Privacy policy.

Greenflag Tech, Inc. is responsible for personal information processed under this Policy.

Principal place of business:

1401 21st Street #4114
Sacramento, CA 95811
United States

Privacy and data requests: privacy@trygreenflag.com
Legal: legal@trygreenflag.com
Support: support@trygreenflag.com
Safety and reports: safety@trygreenflag.com
Website: https://trygreenflag.com

We have not appointed a Data Protection Officer. If that changes, we will update this Policy.

• Greenflag is for adults only: you must be 18 or older.
• We collect your phone number, photos, basic facts, approximate location (to place you in a metro), and the content your friends create about you.
• We require photo verification (a liveness check and face match) through our vendor Didit to reduce fake profiles.
• We use your approximate location to lock discovery to your metro and to power nearby experiences. Each time you open the app we update a single, blurred "last known location" (rounded to an area of a few city blocks); we keep no history of your movements and we do not show your exact location to other users.
• Friends can introduce you to someone they know by sharing a private introduction link to a copy of your live profile. That person can open it in a browser without an account. Introductions are on for every live profile; you can turn them off, and revoke any link, at any time (Section 7).
• Some optional features touch your device. Hiding yourself from people you know reads your contacts and uploads only a short fragment of a scrambled version of each number. Adding a date to your calendar writes one event and never reads your calendar. Links you paste in chat are fetched by our servers, not by the person you send them to (Sections 3 and 5).
• View-once photos in chat can be opened one time by the recipient. The feature removes their access; it cannot stop a screenshot (Section 7).
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• Content screening is machine-only: AI systems review content, not people. Humans are involved only when a safety report is opened or the law requires it (see Section 5).
• We use a small set of service providers (listed in Section 10) for verification, messaging, AI features, hosting, maps and link previews, payments, analytics, and error reporting.
• You can access, correct, delete, or export your information, subject to the limits in this Policy.

This summary is for convenience only; the full Policy controls.

3.1 Information you provide

• Account and verification: your phone number (verified by SMS one-time code), display name, date of birth / age, and the photos and basic facts (such as height, neighborhood, and interests) you upload as raw assets.
• Photo verification: a live selfie/liveness capture and the face-match result used to confirm you match your chosen profile photo (processed by Didit; see Section 10).
• Your friend roster: the phone numbers and names of the friends, family, or loved ones you invite to vouch for you, so we can send them an invitation.
• Content from your Vouchers: the pitch slides, captions, and written vouches your friends create about you, including the stated relationship (for example, "his sister").
• Content you create about others: if you act as a Voucher, the pitch and vouch content you create about the person you are vouching for.
• Profiles written for someone else: if you write a profile for a friend who has not joined yet, the photos, facts, and cover photo you upload about them. We hold that content until your friend claims it or it is removed (Section 12).
• Introductions: if a friend introduces you to someone, the friend's name, how they know you, and an optional short line about why they made the introduction. The person being introduced (the "prospect") gives us two or three photos, a first name, optionally an age and pronouns, and a phone number that we verify by SMS. If you are the prospect, this is what we collect from you, and verifying your number creates a Greenflag account for you.
• Date plans: if you and a match make a plan in chat, the place (its name, address, neighborhood, map coordinates, and any link you chose), the time, and a history of changes to the plan.
• Contact card (optional): contact details you type by hand to share in a chat, such as a phone number, email address or social media handles. We do not verify them, we never use them to contact you, they are not shown on your profile, and they are shared only with the match you send them to. A card you send is a copy kept with that conversation. Changing your card in Settings does not rewrite cards you already sent; only you can update a sent card, from inside that conversation.
• Device contacts (optional): if you turn on hiding yourself from people you know, the app reads the phone numbers in your contacts and uploads only a short fragment of a scrambled (hashed) version of each number. Your contacts' names and real numbers never leave your device, and the fragment we receive cannot be turned back into a number.
• Messages and interactions: messages you send in a match, including reactions, quoted replies, voice notes, photos and their captions, view-once photos, and any links you paste, and your "Curious" interest signals.
• Support, reports, and feedback: messages, reports of other users, survey responses, and attachments you choose to send us. When you send in-app feedback we attach technical context to help us reproduce the problem: the screen you were on and the few screens before it, error codes from recent failed requests, your network type, screen size and text size, and the app settings and permissions that change how the app behaves. It never includes the contents of your messages, the text you typed on those screens, or a device identifier.

3.2 Information collected automatically

• Device and app information: device and installation identifiers, app version, operating system, platform, language, and device type.
• Location: approximate location, used at signup to determine your metro for city-locked discovery and reverse geocoding the area label, and thereafter refreshed once each time you open the app to keep discovery local and power nearby experiences. Before it leaves your device, your position is rounded to an area of roughly a few city blocks; we never receive or store your exact coordinates. We store only your most recent rounded position (a single "last known location" that is overwritten on each update), never a trail or history of where you have been, and we do not collect location in the background. You can control device location permissions at any time, but core discovery needs at least an approximate metro.
• Usage and diagnostics: IP address, request timestamps, routes, status, latency, rate-limit and abuse-prevention signals, security logs, feature-usage events, crash reports, and error diagnostics. On our web pages for friends and introductions, an anonymous analytics identifier may be set in your browser before you have an account.
• Link previews: when a message you send contains a single link, our servers (not the person you are messaging) fetch that page to build a preview: its title, description, site name, and an image that we copy and store ourselves with camera data removed. We keep one preview per link, shared across conversations, with tracking parameters stripped from the address, until it is refreshed or removed.
• Safety-link and introduction-link views: when someone opens a safety link or an introduction link, we record a scrambled identifier that their browser generates, the first and last time they opened it, and an open count, so you can see how many people have your link. We do not store the viewer's IP address with the view.
• Purchase metadata: plan/access status and receipts from the app stores (we do not receive your full card number).

3.3 Information from third parties

We may receive information from the app stores (purchase and receipt status), our verification and infrastructure providers, and other people: friends who write a profile for you or introduce you to someone, people who raise their hand to be introduced to you, anyone who views or reports from a safety link, and anyone who reports you or interacts with you on the Services.

Some information on Greenflag may be considered sensitive, including your photos and face/biometric verification data, approximate location, and information that may reveal characteristics like sexual orientation. Orientation may be inherent in a dating context, and you may also choose to state it directly: the profile has an optional sexuality field you can fill in or leave blank. It is display only. We never use it to rank, filter, or decide who sees you, and leaving it blank publishes nothing. You can clear it at any time from Your details. We collect and use this only to operate the Services (to verify you, build and show profiles, lock discovery to your metro, and keep the community safe) and we apply the protections described in this Policy. We do not use this information for advertising, and we do not sell it.

Two more points. Photos that a prospect uploads during an introduction are screened by our automated safety systems before that person has finished creating an account. And when you make a date plan, the location involved is the place you chose to meet, not your own position; it is shared with your match and with anyone you give a safety link to.

A note on verification: Didit performs a liveness check and a 1:1 face match to confirm you match your chosen photo. The face geometry involved may be considered biometric information under laws such as the Illinois Biometric Information Privacy Act (BIPA) and similar Texas, Washington, and other state laws. This data is used only to confirm the verification result. We do not use it to build a facial-recognition database, to identify you across other services, or for advertising, and we do not sell it or disclose it except to Didit (which processes it on our behalf to perform the check) or as required by law.

Where biometric-privacy laws apply, we collect and process this data with your consent, which you give when you choose to complete verification. We retain the biometric data used for the face match only as long as needed to perform and maintain your verification, and in any event we delete it (or require our vendor to delete it) within a reasonable period, generally within 30 days, after the verification is complete, unless a longer period is required to comply with law or to address a safety or security matter. You can decline verification, but your profile will not go live without it.

We use information to:

• create and verify your account and confirm you are 18+;
• build, display, translate, and distribute friend-built profiles and vouches;
• run city-locked discovery, the "Curious" mechanic, matching, and messaging;
• deliver introductions between people in the order they arrive, with no ranking and no AI beyond the photo screening described below;
• hold a date plan for you and a match, keep a safety link current when the plan changes, and add the plan to your device calendar when you ask;
• build previews for links pasted in chat;
• keep the contact card you choose to build and deliver it, as a message, only to the match you send it to (we never use it to reach you ourselves);
• match the scrambled fragments of your contacts' numbers against members so you are hidden from people you know, if you turn that on;
• send the SMS verification code and service, security, account, and (where permitted) product messages;
• process purchases and access through the app stores;
• detect, prevent, and respond to fraud, abuse, harassment, safety incidents, and violations of our Terms and Community Guidelines, including reviewing reports and applying enforcement;
• analyze usage in privacy-preserving ways to improve the product;
• comply with legal obligations and protect the rights, safety, and security of users, the public, and Greenflag Tech.

Content review and AI-assisted processing. Greenflag makes active use of AI throughout the Services, including for trust and safety. To keep the community safe and to enforce our Terms and Community Guidelines, profiles, photos, vouches, media, and messages may be screened for fraud, abuse, harassment, illegal content, and safety risks, and that screening is performed by automated AI systems, not people. This includes the photos a prospect uploads during an introduction and the photos sent in chat. A chat photo may be held for a few seconds while it is screened; only content that appears to be child sexual abuse material is withheld, and everything else is delivered even if screening did not finish. Your private conversations, and the photos and media you share in them, are never read or viewed by Greenflag staff in the ordinary course of operating the Services: if your content is processed at all, it is processed by machines. Human review happens in exactly two situations: (1) when a safety report is opened about a conversation, profile, or piece of content (whether filed by a user, filed anonymously through a shared safety link, or generated by our automated systems when they detect content that appears illegal or indicates a risk of serious harm), our safety team reviews the reported content, and only that content, to resolve the report; and (2) when we are legally required to act, such as responding to valid law-enforcement requests in connection with an investigation or preserving records under a legal obligation. Outside those two paths, no person at Greenflag reviews your chats or shared media. Separately, our safety team can see the details of an introduction (who made it, how they know you, the line they wrote, and its status, but never phone numbers or the prospect's photos) so that it can withdraw an introduction or revoke a link when safety requires it. AI also powers product features you invoke directly, such as suggesting the time and place of a date you are about to share with your friends, and helps rank and surface profiles in discovery and support matching. We follow industry data-minimization standards: an AI system receives only the minimum content needed for the specific feature, only when that feature actually runs, and the AI service providers that process content for us (Section 10) do so under data processing agreements that bar them from using it for their own purposes: your content is not used to train their models. These automated processes do not produce legal or similarly significant effects about you without the ability for human review where required by law; you can contact us to ask about a decision. By using the Services, you consent to this AI-assisted processing.

Where data-protection laws require a legal basis, we rely on one or more of:

• Performance of a contract: to provide the Services you request;
• Consent: for example, to send the SMS verification code, to complete photo/biometric verification, to access device location, or for optional marketing (you can withdraw consent);
• Legitimate interests: to secure, maintain, and improve the Services, prevent abuse, and keep the community safe;
• Legal obligation: to comply with tax, consumer-protection, law-enforcement, and other legal requirements.

For users in Mexico, we process personal data in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP); this Policy serves as our privacy notice ("aviso de privacidad"), and you may exercise your ARCO rights (Access, Rectification, Cancellation, Opposition) and withdraw consent as described in Section 11.

Because friends build your profile, content about you may be created and shared by other people. You control whether your profile is published and can hide or unpublish it. However:

• Your live profile is visible to other users in your metro as part of discovery.
• Content that is visible to other users can be screenshotted, copied, or re-shared by others outside our control. Unpublishing your profile does not retrieve copies others already saved. This includes view-once photos: the feature removes the recipient's ability to open the photo again, but it cannot prevent a screenshot or a photo of the screen.
• We show your neighborhood/metro-level area, not your exact location, and we encourage limiting identifying details. Photos are inherently identifying, so share only what you are comfortable making visible.

If your friends include other people's information in your pitch, or you do so in someone else's, you are responsible for having any consent required.

Introduction links. A friend who wants to introduce you to someone receives a private link to a copy of your live profile: your first name, pronouns, age, area, your photos, and the pages your friends built, together with the introducer's first name and how they know you. Whoever opens it does not need an account. Up to five people can open each link before it needs to be extended, and it can be extended twice. If a link is pasted into a messaging app, that app may show a preview with your first name and one of your photos. Introductions are on for every live profile. You can turn them off in Settings, which stops every link you have shared from opening, and you can see and revoke each link on its own. Deleting your account revokes them all. The friend who makes an introduction is never told whether you said hi, and a person you do not respond to is never told no. Once you say hi and a conversation opens, the line your friend wrote may be visible to both of you.

Safety links. Before a date, you can create a private safety link for people you trust. Anyone who opens it sees your first name, your phone number so they can reach you, your date's first name, age (unless hidden), photo, verification badge, neighborhood, and cover quote, the place and time, and whether you have checked in or asked for help. If your plan changes in chat, the link updates. Your date is not told the link exists. The link stops working three days after your date, or sooner if you end it, and stays open up to a week longer if someone with the link checks on you or reports a concern, or if you ask for help. If the link is pasted into a messaging app, the preview shows only your first name. A safety link is private but not secret: anyone who receives it, or is forwarded it, can open it, so share it only with people you trust.

Plan emails. Once you and your match both agree to a plan, we email each of you a copy, and we email you again if the plan moves or is called off. Each of these carries a calendar file so you can add the date to your own calendar in one tap, and so that a change replaces the entry rather than leaving you with two. The email and the calendar file contain the other person's first name, the place and the time. They never contain their photo, and the subject line names neither the person nor the venue, so a preview on a locked phone gives nothing away. The calendar file is addressed to you and is not shared with anyone. You can turn these emails off at any time in Settings, under Notifications; turning them off does not affect the plan itself, the in-app notice, or your safety link.

We use SMS in two ways, and only in response to something you did.

One-time verification codes. We send a one-time code by SMS (through Twilio) when you or your invited friends sign in or verify a number.

Transactional account notifications. These are optional and off unless you ask for them. If you joined a waitlist, we text you once when your signup is ready to complete. If you wrote a dating profile for a friend, we text you about the status of that profile: when your friend claims it and when it expires unclaimed. If you took part in an introduction, whether as the person being introduced, the friend who made it, or the person receiving it, we text you about that introduction. Separately, if you ask us to send you your own claim link, we text you that link because you asked for it in that moment.

We do not send marketing, promotional, or re-engagement text messages.

Consent. These are two separate choices. By entering a phone number and continuing, you consent to the one-time verification code, because that code is how we confirm the number is yours and how you sign in. The transactional account notifications are optional: you choose them with a checkbox that starts unchecked, and declining changes nothing about your ability to create an account or use Greenflag. We record the date and the version of the disclosure you were shown for each choice. If you are being introduced to someone and verify your number on the web, both choices are recorded before your account is fully created, and we keep the verification challenge (including your number) for 24 hours before deleting it.

Consent belongs to the number, not the account. If you change your phone number or recover your account onto a new one, the optional choice resets and you can turn it back on.

Frequency. Message frequency is infrequent and varies. We only text you in response to your own activity, such as verifying a number, joining a waitlist, or writing a profile for a friend.

Rates. Message and data rates may apply, depending on your mobile plan.

Opting out. You can turn the optional account notifications off at any time in Settings, and that has no effect on verification codes or on your account. You can also reply STOP to any message, which stops all texts to that number, including verification codes, and can therefore prevent you from signing in. Reply START to undo that. Reply HELP for help.

Sharing. We do not sell your mobile number, and we do not share it with third parties for their own marketing purposes. We share it only with the service providers who deliver our messages, such as Twilio, and only so they can deliver them on our behalf. No mobile information is shared with third parties or affiliates for marketing or promotional purposes.

• Analytics (Mixpanel and Firebase Analytics): we use product analytics designed around bounded, behavioral events (feature usage, onboarding steps, platform). Analytics are not intended to include message contents, vouch text, or secrets. Events about date plans and link previews record only categories (for example, whether a place came from a link), never the place, the time, or the link. Our web pages for friends and introductions set an anonymous identifier in your browser before you have an account so we can tell whether those pages work; it is not joined to your account.
• Website traffic analytics (Google Analytics): on our marketing website (trygreenflag.com, but not our web pages for friends and introductions), we use Google Analytics to count visits and see how people find and use the site: the pages viewed, where the visit came from (for example, a search engine or a link), device and browser type, and an approximate location that Google derives from your IP address without storing it. Google Analytics sets its own cookies for this. We have turned off Google signals and ad personalization, so this data is not used for advertising, and Google Analytics does not load at all when your browser sends a Do Not Track or Global Privacy Control signal.
• Crash and error reporting (Sentry and Firebase Crashlytics): crash reports include technical diagnostics and are intended to be scrubbed of message contents and secrets.
• Push notifications (Firebase Cloud Messaging): our mobile apps use Firebase Cloud Messaging to deliver push notifications to your device. This relies on a device push token; you can control notifications in your device settings.
• Email open measurement (Postmark): our service emails include a small tracking image that tells us the first time a message is opened, so we can tell whether our emails are useful. We record only that a message was opened and which kind of email it was. We do not rewrite the links in our emails to route through a tracking service. Most email apps let you block remote images, which prevents this measurement entirely, and you can turn off email notifications in your settings.
• Cookies / local storage: our apps use device storage, secure storage, and similar technologies to operate. Our website uses a small number of cookies and similar local-storage technologies for anonymous product analytics (Mixpanel) and website traffic analytics (Google Analytics), which we use to understand how the site is used. We do not use cookies for advertising or for cross-context behavioral tracking, and we honour browser Do Not Track and Global Privacy Control signals on the website.

We share information with service providers who process it on our behalf to run the Services. We do not sell personal information. Our current providers include:

Firebase (Cloud Messaging, Firebase Analytics, and Crashlytics) and Google Analytics are provided by Google LLC. Information
about how Google handles personal information when providing these services is available in Google's privacy policy.

Links you paste in chat. When you send a link, our servers fetch that page to build the preview, using a generic browser identity. The site you linked to sees a request from our servers and the address you pasted; it does not see you, your device, or who you sent the link to. The person you sent it to only ever loads the copy we stored. Opening a link is different: you leave Greenflag, and that site's own privacy practices apply.

People you share links with. Anyone you give a safety link or an introduction link to receives the information described in Section 7. They are not our service providers; they are people you chose.

We may also share information with professional advisors; with authorities, regulators, or courts where required by law or to protect rights and safety; with other users or the public when you publish or share content; and with an acquirer or successor in a merger, financing, or sale of assets. We do not share personal information for cross-context behavioral advertising / targeted advertising as those terms are defined under U.S. state privacy laws.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict your personal information; to object to certain processing; to withdraw consent; to opt out of marketing; to opt out of "sale"/"sharing" or targeted advertising (note: we do not sell or share for targeted advertising); and to limit the use and disclosure of sensitive personal information to what is necessary to provide the Services (which is already how we use it). Users in Mexico may exercise ARCO rights under the LFPDPPP (Section 16). Users in Canada may exercise access, correction, and consent-withdrawal rights under PIPEDA and provincial privacy law (Section 17).

Authorized agents. Where the law allows, you may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and may still ask you to verify your identity directly.

Opt-out preference signals. Although we do not sell personal information or share it for targeted advertising, where required by law we will treat a recognized browser- or device-level opt-out preference signal (such as Global Privacy Control) as a valid opt-out request for the browser or device that sends it.

To exercise rights, use the in-app controls or contact privacy@trygreenflag.com. You can also:

• Delete your account in the app, or on the web at https://trygreenflag.com/account-deletion/ by confirming a code we text to the phone number on your account. Either way removes your profile from discovery and deletes your account data subject to the retention exceptions in Section 12.
• Hide or unpublish your profile at any time.
• Turn introductions off in Settings, and see and revoke every introduction link you have shared.
• End a safety link at any time from the conversation it belongs to.
• Control chat media: choose who can send you photos or voice notes, per conversation or for everyone; set your default photo mode; dismiss a link preview before you send; and turn on a reminder before opening links.
• Turn contacts hiding on or off in Settings. Turning it off removes the uploaded fragments.
• Export your data from Settings. The export covers your account, your details and settings, what your friends built for you, and your introductions. It does not include your conversations, date plans, safety links, or link previews.

If you are not a member. You may have information with us without an account: because a friend wrote a profile for you, because you raised your hand to be introduced to someone, because you opened a safety link, or because someone who knows you uploaded scrambled fragments of their contacts. You can ask about, correct, or delete that information by contacting privacy@trygreenflag.com; where a phone number is involved, we will verify you against it. Some records are kept in another person's name (for example the line a friend wrote when introducing you, or the evidence attached to a safety report), and those may stay with that person's account or with the report as described in Section 12.

We may need to verify your identity (for example, via the phone number on your account) before acting. Some requests may be limited where content is also someone else's (for example, a vouch your friend wrote), where we must keep records for legal, security, or safety reasons, or where information is controlled by another person. We will not discriminate against you for exercising these rights.

Appeals. If we deny your request, you may appeal by replying to our response (please reference "Privacy Request Appeal"); we will respond within the time the law requires. Depending on your state or country, you may also complain to your local data-protection or consumer authority, for example your U.S. state attorney general, the California Privacy Protection Agency, the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner, the competent Mexican data-protection authority, or your regional regulator.

We keep personal information only as long as needed for the purposes in this Policy. These are general guidelines, not fixed guarantees, and actual periods may vary with our legal obligations and safety needs:

• Profile, vouch, and message data is kept while your account is active and deleted or de-identified within a reasonable period (generally within about 30 days) after you delete your account, except as noted below.
• Location is stored as a single approximate "last known location" that is overwritten each time you open the app; prior values are not retained, and the stored value is deleted with your account.
• Inactive accounts. We may close and delete accounts that have been inactive for an extended period (for example, around two years), after any notice the law requires.
• Verification (biometric) data is retained only as long as needed to confirm and maintain your verification status and, as described in Section 4, is generally deleted within 30 days of completing verification.
• Introductions. When an introduction expires, is declined, or is withdrawn, the prospect's photos and the friend's line are removed from it; the introducer's name and relationship stay with the dater's record of the links they handed out. If someone was introduced but never went on to build a profile, the photos they uploaded are deleted about 30 days after their last introduction ends. An introduction signup that is never verified is deleted after 24 hours, and introductions are removed when either person deletes their account.
• Profiles written for someone else are removed if they are not claimed within about 30 days.
• Date plans are removed when either person deletes their account.
• Your contact card is deleted with your account. A card you already sent stays with that conversation like any other message you sent, and follows the message rules above.
• Link previews are cached copies of public pages. They are not tied to your account and are kept until they are refreshed or removed.
• View-once photos can be opened once by the recipient; after that, the recipient can no longer open them. They are otherwise handled like any other chat photo.
• Contacts fragments are kept while contacts hiding is on and removed when you turn it off or delete your account.
• Safety, abuse, and ban records may be retained longer, for example for a period after an account is banned, to enforce bans, prevent banned users from returning, investigate abuse, and protect the community. When a safety report is filed, including anonymously from a safety link or an introduction link, we freeze a copy of the reported content as evidence and place the reported account's records under a 30-day preservation hold. The hold preserves records; it does not stop that person from deleting their account.
• Payment, tax, and legal records are retained for the periods required by law (often several years, such as up to about seven years for tax and accounting records), and records of consent are kept as needed to demonstrate compliance.
• Backups, logs, and content already shared (such as a screenshot someone saved) may persist after deletion as described in Sections 7 and 11.

We use technical, organizational, and administrative safeguards designed to protect personal information, including encryption in transit, platform secure storage for secrets, access controls, rate limiting, and redaction rules for analytics and crash reporting. No method is perfectly secure; we cannot guarantee that unauthorized access, loss, or misuse will never occur. Protect your device, phone number, and account. If we learn of a breach affecting your information, we will notify you and authorities where required by law.

We are based in the United States, and we host the Services on infrastructure located in the United States. We use service providers that may process information in the United States and in other countries, which may have different privacy laws than where you live. Greenflag serves users in the United States, Canada, and Mexico, and your information will generally be processed in the United States. If you are in Canada or Mexico, this means your personal information is transferred to and stored in the United States, where it may be accessible to U.S. courts, law enforcement, and regulatory authorities under U.S. law. Where required, we use appropriate safeguards (such as standard contractual clauses or other lawful transfer mechanisms) for international transfers. When you paste a link in chat, our servers send a request to that website, wherever it is hosted, to build the preview.

We do not sell personal information or share it for cross-context behavioral advertising as defined under U.S. state privacy laws (including the CCPA/CPRA). Depending on your use, we may collect these categories of personal information:

• Identifiers: phone number, name, device identifiers, customer IDs, IP address, and, if you turn on contacts hiding, scrambled fragments of the phone numbers in your contacts;
• Customer records / commercial information: purchase, access, and transaction records;
• Internet/network activity: app and server request metadata and feature-usage events;
• Geolocation: approximate location for metro placement and nearby features, collected when you open the app and stored only as a single rounded last-known value, and the location of a place you and a match plan to meet;
• Biometric information: liveness/face-match verification data;
• Audio/visual information: your photos, voice notes, and any chat media you send, including view-once photos, and images we copy from links you paste;
• Characteristics that may be sensitive: information inherent to a dating context;
• Information about people who are not members: the photos, first name, age, and pronouns of someone a friend introduces to you or writes a profile for;
• Inferences: limited product-usage inferences for service improvement.

We collect, use, disclose, and retain these for the purposes and for the periods described in this Policy (see Section 12), and we disclose them only to the service providers and other recipients listed in Section 10. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use or disclose sensitive personal information beyond the purposes permitted under the CCPA/CPRA (such as providing the Services, verification, and safety). We do not offer financial incentives in exchange for your personal information.

California residents, and residents of other U.S. states that have enacted comprehensive consumer privacy laws (including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Maryland, Minnesota, New Jersey, and others), may exercise rights to know, access, correct, delete, and port their information; to opt out of sale/sharing/targeted advertising; to limit the use of sensitive personal information; and to appeal a denied request (see Section 11). You may not be discriminated against for exercising these rights, and you may use an authorized agent. To exercise these rights, contact privacy@trygreenflag.com. Because Greenflag verifies accounts by phone, we generally verify requests using the phone number on your account.

Washington and Nevada: consumer health data. Some information inherent to a dating service (for example, data that may reveal sexual orientation) could be treated as "consumer health data" under Washington's My Health My Data Act and Nevada law. We collect and use such information only to provide and secure the Services as described in this Policy and with your consent where required; we do not sell it, and we apply the protections described here. Washington and Nevada residents may contact privacy@trygreenflag.com to exercise applicable rights.

For users in Mexico, Greenflag Tech, Inc., with a domicile at 1401 21st Street #4114, Sacramento, CA 95811, United States, acts as the data controller ("responsable"), and this Policy serves as our privacy notice ("aviso de privacidad"). Our privacy contact ("departamento de datos personales") is privacy@trygreenflag.com.

Sensitive personal data. We process sensitive personal data ("datos personales sensibles"), including your photographs, the biometric data used for photo verification, and data inherent to a dating context from which sexual preference may be inferred, only with your express consent, which you give through an affirmative action in the app before that processing begins. If you are introduced to someone through Greenflag, you give that consent when you upload your photos and verify your number on the web, before the app is installed. You may withdraw that consent at any time, though doing so may mean we can no longer provide the Services.

Primary and secondary purposes. The purposes described in Section 5 that are necessary to provide the Services (creating and verifying your account, building and showing friend-built profiles, running discovery and messaging, delivering introductions, holding date plans and safety links, building link previews, processing purchases, keeping the community safe, and meeting our legal obligations) are primary purposes. Hiding yourself from people you know is optional and runs only on your request. Marketing and product-update communications (Section 19) are a secondary purpose that is not necessary to the Services; you may refuse or withdraw consent for it at any time by using the unsubscribe link or contacting privacy@trygreenflag.com, without affecting your access to the Services.

Transfers. As described in Section 14, your personal data is transferred to and stored in the United States, and is shared with the service providers listed in Section 10, who process it on our behalf.

You may exercise your ARCO rights (Acceso, Rectificación, Cancelación, Oposición), limit the use or disclosure of your data, and withdraw consent by contacting privacy@trygreenflag.com. You may also file a complaint with the competent Mexican data-protection authority.

If you are in Canada, we handle your personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, substantially similar provincial laws such as British Columbia's *Personal Information Protection Act*, Alberta's *Personal Information Protection Act*, and Quebec's private-sector privacy legislation.

• Consent. We collect, use, and disclose your personal information with your consent, for the purposes described in this Policy. For sensitive information (including your photographs, the biometric data used for photo verification, and information inherent to a dating context from which sexual orientation may be inferred) we rely on your express consent, which you give through an affirmative action in the app, or, if you are introduced to someone through Greenflag, when you upload your photos and verify your number on the web. Reading your contacts to hide you from people you know happens only when you turn it on. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, though doing so may mean we can no longer provide the Services.
• Access and correction. You may request access to the personal information we hold about you and ask us to correct it if it is inaccurate or incomplete. Contact privacy@trygreenflag.com, or use the in-app export and editing controls.
• Storage outside Canada. As described in Section 14, we are based in the United States and store personal information there. While your information is outside Canada, it is subject to the laws of the United States and may be accessible to U.S. courts, law enforcement, and regulatory authorities. We remain accountable for information we transfer to service providers for processing.
• Commercial electronic messages. Where we send commercial electronic messages to Canadian recipients, we do so in accordance with Canada's Anti-Spam Legislation (CASL), including identifying ourselves, providing our mailing address, and offering an unsubscribe mechanism. Verification codes and other transactional messages are not marketing.
• Complaints. If you are not satisfied with how we have handled your personal information, you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy commissioner where one has jurisdiction (for example, the Information and Privacy Commissioner for British Columbia, the Information and Privacy Commissioner of Alberta, or the Commission d'accès à l'information du Québec).

Greenflag is strictly for adults. The Services are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 is using Greenflag or has provided information to us, contact safety@trygreenflag.com and we will act, including terminating the account.

If we become aware of apparent child sexual abuse material (CSAM) or the sexual exploitation of a minor, we will remove it, preserve relevant evidence, and report it as required by law to the National Center for Missing & Exploited Children (NCMEC) and/or to law enforcement. We may retain and disclose related information for those reporting, investigative, and child-safety purposes even where we would otherwise delete it.

If you opt in or provide contact information, we may send product updates and (where permitted) marketing messages. You can opt out using the unsubscribe link or by contacting support@trygreenflag.com. We may still send non-marketing service, security, account, payment, and legal messages.

The Services may link to or integrate with third-party sites and services governed by their own privacy practices. We are not responsible for their privacy, security, or content.

We may update this Policy from time to time. When changes are material, we will provide notice by posting the updated Policy, updating the "Last Updated" date, and/or sending in-app or email notice. Your continued use of the Services after the update takes effect means you acknowledge the updated Policy.

Greenflag Tech, Inc.
1401 21st Street #4114
Sacramento, CA 95811, United States

Privacy and data requests: privacy@trygreenflag.com
Legal: legal@trygreenflag.com
Support: support@trygreenflag.com
Safety and reports: safety@trygreenflag.com