Flukto
LanguageEnglish

Privacy Policy

Version: privacy-2026-10-25b · Updated 25 October 2026

The German text is the original. This translation is provided for convenience; where the two differ, the German version applies.

This policy says what Flukto does with data. It does not describe an ideal; it describes what the server actually does. It covers the app and the website flukto.com.

1. Controller

Reimund Bleischwiz, Eberhard-Hoesch-Straße 130, 52351 Düren, Germany E-mail: datenschutz@flukto.com

There is no data protection officer; the legal conditions for one are not met.

2. The short version

3. What we process, why, and on what basis

3.1 Your account

What: e-mail address — or, with sign-in through Google or Apple, the identifier of that sign-in and the e-mail address the provider passes on with it (section 5) —, nickname, your confirmation that you are 18 or older (with its time), gender, your line about yourself, languages, your settings (blur, language filter, hide visitors, group invitations, group notifications, availability while off), the language the app shows you and its version, when your app last contacted our server (to the five minutes), and which version of the rules you accepted and when.

Why: so that an account exists, so that the age limit is kept, and so that others see who they are talking to.

Basis: Art. 6(1)(b) GDPR (contract of use). There is no password — access works through a one-time code sent to your e-mail address, or through sign-in with Google (Android) or Apple (iPhone).

How long: until you delete the account. Then immediately and completely — with everything attached to it: photos, counters, friends list, group memberships, blocks, consents.

3.2 Your photos

What: up to six pictures, as you upload them. We derive nothing from them: no face recognition, no biometric features, no matching across pictures. Basis: Art. 6(1)(b) GDPR. How long: until you replace them or delete the account.

Whatever is not part of the picture falls out of it. A camera often writes more into the file than the picture itself: the place it was taken (GPS), the time, the device, the software. Flukto rebuilds every picture you send anywhere in the app on the server. The picture remains; EXIF, XMP and IPTC are gone, and with them the place you stood in. The app already drops these entries on your phone, the server is the second line. Pictures uploaded before 28 August 2026 were cleaned the same way on 18 September 2026.

There is one check, and it happens before display. Every uploaded picture passes once through a model that answers a single question: is there something objectionable in it? Until that is done, nobody but you sees the picture. Clearly harmless pictures are approved, clearly objectionable ones rejected, and everything in between is looked at by a human — you can object to a rejection in the Team thread.

That holds for your profile pictures, for the pictures on a note and for a picture you send with a first message: all of them go through the same check — a program, and a person where the program is unsure — before anyone else sees them. Pictures inside a conversation that is already running are not checked beforehand; they can be reported like any message (§3.7).

The model runs on our own server; the picture is sent to no outside service. We store the result and the time so that a decision stays traceable. Basis: Art. 6(1)(f) GDPR (protecting the people here from content nobody wants to see) and our obligations towards the app stores.

The clear approval and the clear rejection are automated decisions (Art. 22 GDPR). Your protection: you learn the result, you can object in the Team thread, and then a human decides anew — the same person who in any case looks at everything the model cannot classify with confidence.

3.3 Your location

What: your device's position while you are on air.

Why: to find people near you and to fill the cells of the map.

Basis: Art. 6(1)(a) GDPR — your consent, given through the location permission in the operating system. You can withdraw it there at any time; after that the app no longer works, but your account remains.

How: The exact point lives only in the server's memory and is used only for the distance calculation. That is not a figure of speech: the store that holds it (Redis) runs explicitly without disk persistence, and the database has no field for coordinates at all. If the server restarts, all positions are gone. The exact point is never displayed.

What others see is a gridded point. The world is divided into cells whose edge length you choose yourself (300 to 1000 metres; never below 300). What is shown is not your position but a fixed spot inside the cell you are currently in — never at the cell edge. That spot depends neither on the viewer, nor on the session, nor on the time: everyone sees the same one. That is exactly where the protection lies — no average can be formed from several requests, several accounts or several days that points at your real position. How far the shown spot is off depends on where in the cell you stand; it is never further than one cell edge. The promise is neighbourhood, not address. Distances are rounded up to 50 metres.

In the background. While you are on air, your device reports its position even when the app is not open — otherwise you would vanish from the map the moment the screen goes dark. Android requires a permanent, silent notice in the status bar for that ("Flukto keeps you on air"); it is the system's condition, not advertising. When the session ends, so does the notice. On iPhone there is no such notice: the system schedules short background refreshes instead.

Visits (Teleport): you can move a running session into a warm cell somewhere else. Others then see only the chosen cell with a random point inside it and the label "Guest" — your real location is not shown at all and is kept in memory only for the way back. A meeting point cannot be set as a guest or with a guest. Whoever does not want to see guests switches them off ("Hide visitors"); that works both ways. Of each visit, the cell and the time stay stored for 30 days — so that a trip ended after reports closes visits for the rest of that day, and as a counter (§3.5); never your way there.

The rough cell of your last start (about 5 km², the size of a small town) stays in your account until you start again or delete the account. It was meant for the daily line while off; that notice is currently switched off.

Your own map is the exception that is none: your device knows your position anyway and shows it to you exactly. It never goes out.

An exact coordinate leaves your device in one case only: when you yourself set a meeting point. That is a place you pick by hand on the map; it goes, exactly as chosen, to the person in the conversation and lives as long as the conversation does (24 hours after the last message, see §3.4). The crosshair never starts on your own position — so that this cannot happen by accident. It stays your decision: the meeting point is a place, not a person, and Flukto never sends it by itself.

The cells of the map say something different from the points, and less: at the closest zoom level a cell covers about 0.7 km² (edge about 460 m); whoever zooms out sees larger cells that contain several. A cell already glows when a single person is active in it — otherwise a quiet town would be an empty map. It names no number: the number of people is shown only from five upwards; below that it simply does not exist. And it does not say whether someone is there right now: the colour fades over one hour, so a glowing cell can also mean that someone was there a little while ago. The same cells, without names and without points, are also shown by the public map on flukto.com (§3.9).

How long: A session ends four hours after the start or after the last extension — without you doing anything, after four hours at the latest. You can extend it as often as you like and end it immediately at any time; while it runs, your position keeps being processed. The warmth of a cell fades over one hour and cannot be attributed to a person.

Open to chat, without a session. After your first session you can stay on the map without a running session: as a quiet dot with no line, half-bright. For that we keep the area in which you last went on air or last opened the app: one map cell of about 5 km² (H3 level 7), never a point, together with the time of that last use and the time you last opened the app. The dot sits in that cell, shifted a little each day, and stays for up to 100 days after you last opened the app; every opening starts the 100 days again. People on air whose reach extends to that cell can write to you; such a first message waits 24 hours for you instead of one. You yourself see nobody meanwhile. Nothing runs in the background for this: the app does not report any position while it is closed or not on air; the cell is written only when you go on air, go off or open the app. The switch is under You › Availability and is off until you agree: before your first session the app asks you once ("Show me and stay findable" / "Only while on air"); accounts that never answered are asked once. Switched off, signed out or deleted, the dot is gone at once and the cell is removed. While it is on, the capsule at the top of the map says so ("Off · Open to chat"). Basis: Art. 6(1)(a) GDPR (your consent through the sheet and the switch, and the location permission).

3.4 Your messages, chats and groups

What · How long

First message to someone you have not talked to yet · 1 hour, then deleted; 2 hours if the person is not on air right now (only "Open to chat") or is in your friends list; 24 hours if the person is shown only by the cell of their last use

One-to-one chat (messages, photos, reactions, quotes, meeting point) · 24 hours after the last message

Group (title, members, messages, photos, reactions, mentions, polls with votes) · 7 days after the last message or join — for all members at once

Thread with the Flukto Team · 24 hours after you read the last reply. If a reply is never read, the thread is deleted 24 hours after the reply. If you write again, the thread and its history stay until it is answered again

Basis: Art. 6(1)(b) GDPR. There is no archive. What expires is physically deleted, not flagged as deleted.

Editing and taking back. You can change one of your own lines afterwards (it then carries the mark "edited"; the earlier version is not kept) or take it back. A line taken back loses its text and picture immediately; only an empty shell remains until the end of the chat, so that quotes and albums do not point into nothing. In a group, the person who created it may additionally take back any line.

Groups. Whoever creates a group chooses the title and the members from their own open chats. Every member sees the names and photos of the other members and their line about themselves. In a poll, members see who voted how; for a reaction, who reacted. Whoever does not want to be invited to groups switches that off ("Nobody can add me to groups"). Whoever no longer wants to be in leaves — and is gone for the others at once; their own lines stay until the group ends, because they are part of the others' conversation.

Notes in a cell. In the cell you are standing in, you can leave a note: text (up to 4096 characters) and up to ten pictures, for one hour up to seven days; every five thumbs up keep it one more day, up to seven days. You can change the text later; the pictures and the lifetime stay. It is attached to the cell (about 460 m edge), not to your position, and carries your nickname and profile picture. Whoever stands in that cell or in one of the six cells next to it, on air, can read it, "find" it, give one thumb up or down and leave a comment (up to 200 characters) under it. A guest by Teleport can do the same in the visited cell and its six neighbours, sees names and profiles like everyone else, and only cannot leave a note there; a guest's read counts as a find. We store the text, pictures, cell, lifetime, who found it (so that a find counts once), the comments (one per account) and one thumbs up or down per account; everything disappears physically when it expires, pictures included. If a note has at least five thumbs down and at least twice as many down as up, the server takes it down by itself and tells the author in the Team thread. When a note expires, the author gets a summary there: finds, thumbs, and the comments with the finders' nicknames. The author also sees in the app WHO found the note: nickname, profile picture and the thumb that person gave (or that they only read it). Whoever reads someone else's note never sees that list. You can read, edit and take back your notes at any time from anywhere, and edit or remove your comment. Notes and comments can be reported like messages (§3.7). The language is detected as for messages so that "Translate" can be offered. Basis: Art. 6(1)(b) GDPR.

Translating. If a message, a profile line or a note is in a language that is not in your profile, you can have it translated. This happens only when you tap, never by itself. The translation model runs on our own server; the text goes to no outside service. The translation is kept for at most 48 hours, so that a second tap does not have to compute again, and is deleted after that. So that the app knows whether to offer a translation, the server detects the language of each message when it is sent (a code such as "ko", nothing more); the code lives and dies with the message. A machine translation can be wrong — the original text always stays visible. Basis: Art. 6(1)(b) GDPR.

Improbability Generator. (Android app only — the iPhone app does not have this feature.) A switch under You › How others reach me, off by default. With it on and you on air, you can tap the device on the map: the server picks at random another person who is also on air, has the switch on and speaks one of your languages, anywhere in the world. Your current on-air line travels with the request but is not shown in the chat (nor is theirs); they have two hours to answer, and their answer is the first line of the talk, which then lives like any other (§3.4). The other person sees your profile as with any request (nickname, picture, the line about yourself, languages) and the line, never your place; both see the number of people who were in the draw. Per spin we store whom the server matched with whom (30 days, so the same two do not fall together again, and for the limit: six spins a day; swiping away a request that landed on you counts as one of them). Whoever is in such a talk or has such a request open is matched with nobody in the meantime. Basis: Art. 6(1)(a) GDPR (the switch and the tap on the device).

Hosts. Some accounts on the map are Flukto hosts, run by us (marked "Flukto host" in the profile). A message to a host is answered by our own software on our own server; it is stored and deleted like any other chat and is never passed to a third party.

3.5 Counters

Nothing has to be earned: full reach, visits, groups and the friends list are open from the first start. Your account still keeps counters, shown to nobody:

Why: the talk pairs decide whom you can invite to a group and keep as a friend (someone you have actually talked to). The hours are a plain usage figure of the account; we keep them for functions we may add later and show them to no one. Basis: Art. 6(1)(b) GDPR for the talk pairs; Art. 6(1)(f) GDPR for the hours (our interest in building on honest usage figures; a number without time or place touches you hardly at all). How long: until you delete the account.

Friends list. Your friends are a private list: one-sided, without a request, without confirmation. The person does not learn that they are on it. The list stays until you change it or delete the account.

3.6 Notifications

What: your device's push token, platform, app version, last contact. Basis: Art. 6(1)(a) GDPR (the permission for notifications that your device asks for). How long: until the device signs out or the token becomes invalid — then deleted immediately.

What a notification says: for a request and a reply only that something is there ("Someone sent you a message") — no name, no content. For a message in a one-to-one chat the push service (§4) carries only the fact that there is a line and its identifier; your own device then fetches the name, the picture and the text from our server with your session and shows them in the notification. If that fails (no network, line already gone), the notification says only "New message". The same applies to a message in a group: the push service carries only the fact and the identifier, your device fetches the name, the group title and the line. Older app versions still get the plain notification for one-to-one chats and, for groups, the name, the group title and the beginning of the line inside the push itself. Group notifications can be switched off under You › Notifications from groups (mentions with @ still reach you).

3.7 Reports and safety

What: if you report someone, we store your reason and a copy of the reported conversation. Without that copy the content would already have evaporated before a human can look at it.

Why: to fend off abuse, protect people, and meet legal obligations. Basis: Art. 6(1)(f) GDPR (our legitimate interest in a service where nobody is harassed).

Who sees it: moderation only. The reported person does not learn who reported them.

How long: 30 days after handling. Bans stay stored until they expire — as a pseudonymised entry (a hash of the sign-in identifier, not the address itself), so that a banned account cannot come back by deleting and re-creating. Every action by moderation is recorded with time and reason so that it can be traced and contested.

3.8 Technical operation

Our server logs the path, response time and status of every request — without an IP address: the field is deliberately switched off, in the server and at the gateway in front of it. What is not stored need not be protected, deleted or explained.

One narrowly limited exception: before sign-in (when there is no account yet that could be counted) we limit sign-in attempts per IP address to slow down abuse. These counters live under two minutes in memory and are logged nowhere.

Error reports from the app. If something goes wrong in the app (for example the camera returns no picture), the app reports a keyword for it to the server, with app version and time — no content, no location. These entries are deleted after 30 days.

Basis: Art. 6(1)(f) GDPR.

3.9 The website flukto.com and the public map

The website is a set of static pages with no account, no cookies and no analytics. At most it remembers in your browser whether you chose the light version; that stays on your device.

Public map (flukto.com/map): it shows the same cells as the app — warmth per cell, plus four numbers for the whole world (accounts, on air right now, cities, guests). No names, no points, no number under five per cell. It can be viewed without an account; the server only learns which part of the map you are looking at, and does not store it.

City search (in the app's World view): the name you type is sent to our server as part of the request and matched against a list of places that lives on our own server; nothing goes to a third party. The server answers and does not keep the term beyond the request log described in §3.8 (path, time, status — no IP address).

Sticker: on the map you can create a sticker with a QR code that points at a spot on the map, with a short text of your own. The text stays in your browser: it is not sent to us and not stored, and the image is created in your browser too. The QR code contains only the spot and the zoom level — nothing about you.

Basis: Art. 6(1)(f) GDPR.

3.10 Your sticker

What: you can create a sticker and put it up wherever you like. It carries a QR code that points at YOU (flukto.com/s/<code>), plus two lines of your own text.

Whoever scans it sees your profile — nickname and photos — and may write you ONE message, even from far away. How many people do that is up to you: a sticker hangs in public, and anyone passing by can scan it. Two handles work at once: pause the sticker — the code stays, and everything printed works again as soon as it is back on — or renew the code, which silences every sticker already put up for good. Anyone you blocked does not reach you through a sticker either, and from one person there is only ever ONE open line: while it waits for you, they cannot send a second.

The code is not your account identifier, it is a separate entry that says nothing about you. The text you print stays on your phone and is not stored. Whoever scans the code without the app lands on a page that answers exactly one question: is this code alive? Nickname, picture and identifier never appear there.

Basis: Art. 6(1)(b) GDPR (the feature you choose). How long: until you renew the code or delete the account; a pause leaves it in place without leading anywhere.

4. Who touches the data besides us

Who · For what · Where

dogado GmbH (one.com cloud) · Server, database, pictures, maps, all models · Germany (Leipzig)

Heinlein Support GmbH (mailbox.org) · Sending the sign-in code · Germany (Berlin)

Google (Firebase Cloud Messaging) · Push notifications on Android and, through the Apple Push Notification service, on iPhone — the token is a device address, and beyond delivery no content is read · USA

Apple (Push Notification service) · Push notifications on iPhone · USA/EU

With the first two there are data processing agreements (Art. 28 GDPR). For the transfer to Google and Apple we rely on the EU-US Data Privacy Framework or the standard contractual clauses. For one-to-one chats no content goes to the push services; for groups, the beginning of the line named in §3.6.

Not involved: no map provider, no ad network, no analytics service, no social networks, no outside AI service — photo check, translator, sticker check and the test accounts run on our own server.

5. If you sign in with Google or Apple

If you use that sign-in (Google on Android, Apple on iPhone), we receive an identifier and, where you allow it, your e-mail address from there — nothing more. What Google and Apple learn about the sign-in on their side is governed by their privacy policies.

6. Age

Flukto is for people aged 18 and over. That is simply the age we require; it lies well above the age of valid consent under Art. 8 GDPR in Germany. When the account is created, the tick for the terms also confirms that you are 18 or older; we store the time of that confirmation. The app has not asked for a date of birth since 14 October 2026. A date entered earlier stays in the account as long as older versions of the app still need it, and is deleted after that. If we learn of a younger account, we delete it.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent you have given can be withdrawn at any time with effect for the future.

Much of that works immediately and without us: change your profile in the app, delete the account in the app (takes effect instantly and completely), withdraw the location permission in the operating system. For access and portability write to datenschutz@flukto.com; we reply within one month.

Complaint: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

8. Security

The connection is encrypted end to end between you and the server (TLS). Access works without a password, so there is no password database that could be stolen. The servers are in Germany. Only people who need it for operation have access to the database; every intervention from the admin area is logged.

Messages are encrypted between you and the server, not end-to-end: the server must be able to read them to deliver them, to translate them and to present them when reported. The app says so too.

Please send security vulnerabilities to sicherheit@flukto.com — we are grateful and we reply.

9. Backups

In case of a failure we back up the data every six hours to a second server (also in Germany, outside the data centre). Messages, requests, chat photos, notes with their pictures, translations and reports are never contained in these backups — the promise "no archive" holds here too. Contained are accounts, profile photos and counters; after an account deletion these remnants also disappear with the rotation of the backups, at the latest after five weeks.

10. Changes

If something material changes, this policy gets a new version and the app asks you again at the next start. The current version is shown at the top.