Privacy Policy

Effective date: October 25, 2026

This Privacy Policy explains what information RedFlags Dating App: Unhinged (“Unhinged”, “we”, “our”, “us”) collects when you use our Android app and our web app at app.unhingedredflags.com (together, the “App”), why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

The short version: we collect what we need to run a dating app safely. We never sell your data, we do not show third-party ads, and you can delete your account at any time from Settings.

1. Who we are

Unhinged Red Flags (trading as Redflags) is operated by Modra Consultancy Ltd, a company registered in Kenya, Kiserian Isinya Road, Neema House, Kiserian, Kenya. Modra Consultancy Ltd is the “data controller” for the personal data described in this policy, which means it decides how and why it is used.

For any privacy question or request, email support@unhingedredflags.com. We aim to reply within 30 days.

2. Where this policy applies

This policy applies to the App, our website pages (such as this one) and any emails or notifications we send you. It does not apply to other companies’ services you reach from the App, such as Google sign-in, Sign in with Apple, Paystack’s payment page, Google Play or the App Store, which have their own privacy policies.

3. Information we collect

3.1 Information you give us

• Account details: your email address and password (we store only a secure, one-way hash of your password), or your name and email from Google if you sign in with Google. If you use Sign in with Apple, Apple gives us an account ID, your email (or a private relay address if you choose “Hide My Email”) and, the first time only, your first name; we also keep a token from Apple so we can end the Apple link when you delete your account.
• Email verification: a 6-digit code we email you. We store only a coded version of it, for 15 minutes.
• Phone number: if we ask for it before you can send messages, verified with a one-time code by text message. It is never shown to other members; in the App you only ever see it masked.
• Profile: your first name or nickname, date of birth (to confirm you are 18 or older and show your age), gender and who you want to see (this can reveal your sexual orientation), photos, bio, prompts and answers, your red flags, the red flags you can work with (including ones in your own words), dealbreakers, what you are looking for, age range and distance preferences.
• Photo verification (optional): a selfie copying a pose we ask for. A member of our team compares it with your profile photos by eye. We do not use automated face recognition and we do not create a face template. The selfie is never shown on your profile.
• Messages: what you send to your matches, including messages you reply to.
• Reports and feedback: reports you make about other members (including the reason), red flag suggestions, and anything you send to our support email.
• Purchases: which plan or pass you bought, when it started and ends. See section 3.3.

3.2 Information collected when you use the App

• Approximate location: if you allow it, your phone or browser gives us your location. We round it to about 1 km before storing it and use it only to show people nearby and the approximate distance between you. We never collect precise or background location.
• Activity: likes and passes, matches, boosts, rewinds, when you were last active, and daily counts used for free-plan limits (for example swipes and new chats).
• Screenshot notices (Android 14 and later): if you take a screenshot of a chat, the App records that a screenshot happened (not the screenshot itself) and shows a notice in that chat.
• Notifications: if you turn notifications on, a push address for your phone or browser from Google, Apple or Mozilla, so we can tell you about matches, messages, likes and when a pass is ending. Notifications show who it is from, never what a message says.
• Device and log data: device type, operating system, app version or browser type, IP address, the time of requests and error details. We use these for security, preventing abuse and fixing problems.
• On your device: the App keeps your sign-in session and a few settings (such as your language and which tips you have seen) on your phone or in your browser. We do not use advertising or tracking cookies, and there are no analytics or advertising tools in the App.

3.3 Payments

• In the Android app, payments go through Google Play; in the iPhone app, through the App Store. RevenueCat helps us manage subscriptions. Google and Apple handle your payment details; we never see them.
• In the web app, passes are paid through Paystack (M-Pesa, card, Apple Pay or bank transfer). Paystack receives your email, the amount and your payment details.
• If you choose “Pay with M-Pesa” inside the App, you type your M-Pesa number on our page and we pass it to Paystack so Safaricom can send the payment prompt to your phone. We use it only for that payment and don’t store it on our servers (your browser may remember it on that device to fill it in next time).
• We receive only the result: the plan, amount, currency, payment method type (for example “M-Pesa” or “card”), a payment reference and the status. We never receive or store your full card number or M-Pesa PIN.

3.4 Information we create

• Compatibility and ranking: we work out a compatibility score from both members’ red flags and what you are looking for, and we order the profiles you see using signals such as compatibility, distance, recent activity, who liked you, boosts and whether a profile has been reported. See section 5.
• Safety signals: the result of our automatic message and profile checks (see section 5), reports about you and our moderators’ decisions.

4. How we use your information, and our legal reasons

Data protection laws (including the Kenya Data Protection Act, 2019, the EU and UK GDPR, and similar laws elsewhere) require a legal reason for each use of personal data. Ours are:

• To provide the App you signed up for (contract): creating your account, showing your profile to compatible people and theirs to you, matching, messaging, notifications you turned on, and the paid features you buy.
• With your consent: using your location; showing your gender and who you want to see, which may reveal your sexual orientation; photo verification; notifications; and the Elite AI features. You can withdraw consent at any time in your phone or browser settings, in the App’s Settings, or by deleting the information, without affecting what happened before.
• To keep members safe and prevent fraud (legitimate interests and, where it applies, legal obligation): confirming you are 18 or older, verifying phone numbers, automatic checks for scams, contact details and hateful content, reviewing reports, suspending accounts, keeping banned members from coming back, and investigating security incidents.
• To run and improve the service (legitimate interests): keeping the App secure and working, fixing bugs, understanding which features are used, and sending important account and service messages.
• To meet legal obligations: keeping purchase records, responding to lawful requests from authorities, and handling your privacy requests.

5. Automated checks, matching and AI

5.1 Matching

The profiles you see, and their order, are chosen automatically from both members’ preferences (age range, who you want to see, distance and dealbreakers), red flag compatibility and the ranking signals in section 3.4. This decides who you are shown, not whether you can use the App. You can change your preferences at any time.

5.2 Safety checks

Messages you send are checked automatically, before they are delivered, for slurs, threats, sexual services and mentions of under-18s, and are not sent if they break these rules. Messages you receive are checked automatically for common scam and pressure warning signs (for example requests for money, M-Pesa or airtime, or pressure to move off the App), and you may see a safety notice. Profile text (name, bio, prompts and your own-words flags) is checked for slurs, contact details, money requests and similar content before it is saved; some borderline words are sent to our team for a look. These checks use fixed rules, not AI. Final decisions to suspend an account are always made by a person.

5.3 Elite AI features

The AI features only work after you allow them: the first time you open one, the App asks whether we may share this information with Anthropic, and nothing is sent unless you tap Allow. You can withdraw this at any time in Settings → AI features. If you have an Elite plan and use the AI Red-Flag Decoder or the AI chat coach, we send what that request needs to our AI provider, Anthropic: both members’ first names, ages, bios, red flags and what they are looking for and, for the chat coach, up to the last 20 messages of that chat and your question. Anthropic uses it only to answer you and, under its commercial terms, does not train its models on it. AI answers can be wrong, and nothing is sent to the other person automatically.

6. Who we share information with

We do not sell your personal data or share it for advertising. We share it only:

• With other members: your profile (first name, age, photos, bio, prompts, red flags, what you are looking for, verified badge and approximate distance) and the messages you send to your matches. Your matches also see your flag compatibility score and whether you have been active recently (“Active now” or “Active today”, never an exact time; hidden while Incognito is on). Depending on their plan, other members may see whether you liked them and your compatibility breakdown.
• With service providers who run parts of the App for us, under contracts that only let them use the data to provide their service: Render (servers), MongoDB Atlas (database), Cloudinary (photo storage), Cloudflare (web hosting, network security, support email forwarding), Resend (account emails), Twilio (phone verification codes and number checks), Google (sign-in, Google Play billing, Firebase Cloud Messaging for Android notifications), Apple (Sign in with Apple, App Store billing, iPhone and browser notifications), Expo (delivering app notifications), Mozilla (browser notifications), RevenueCat (subscription management), Paystack (web payments) and Anthropic (Elite AI features).
• For safety and the law: with police, courts or regulators when the law requires it or when we believe in good faith it is necessary to protect someone from serious harm, to investigate fraud or abuse, or to defend our rights. Where we report child sexual abuse material, we report it to the relevant authorities as described in our Child Safety Standards.
• If the business changes hands: if Unhinged is merged, acquired or sold, your data may pass to the new owner, who must keep protecting it as this policy describes. We will tell you before that happens.

7. International transfers

Our service providers store and process data outside Kenya, mainly in the United States and the European Union. When we transfer your data, we use the safeguards the law requires, such as the providers’ data processing agreements and standard contractual clauses, under the Kenya Data Protection Act, 2019 and, for members in the UK and EU, the UK and EU GDPR.

8. How long we keep information

• Your account and profile: while your account is open. When you delete your account, your profile, photos (including the files in our photo storage), matches, chats, likes and passes, blocks, verification selfies, notification addresses, red flag suggestions and AI results are deleted straight away.
• Verification selfies: deleted as soon as our team has decided, and after 30 days at the latest. We keep only the result (verified or not).
• Email codes: 15 minutes. Daily limit counters: a few days. AI Decoder results: 7 days. AI usage counts: 8 days.
• Reports: kept after either account is deleted, together with a copy of the last messages of that chat (up to 50) taken at the moment of the report, so that people who break our rules cannot erase the evidence by deleting their account.
• Banned members: if we remove an account for breaking our rules, we keep a one-way coded fingerprint of its phone number (not the number) so it cannot be used to sign up again.
• Purchase records: as long as tax and accounting law requires (in Kenya, generally 5 years).
• Security logs: kept for a limited time by our hosting provider, then deleted.

9. Your choices and rights

Wherever you live, you can:

• See and change most of your information in the App (Profile and Settings).
• Delete your account at any time in Settings → Delete account, or by emailing us. See also unhinged-w5r9.onrender.com/delete-account.
• Turn off location, notifications and photo verification in your phone, browser or the App’s Settings.
• Ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, or to move it to another service, by emailing support@unhingedredflags.com.

We may need to confirm it is really you before acting on a request. We may keep some information where the law allows, for example reports described in section 8.

Kenya: you have the rights in the Data Protection Act, 2019, and you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

UK and EU: you have the rights in the UK and EU GDPR, and you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

United States: we do not sell or “share” personal information for targeted advertising as defined by US state laws, and we do not use sensitive information to infer characteristics about you beyond running the App. Residents of states with privacy laws can make the requests above by email; if we decline, you can ask us to reconsider.

We will not treat you differently for using your privacy rights.

10. Security

We protect your information with encrypted connections (HTTPS), hashed passwords, sign-in tokens that stop working when you change or reset your password, limits on repeated attempts, restricted staff access and providers that meet recognised security standards. No system is completely secure; if a breach affects you, we will tell you and the authorities as the law requires.

11. Children

Unhinged is only for people aged 18 and over. We ask for your date of birth, do not show anyone under 18 and remove accounts that belong to someone under 18. If you think a member is under 18, report them in the App or email us. See our Child Safety Standards at unhinged-w5r9.onrender.com/child-safety.

12. Changes to this policy

We will update this policy when the App changes. The date at the top shows the latest version. If a change is significant, we will tell you in the App or by email before it takes effect.

13. Contact us

Questions, requests or complaints: support@unhingedredflags.com.