Biometric Notice

1. Who we are

2. What biometric data is

3. When we collect it

• 1.
  Photo checks. Every photo you upload goes through our photo checks. Our own servers find the faces in the photo and count them. They look for nudity too. If the photo shows only one face, an automated system also estimates its age. This is the only trait it estimates: it never guesses sexual orientation, race, religion or any other trait (EU AI Act, Article 50(3) notice). If our tools are unsure about a photo that shows one face or none, Google's Gemini AI service also looks at it, for example to check whether the person could be under 18. A photo with more than one face goes to a trained member of our team instead: our tools and Google never measure or estimate the age of other people's faces. Photo checks make no face code.
• 2.
  The selfie check. You record a short video selfie on your phone, in the Flowting app or in your phone's web browser, and follow a random prompt (for example, turn your head or blink). Your phone checks the movement; this face reading stays on your phone. Apple or Google confirms that the app is genuine; they receive no face data. Then two or three still images (frames) from the selfie come to us:

  • Our own servers measure the face in the frames and in each of your profile photos that shows only you, and compare them.
  • Our own servers compare the face in the selfie with the face codes of accounts we banned for safety (see section 5). We skip this step while you are in the City of Portland, Oregon.
  • Google's Gemini AI service looks at one frame to check that a live person was in front of the camera (not a photo, a screen or a mask). It also looks at that frame and each of your solo profile photos to check that they show the same person.
  • If the result is unclear, you get a second prompt. If it is still unclear, or if the selfie looks like a banned account, a trained member of our team compares the selfie frames with your photos.
• 3.
  When you change your photos. A passed selfie check counts only for the photos it was compared with. If you add or remove a photo that shows only you, you take the selfie check again.
• 4.
  A ban for safety. If we ban an account for safety, we may make one face code from one of its profile photos (see section 5).

4. Why we collect it

• check that you are a real, live person and that your photos are of you
• check that you look like an adult, and that photos do not show children
• keep people we banned for safety from coming back
• let you add photos, say yes to people and appear in other people's picks

5. The ban list

• We make the face code only from a profile photo that the person's own passed selfie check matched. We never make one from a photo that might show someone else.
• We never make a face code of a person who is, or may be, under 18. For those bans we use other signals, such as a scrambled form of the email address.
• We keep the face code for the ban, and destroy it 24 months after the ban. We destroy it at once if the ban is lifted, for example after an appeal.
• The face code stays if the banned person asks us to delete their data or deletes their account, because the law lets us keep data to prevent fraud and harassment (for example Washington RCW 19.373.100(3)). We tell them so in our answer. It still goes 24 months after the ban.
• Every selfie check compares the new face with these face codes. A match never bans anyone on its own: the selfie is held, and a person on our team decides.
• A person check (section 10) makes no face code, so it is not compared with the ban list, and a ban never makes a face code of a member who chose it.
• City of Portland, Oregon. Portland City Code chapter 34.10 does not allow this kind of search (one face against many) in services open to the public in the city. If a location check finds you inside the City of Portland, your selfie check does not search the ban list. This stays so until a check of your home location finds you outside the city. The comparison of your selfie with your own photos still runs.

6. How long we keep it (our retention and destruction schedule)

7. Who receives it

• Our own servers, hosted by Hetzner in the United States (Ashburn, Virginia). They run the photo checks, measure and compare faces, and search the ban list.
• Cloudflare (R2 storage) stores your photos and, for the times in section 6, selfie images, in the EU. It stores no face measurements.
• Google (Gemini on Google Cloud Vertex AI) checks one selfie frame for a live person, compares it with your solo profile photos, and gives a second opinion on unclear photos. Google may process it in any of its regions. Google works only on our instructions and may not use your data to train its models. Google keeps no copy after it answers, except that its automatic abuse checks may flag an image and keep it for up to 90 days for review by Google staff.
• Apple and Google device checks (App Attest, Play Integrity) confirm that the app is genuine. They receive no face data.
• Our team (James or our contracted safety backup person) sees selfie frames only when a check stays unclear after a second prompt, or when a selfie looks like a banned account.
• No one else, unless the law requires it (for example a valid court order).

8. How we protect it

• Photos and selfie images travel over encrypted connections and are kept in private storage, reached only through short-lived links.
• Face measurements exist only in memory during a check. We never write them to our database, logs or backups. The only stored face codes are those on the ban list.
• Our logs, crash reports and analytics never receive face images, face measurements or match scores.
• Only our owner and our safety backup person can open the selfie review, and every look is recorded.

9. If something goes wrong (incident response)

• 1.
  We stop the access, secure the systems and keep a record of what happened.
• 2.
  We find out which data and which people are affected.
• 3.
  We destroy or protect the data at risk, and ask our providers to do the same.
• 4.
  We tell the affected people, and the authorities where the law requires it, without unreasonable delay. In Florida, for example, that is within 30 days.
• 5.
  We review what went wrong and change our controls so it does not happen again.

10. Can I say no?

• If you say no, you cannot finish joining Flowting, unless you choose a person check where it is offered (below). Every member’s photos and selfie are checked, because the checks confirm that members are real adults whose photos are them. You can stop at that screen and come back later, or delete your account at any time.
• In the European Economic Area and the United Kingdom, you can choose a person check instead. Tap "Have a person check instead" on the face consent screen. You take one selfie photo while you copy a pose we show you, and a trained member of our team compares it with your profile photos by eye. We make no face code from it, measure nothing in it, and do not compare it with the ban list, so it is not biometric data. We delete the photo when our team decides, and never later than 30 days after you take it. Our photo checks still find and count the faces in your photos and estimate the age of a photo that shows one face (section 3), because they keep children and other people’s photos off Flowting; they make no face code. You can switch to the face check later by agreeing on that screen.
• Elsewhere there is no other way to get verified at this time. If we add another way later (for example an ID check), we will update this notice.
• Saying no does not affect your other rights or the price of Flowting Plus.

11. Can I withdraw my consent or ask for deletion?

• Go to Settings, then Your permissions, then Face checks and the selfie check, then Withdraw. Or email [email protected].
• Your selfie check no longer counts, and we remove its match scores at once. We stop face checks on your photos. You cannot say yes to people until you agree again and take a new check.
• We delete any selfie images we still hold at once. If your selfie is held because it looked like a banned account, a person still reviews the hold, without the images.
• Your consent record stays as proof of what you agreed to, as section 12 of our Privacy Policy explains.

12. People in your photos

13. Washington residents

14. Your rights

15. Review and changes

16. Contact