Privacy Policy
Last updated: 7 August 2026
This policy explains what flappr (“flappr”, “we”, “us”) collects when you use the flappr mobile app, why, and the choices you have. We keep it plain and short.
1. Who we are
flappr is a daily brain-game app. For any privacy question or request, contact us at support@flappr.app. We are the controller of the personal data described below.
2. Data we collect
We only collect what the game needs to work:
Account
- Authentication — you sign in through Firebase Authentication (a Google service). We receive a Firebase user ID and, depending on your sign-in method, your email address.
- Profile — the handle (username) you choose and an optional avatar you pick from our in-app library.
Gameplay
- Your scores, daily-drop results, streaks, XP, duel ratings, quests, and league standings.
- Friend circles you join, invites you send, and nudges — so friends can see each other’s daily boards.
Notifications
- If you enable push notifications, we store a push token and your platform (iOS or Android) so we can send streak reminders and friend activity. You can turn these off any time in your device settings.
Purchases
- If you buy a subscription, we store a subscription identifier and entitlement status from the app store (Apple or Google, via RevenueCat). We never see or store your card number — payment is handled entirely by the store or payment provider.
Technical
- Standard server logs (such as IP address and request timestamps) generated by our hosting for security, abuse prevention, and debugging.
Product analytics
- We use Mixpanel to understand how flappr is used. It records in-app events (screens you open, features you use, purchases you make) along with your device platform and app version. These events are linked to your account, and we also send your handle and email address so we can support you when you contact us.
- You can turn analytics off at any time in Profile › Privacy. Turning it off stops all further collection from your device.
Advertising measurement
- We advertise flappr on Meta (Facebook and Instagram). To know which ads are worth paying for, we use AppsFlyer as our measurement partner: our server tells AppsFlyer when you install the app, create an account, finish onboarding, and buy a subscription, and AppsFlyer reports back which ad brought you. That is the whole list — your lessons, scores, streaks, friends, and everything else stay out of it.
- For purchases we also send the amount and the currency. AppsFlyer identifies you by an install identifier it generates on your device, not by your email address.
- You can turn this off in Profile › Privacy, separately from usage analytics. In the EEA and the UK it starts switched off until you turn it on. On iOS we also ask Apple’s tracking permission first, and your answer is passed on honestly: decline it and the measurement is limited to anonymous, aggregated counts.
- Turning off usage analytics turns ad measurement off as well. Turning usage analytics back on does not turn ad measurement back on — that is a separate choice you make yourself.
Who acts on whose instructions: Mixpanel and AppsFlyer are our processors — they handle your data on our instructions and not for their own purposes. Meta is not: it uses the events above for its own advertising purposes as well, which is why ad measurement has its own switch, its own consent, and its own default. We do not sell your personal data.
3. How we use your data
- To run the game — daily drops, scoring, streaks, leaderboards, duels, and friend circles.
- To send notifications you’ve opted into.
- To provide and validate subscriptions.
- To understand which parts of the app are used, so we can improve them.
- To measure which of our ads brought people to flappr, so we spend less on advertising.
- To keep the service secure and prevent cheating and abuse.
Where required (for example, in the EEA/UK), our legal bases are performance of our contract with you, your consent (for notifications, and for advertising measurement), and our legitimate interest in running and securing the game.
4. Who we share it with
We share data only with the service providers that help us run flappr, and only as needed:
| Provider | Purpose |
|---|---|
| Google Firebase | Sign-in and authentication |
| Neon | Database hosting (your game data) |
| Cloudflare | Application hosting, CDN, and security |
| Expo | Delivery of push notifications |
| Apple / Google | Processing subscription payments |
| RevenueCat | Managing subscriptions and purchase validation |
| Mixpanel | Product analytics (how the app is used) |
| AppsFlyer | Advertising measurement: attributing installs and conversions to the ads that caused them, on our instructions. |
| Meta | Advertising. Unlike the others, Meta is not merely acting on our instructions: it also uses this data for its own advertising purposes. |
| Email delivery provider | Sending friend-invite emails you request |
We may also disclose data if required by law, or to protect the rights, safety, and security of flappr and its users.
5. International transfers
Our providers may process data in the United States, the European Union, and other regions. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.
6. How long we keep it
We keep your data while your account is active. When you delete your account, we delete your personal data as described in our account deletion policy, except where we must retain limited records to meet legal, tax, or fraud-prevention obligations.
7. Your rights
- Get a copy of your data — in the app, under Profile › Privacy › Download my data. We email a machine-readable JSON file to your verified address, usually within a minute.
- Delete your account and data at any time — see Delete your account.
- Turn off analytics — under Profile › Privacy.
- Correct your personal data, and object to or restrict certain processing.
For anything not covered by the in-app controls above, email support@flappr.app. You also have the right to complain to your local data-protection authority.
8. Children
flappr is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
9. Security
Data is encrypted in transit (HTTPS/TLS), access is restricted, and authentication is handled by Firebase. No method of transmission or storage is perfectly secure, but we work to protect your information.
10. Changes to this policy
We may update this policy as flappr evolves. We’ll revise the “Last updated” date above and, for material changes, provide notice in the app.
11. Contact
Questions or requests: support@flappr.app.