Privacy Policy

Last updated: November 9, 2026

Flam is a game for couples, available as an iOS app and on the website flam-couple.app. This policy explains what data is processed when you play, why, by whom and for how long. It applies to the app and the website alike.

At a glance

• No account. Your first names, your desires and your history stay on your device.
• To improve the game, we receive usage metrics (game played, duration, Daily Dare completed) and the feedback you choose to give, without your first names or any identifier.
• The AI features send your request to Mistral AI to create the content, and an anonymous copy reaches us so we can improve the service.
• No ads, no advertising trackers, no sale of data.

1. Who is responsible for your data

Game Duo, sole proprietor — SIRET 831 785 910 00025 — .

2. What stays on your device

The players' first names and genders, the chosen level, your preferences, the desires you tick, the couple's anniversary date, the history of your games and of the content created by the AI, and, on the website, the email address used for your purchases. This information is stored on your device (app or browser storage): we have no access to it. You can erase it by deleting the app, or by clearing the website's data in your browser.

Reminders and notifications are scheduled on your device: we receive nothing from them.

3. What is sent to us, and why

3.1 Usage metrics (app and website). At the end of a game: the game, its duration and your status (free, trial or subscriber). When you complete the Daily Dare: your status. When a purchase offer is shown, then if you start a purchase: the screen, the product, the outcome (completed, cancelled, pending or failed), the platform (app or website) and your status. For these metrics and for your feedback (3.2): the country the connection comes from, which our host derives from the IP address; the address itself is not recorded. No first name, no identifier. We use them to know which games are played and to improve them. Retention: 3 months, then only as totals.

3.2 Your feedback (💛, 👎, ✍️). When you rate a dare or a truth, or suggest another wording, we receive the text of the dare (your first names are replaced with a neutral placeholder before it is sent), the game, the level, and your suggestion if you write one. We use it to correct and improve the texts. A weekly summary is sent to us by email. Retention: 3 months; feedback cannot technically be deleted before then. Do not write any personal information in a suggestion.

3.3 The AI features (“My AI level”, “Surprise night”, “Custom dare”). When you use them, we send Mistral AI, which runs the open DeepSeek model on its servers in Europe, what you describe, the type of couple (a woman and a man, two women, two men), the mood, the intensity, the prop you chose, and, for the Custom dare, the desires you have both ticked. This information may reveal your sexual orientation and your sex life: it is sensitive data. A notice says so on each creation screen; by starting the creation, you accept this transfer. If you do not want this, do not use these features: the rest of the game works without them.

Your request goes through our server, which forwards it to Mistral AI without your IP address or any identifier, and does not keep it. Mistral AI processes it to create the content; it does not use it to improve its products and keeps it for 30 days at most, to detect abuse. It is not sent to the company DeepSeek. The content created is stored on your device.

To improve the service, a copy of your request and of the content created is sent to us by email. It contains no name, no IP address and no identifier: we cannot tell who it comes from. We keep it for 12 months at most. Do not write anything in your description that could identify you.

3.4 Website visits (website only). We count page views: the page, the language, the country, the site you came from, and a technical identifier computed from your IP address and your browser, renewed every day, which does not allow us to track you from one day to the next. No cookies. We use this to measure the website's audience. Retention: 3 months, then only monthly totals.

3.5 Connection data (app and website). Like any server, ours receives your IP address and the type of your device or browser. Your IP address is used to block abuse, for example too many requests. It is not recorded in any of our metrics; our host's technical logs, which contain it, are deleted after 3 days.

3.6 Purchases. In the app, purchases are handled by Apple: we receive neither your payment details nor your Apple identity. Apple also notifies us when a subscription starts, expires or is refunded. Its message includes a transaction number, which we do not keep: we only retain anonymous counts, with no time limit (start month, plan, number of months subscribed). On the website, payment is processed by Stripe, which collects your payment details; we never have access to them. Stripe keeps your email address and your purchases. Our server keeps the list of your purchases linked to your email address, to give you access to the paid content and restore it on another device, for as long as that access is valid. Your email address is also stored in your browser, so you are not asked for it again. Payment records are kept for 10 years, as the law requires.

3.7 If you write to us. Your email address and your message, to reply to you. Retention: 3 years after the last exchange.

4. What this processing is based on

The GDPR requires us to state what each processing activity is based on:

• our legitimate interests (improving the game, understanding how it is used, protecting it from abuse and replying to you) for usage metrics, feedback, copies of AI requests, website visits, connection data and your messages;
• your acceptance, when you start an AI creation, for sending your request to Mistral AI;
• the contract between us, for your purchases;
• the law, for keeping payment records.

5. Who receives your data

Our service providers, only for the purposes described above:

• Cloudflare, Inc. (United States): hosting of the website and the server, usage and audience metrics, technical logs;
• Mistral AI (France): AI content creation;
• Resend, Inc.: sending the publisher's internal emails, from the European Union;
• Google (Gmail): the publisher's mailbox, where these emails arrive;
• Stripe Payments Europe, Ltd. (Ireland): payments on the website;
• Apple: purchases in the app.

Some of them are based in the United States: these transfers rely on the safeguards provided for by the GDPR (EU-U.S. Data Privacy Framework or standard contractual clauses), included in their terms. We do not sell or rent your data.

6. What we do not do

No ads, no advertising identifier, no tracking across apps or websites, no profiling, no automated decision-making about you.

7. Your rights

You can request access to your data, its rectification, its erasure, the restriction of its processing and its portability, object to processing based on our legitimate interests, and give instructions about what happens to your data after your death. Write to ; we reply within one month. Metrics, feedback and copies of AI requests contain no identifier: we therefore cannot find the ones that concern you, and they are deleted automatically (after 3 months for metrics and feedback, 12 months for copies).

You can also lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority, or with the data protection authority of your country.

8. Security

All connections are encrypted (HTTPS). Access to metrics and emails is restricted to the publisher.

9. Age

Flam is for adults only (18 and over). We do not knowingly collect any data about a minor; if you think this has happened, write to us and we will delete it.

10. Changes

We update this policy when the game changes; the date at the top of the page shows when. Any significant change is announced in the app and on the website.