign-in. The website also requests fonts from Google Fonts.
• Beehiiv — only if you submit the waitlist form on the website.

We may disclose information if the law requires it, or if we need to protect someone’s safety. If we become aware of child sexual exploitation or abuse material, we remove it and report it to the UK National Crime Agency (or an equivalent authority) as UK law requires. We do not run an automated NCMEC reporting pipeline.

8. International transfers

Your account data is stored in the United Kingdom (London). Some processors above are in, or may access data from, other countries, including the United States (for example Apple, Google, Cloudflare, Resend, Beehiiv). Where we transfer personal data out of the UK, we rely on the UK’s adequacy decisions or the suppliers’ standard contractual clauses / UK addenda.

9. How long we keep it

• Account, profile, notes, comments, messages you sent, follows, and uploaded files: until you delete them or delete your account.
• Watch records: kept so recap, “already seen” feeds, and private Creator insights work. Raw watch records are removed on a rolling window of up to about 13 months.
• Weekly recap uses the previous week only.
• Ordinary reports we dismiss as a false alarm: we may delete the case once it is closed, or keep a short record that a report was made.
• Moderation cases we acted on, and hashes of files we have taken down: kept so we can stop re-uploads and enforce bans.
• Child-safety records: kept for as long as we reasonably need them to meet UK online-safety duties and to deal with any follow-up from authorities.
• Technical logs: a short rolling window set by the hosting provider.
• Push tokens: until you turn notifications off, sign out, or delete your account.
• Waitlist emails: until you unsubscribe or we close that list.

When you delete your account we remove your profile, notes, comments, messages you sent, follows, reposts, saves, and uploaded files. Deletion cannot be undone. Copies of messages you sent may remain visible to the people who received them. We may retain a minimal record (for example that an account was banned, or a hash of removed illegal content) where we must do so to run a safe service or comply with the law.

10. Your rights

If UK GDPR or EU GDPR applies to you, you can ask us to access your data, correct it, delete it, restrict or object to certain uses, and receive a portable copy. Email privacy@useflair.app. We will respond within one month.

You can also:

• Edit your profile and delete individual notes in the app (Manage notes).
• Delete your account from Edit profile → Delete account.
• Ask for a copy of your data by emailing privacy@useflair.app (there is no in-app export button yet).

You can complain to the Information Commissioner’s Office at ico.org.uk, or to your local data-protection authority if you live in the EEA.

California and other US state laws. Flair is a small UK service and may not meet the size thresholds that make those laws apply. If they do apply to you, we do not sell personal information and we do not share it for cross-context behavioural advertising, so we do not offer a “Do Not Sell or Share” link. You can still email privacy@useflair.app to ask for access, correction, or deletion.

We do not currently take automated decisions that produce legal or similarly significant effects about you. Feed ranking uses watch and graph signals to choose public notes to show you; it does not affect your legal rights.

11. Children and age

Flair is for people aged 13 or over. By creating an account you confirm you meet that age. We do not knowingly collect personal information from anyone under 13. If you think a child under 13 has an account, email privacy@useflair.app and we will remove it.

We do not currently use an identity-document or face-scan age-assurance product. Age is self-declared. Under UK law a “child” for online-safety purposes is anyone under 18, so people aged 13–17 may use Flair today. The UK government has said it intends to restrict social media for under-16s; the exact rules are still being written. We are watching that process and will put in place the age-assurance or access controls the law requires before those rules apply to Flair, then update these documents.

12. Security

Data is encrypted in transit. Non-public notes are stored in private storage with access rules on the server, not only in the app. No system is perfectly secure. Do not post anything you would be seriously harmed by losing or having copied.

13. Changes

If we make a material change, we will update the date at the top and tell you in the app before it takes effect where we can.

Questions: privacy@useflair.app