1. Personal information we collect and hold
Depending on how you use Flare, we may collect and hold:
- Account and authentication information: your email address, internal account identifiers, authentication and session records, policy acceptances and account status. If you choose Sign in with Apple or Google, this includes the account identifier, email address and basic profile information that provider supplies. Apple may supply a private relay address. We do not receive your Apple or Google Account password.
- Profile information: username, display name, biography, interests, profile photos, profile settings and meetup participation count.
- Flare and meeting information: flare title, description, category, audience, duration, privacy radius, approximate public map area, exact meeting coordinates, venue, address and optional arrival instructions.
- Activity and communications: join requests and decisions, attendance, event-chat messages and read state, connections, connection interactions, blocks, notification activity and related timestamps.
- Location information: accurate foreground location readings used when you choose to centre the local map, create a flare or set an optional nearby-flare alert area. Flare does not collect background or continuous live location.
- Device and notification information: Expo push token, notification preferences, app version, build number, platform, operating-system version and limited device model information.
- Safety and moderation information: safety reports, report descriptions, contextual snapshots, moderation decisions, account warnings or restrictions, and audit records. Another member may provide information about you when making a report.
- Feedback and diagnostics: feedback category and message, whether you permit follow-up contact, and privacy-minimised crash or error information such as an error type, stack trace and safe internal error context.
- Website information: if an access-request form remains available, the email address you submit, your confirmation that you are at least 18, submission time, and a keyed pseudonymous value derived from the requesting network address for rate limiting. Flare uses an access-request email only to review the request and send an invitation if a place is offered; it is not used for marketing. If you use the website Support or Account deletion form, we also collect your account email, request category and, for ordinary support, a deliberate message of up to 1,000 characters. Account-deletion requests do not collect a free-text message. Cloudflare Turnstile may process limited browser and device signals to distinguish people from automated requests; Flare does not send Turnstile your email or message. The pseudonymous network value is used only for a one-hour rate limit. Rate-limit records more than 24 hours old are removed by hourly cleanup and during subsequent request processing.
2. How we collect personal information
We collect information:
- directly from you when you create an account or profile, create or join a flare, send a message, connect with another member, change settings, submit feedback, contact us, or make a safety report;
- from your device when you deliberately grant location, photo-library or notification permission, or when a technical error occurs;
- from Apple or Google if you use their sign-in service;
- from other members when their activity involves you, including join decisions, connection requests, messages, blocks or safety reports; and
- automatically through our service providers as needed to authenticate your account, deliver the service, protect against abuse and diagnose errors.
3. Why we use personal information
We use personal information to:
- create and protect accounts and verify policy acceptance;
- provide profiles, flare discovery, hosting, join requests, private meeting details, temporary event chat, connections and account activity;
- calculate which eligible flares are within a chosen discovery or alert area;
- apply audience, participation, blocking, expiry and account-access rules;
- deliver notifications you have enabled;
- prevent abuse, investigate reports, moderate content and enforce our Terms and Community Standards;
- provide support, respond to privacy requests and follow up on feedback when you have permitted us to do so;
- diagnose failures, maintain reliability and secure the service; and
- meet legal obligations and establish, exercise or defend legal claims.
Flare does not sell personal information. Flare does not use third-party advertising SDKs, cross-app tracking or location data for advertising.
4. Location privacy
Flare asks for foreground location only when location is needed for a feature you choose to use. The ordinary map location is kept in app memory and used to request eligible flares within your selected discovery radius.
When a host creates a flare, the exact meeting coordinates are stored in a protected private record. The server creates one stable, randomly offset public map centre within the host's selected privacy radius. Eligible members see that approximate area before acceptance, not the exact point or a person's live location. The host and currently accepted participants can access exact meeting details while the flare is active.
Nearby-flare alerts are optional. If enabled, Flare stores one protected alert centre based on your latest accurate foreground reading, together with your selected discovery radius and update time. Flare does not retain a history of these alert locations. The area stops matching after seven days without a foreground refresh and is deleted when you turn nearby alerts off.
5. When information is visible to other members
Flare displays information only within the contexts needed to operate the service. Depending on audience, connection and participation rules, eligible members may see a flare's public description, approximate area and host profile. A host can review profiles of people requesting to join. Exact meeting details and event chat are restricted to the host and accepted participants while access remains valid. Members of a naturally ended flare may retain limited profile, connection and chat access for up to 24 hours.
Connections are mutual and private. Blocking separates the accounts and revokes ordinary access as described in Flare's service rules. We do not make member lists or connection lists publicly searchable on the open web.
6. Service providers and overseas disclosure
We use service providers to operate Flare, including:
- Supabase for authentication, database services, server functions and private file storage in its Asia Pacific (Sydney), Australia region;
- Apple for optional Sign in with Apple, Apple Maps on iPhone and iPhone push-notification delivery;
- Google for optional Sign in with Google, Google Maps on Android and Android push-notification delivery;
- Expo for application delivery infrastructure and push-notification routing;
- Sentry for privacy-minimised crash and error reporting;
- Resend for transactional authentication email; and
- Cloudflare for website hosting, security and bot protection.
These providers process information only as needed to provide their services to Flare and are expected to protect it consistently with their contractual and legal obligations. They and their subprocessors may process information outside Australia. Flare's Production Supabase project is configured in the Asia Pacific (Sydney), Australia region; Sentry error-event storage is configured for the European Union in Germany; and other provider operations or subprocessors may be located in the United States, European Union and other countries described in their current service documentation.
We may also disclose information when reasonably necessary to comply with law, respond to valid legal process, protect a person from serious harm, investigate abuse, or establish, exercise or defend legal claims. We do not give retained private event content to ordinary users or standard mobile moderators.
7. Retention and deletion
We keep personal information only for as long as needed for the purposes in this policy, including limited safety, security and legal purposes:
- exact meeting details become unavailable to members at expiry or cancellation. After natural expiry, the fixed host and attendee roster may retain chat and related attendee-profile and connection access for up to 24 hours. Cancellation, leaving or removal before expiry, blocking and account restrictions revoke the affected access. Exact details and chat are ordinarily deleted from restricted storage within 30 days after expiry or cancellation;
- minimal flare and participation records are ordinarily deleted within 90 days;
- a nearby-alert area stops matching after seven days without refresh and is deleted when the feature is disabled;
- pending website access, support and account-deletion requests are scheduled for deletion 90 days after the latest submission and removed by hourly cleanup; they may be removed sooner after resolution;
- ordinary product feedback is deleted when the submitting account is deleted and may be removed earlier when no longer useful; and
- device push tokens are removed when the device is unregistered, on normal sign-out from that device, when the account is restricted, or when the account is deleted.
An audited and time-limited safety, emergency or legal preservation hold may delay deletion of relevant event records. Safety reports and moderation audit history may remain as pseudonymised incident records after account deletion when reasonably needed for participant protection, accountability or legal obligations. Account deletion does not shorten an applicable limited event safety period.
8. Your choices, access and correction
You can:
- grant or withdraw location, photo-library and notification permissions in your device settings;
- manage notification categories and disable nearby-flare alerts in Flare;
- edit your profile, remove photos and manage connections or blocks;
- review your submitted safety reports;
- sign out or permanently delete your account in Profile & Settings; and
- manage Flare's Sign in with Apple or Google authorisation in your Apple Account or Google Account settings.
You may ask us to provide access to personal information we hold about you or to correct inaccurate information by contacting support@flare-social.com.au.
We may need to verify your identity before acting on a request. If applicable law permits or requires us to refuse a request, we will explain why and how you may complain.
9. Security
We use technical and organisational safeguards designed for the nature of the information Flare handles. These include encryption in transit, restricted database and file access, server-side authorisation, separation of public and private meeting information, limited retention, administrator access controls and audit records. No internet service can guarantee absolute security. Please use a strong, unique password and contact us if you believe your account or information has been compromised.
10. Privacy questions and complaints
For a privacy question, access or correction request, or complaint, contact:
Luke Rouse
Email: support@flare-social.com.au
Australia
Please describe your concern and provide enough information for us to respond without sending unnecessary sensitive information. We will acknowledge and investigate privacy complaints and aim to respond within a reasonable period. If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints.
Do not use the privacy email or product-feedback form for an emergency. In Australia, call Triple Zero (000) when urgent police, fire or ambulance help is required.
11. Children
Flare is not directed to anyone under 18, and people under 18 may not create an account. If you believe a person under 18 has provided personal information to Flare, contact support@flare-social.com.au.
12. Changes to this policy
We may update this policy when Flare's features, service providers, legal obligations or information practices change. We will publish the updated policy and effective date at https://flare-social.com.au/privacy. When a material change requires renewed acceptance, Flare will present the updated policy in the app and ask account holders to accept it before ordinary app access resumes.