askflag
Privacy policy
This policy explains what askflag collects, why, who sees it and what you can do about it. It applies wherever you live. askflag is responsible for your data (the "controller"). Contact: support@askflag.com.
1. What we collect
- Account: your verified contact (WhatsApp, Telegram or phone number), your public ID (like AF-7K2QX), and when you joined and were last active.
- Profile (public): the name, username, photo and short bio you choose, who you follow and who follows you, and your count of good deals. Anyone can see your profile and your open posts. Your contact details are never on it.
- Posts and offers: the text, price, photos and videos you post, the offers you send and receive, and your likes and saves.
- Location, only if you allow it: the point your device gives us, used to measure distances and name the area. Other people never see this point: they see an area about 150-450 m away from it.
- Country and city of your connection (from our hosting network), used to pick your currency and the places in the feed filter.
- Usage: first-party events such as screens opened, posts seen and buttons tapped, with a random session ID kept on your device. We use no advertising trackers and no third-party analytics, and we do not sell or rent personal data.
- Deals, coins and payments: which offer was picked, whether a deal was done, and a record of every coin and view added or spent. Card details are handled by Stripe, never by us.
- Reports you make or that are made about your content, and messages you send to support.
2. Why we use it
- To run the service you asked for: your account, posts, offers, picks, deals and alerts (contract).
- To keep it safe: moderation, spam and fraud prevention, enforcing the terms (legitimate interests; legal duty).
- To show distance and nearby posts (your consent, given in your browser or phone; you can withdraw it any time).
- To choose which posts to show you first, from the posts you liked, saved or offered on (legitimate interests). This only orders what you see; it never decides anything about you, and it is deleted with your account.
- To understand and improve the service from first-party usage data (legitimate interests).
- To process payments and keep the records tax law requires (contract; legal duty).
3. Who sees what
- Everyone: your posts, your public ID, your deal badge and an approximate area.
- Only the poster: the offers sent to their post.
- Only the other person in a deal, and only after a pick: your verified contact.
4. Service providers
- Cloudflare: hosting, database, file storage, and the AI that checks content, translates posts on request and matches similar posts.
- Stripe: payments and taxes, as reseller of coins and VIP.
- WhatsApp (Meta), Telegram and an SMS provider: verifying your contact.
- OpenStreetMap (Nominatim): turns the location of a post into a place name.
- OpenFreeMap, jsDelivr and Google Fonts: your device loads map tiles, map code, flag images and fonts directly from them, so they receive your IP address.
- Search engines receive links to public posts only.
They may only use the data to provide their service to us, except Stripe and the messaging apps, which also act under their own privacy notices.
5. Automated checks
Posts, pictures and offers are checked automatically for banned items and contact details, and may be blocked. You can ask for a person to review any automated decision by writing to us.
6. Where data is stored
Data is stored and processed on Cloudflare's global network and by our providers, so it may be handled outside your country. Where the law requires it, transfers are protected by Standard Contractual Clauses or equivalent safeguards.
7. How long we keep it
- Account, posts and offers: until you delete them or your account.
- Usage events: 180 days.
- Deleted data leaves the live service at once and our backups within 30 days.
- Payment records: as long as tax law requires (up to 10 years in some countries), by us and Stripe.
- A one-way fingerprint (hash) of the contact of a deleted account, so free welcome coins cannot be claimed twice. It cannot be turned back into the number.
8. Your rights
- Download your data: Me, then Download my data.
- Delete your account: Me, then Delete my account.
- You can also ask us to correct, restrict or stop using your data, or to explain anything here, at support@askflag.com. We answer within 30 days.
- You can complain to your data protection authority.
EU, EEA and UK: the legal bases are listed in section 2; you have the rights of access, correction, deletion, restriction, portability and objection. California: we do not sell or share personal information for cross-context behavioural advertising, we use sensitive information only to provide the service, and you will not be treated differently for using your rights. Brazil (LGPD), India (DPDP Act), UAE and Saudi Arabia (PDPL), Canada (PIPEDA), Australia and everywhere else: the same rights, through the same tools and the same contact.
9. Children
askflag is for people aged 18 or older. If we learn an account belongs to someone younger, we delete it.
10. Security
Everything travels over HTTPS; sign-in tokens and verification codes are stored only as hashes; access to data is limited to what running the service needs.
11. Changes
We will tell you in the app before an important change to this policy takes effect.