Privacy Policy
Effective date: 16 May 2025 · Last updated: 11 October 2026
This Privacy Policy explains how Filltr (“we”, “our”, or “us”) collects, uses, stores, and protects your personal data when you use the Filltr apps for Android and iPhone and the website filltr.de. Filltr is operated by Filltr UG (haftungsbeschränkt), a company registered in Berlin, Germany, and is subject to the EU General Data Protection Regulation (GDPR).
Data controller: Filltr UG (haftungsbeschränkt), c/o Taras Nikolenko, Wiclefstraße 65, 10551 Berlin, Germany (Amtsgericht Charlottenburg, HRB 291045 B) — privacy@filltr.de
1. Age Restriction
Filltr is an adult dating platform intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we become aware that an account belongs to a minor, we will immediately terminate that account and delete all associated data. By creating an account, you confirm that you are at least 18 years old.
2. Data We Collect
2.1 Account & Profile Data
When you register, we collect your email address and create a unique user ID. Your date of birth is required to confirm that you are 18 or older; you can hide your age on your profile. Everything else on your profile is optional: display name, pronouns, gender, relationship status, what you are looking for, the community archetypes you select for yourself (“I am”) and those you are interested in (“Into”), height, weight, body type, ethnicity, sexual position, a short bio, tags, health information and up to three photos. Profile information is visible to other members according to your settings. Section 3 explains the data that is especially protected.
2.2 Photos & Media
Photos and media you upload are stored on our own servers in the EU (Finland). Every image is automatically classified (safe / suggestive / explicit) by an image-moderation model that runs on our own servers, so images are never sent to a third party for scanning. On public surfaces — profile photos and feed posts — an image the classifier rejects is removed automatically, without a prior human review; you can appeal (Section 9). In chats the classification is used to blur explicit images for members who chose that. Images are not used to train AI models.
Expiring photos are photos shared in a chat that disappear after the time the sender chose; they are then deleted from our servers. Free accounts can send three per 24 hours; with Premium there is no limit.
2.3 Messages & Communications
Chat messages are stored in our own database on our servers in the EU (Finland) to deliver the service. Messages include text, media, timestamps, read receipts and typing indicators. We review a conversation only when it has been reported to us (Section 9). What happens to messages when an account is deleted or blocked is described in Section 6.
2.4 Location & Distance
Filltr uses your device’s location to show you nearby members and calculate approximate distances. We store your last known coordinates and use them only for proximity features. We do not sell or share your location with advertisers. Other members see only an approximate distance (e.g. “2 km away”), never your exact coordinates. You can revoke location permission at any time in your device settings.
Maps in the Android app — the location picker and previews of locations shared in chat — are rendered by Google Maps; on iPhone by Apple Maps. When a map is shown, the map provider receives the map area being displayed and your IP address; see Google’s privacy policy and Apple’s privacy policy. We do not send your account identifier to either, and your stored location is never shown on a map to other members.
2.5 Subscriptions & Payments
Premium subscriptions are bought through Google Play (Android) or the App Store (iPhone, once available). We never see your payment card details. We receive from the store a purchase token (or transaction ID), the product, the subscription period, the renewal status and the acknowledgement status, and store them to grant Premium. Subscriptions are managed (upgrade, cancel, refund) in your Google Play subscriptions or your Apple account settings.
2.6 No Analytics, No Crash-Reporting SDK
The apps run no usage analytics and no crash-reporting service: we do not track the screens you visit, the actions you take or how long you use the app, and there is no advertising identifier. If you have allowed your phone to share diagnostics with app developers (Android: “Usage & diagnostics”; iPhone: “Share With App Developers”), Google or Apple show us aggregated crash reports without your identity. That setting belongs to your phone and you can change it there.
2.7 Profile Views
When you view another member’s profile, a view is recorded so they can see who visited. With Incognito Mode (Premium) your views are not recorded. View records are deleted after 30 days.
2.8 Intention Mode
If you activate Gentle or Direct intention mode, the mode is stored on your profile and shown to members with the same or a compatible mode. It is cleared when you turn the mode off.
2.9 Reports & Moderation Data
When you report a member or content, we store the reason, any description you add and the reported content or account, and we confirm receipt. Our team reviews reports. False or malicious reports may lead to action against the reporting account.
2.10 This Website
When you visit filltr.de, our web server records your IP address, the page requested, the time and your browser’s user agent; these logs are deleted after 14 days. The website sets no tracking cookies (see the Cookie Policy). The contact, feedback and waitlist forms send what you enter (name where asked, email address, message) as an email to our support mailbox, hosted by Zoho Mail; it is not stored anywhere else. The support assistant sends your questions to a language model that runs on our own server; the conversation is not stored, and your IP address is used only in memory to limit request rates.
3. Especially Protected Data (GDPR Art. 9)
Some data on Filltr belongs to the special categories of personal data under Article 9 GDPR:
- Sexual orientation and sex life — being a member of Filltr, and the profile details you choose (for example “I am” / “Into”, what you are looking for, sexual position), can reveal them.
- Ethnicity — if you choose to add it.
- Health — HIV status, date of your last test, health practices and vaccinations, if you choose to add them.
We process this data only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give in the app; for health information in a separate step before your first entry. Every one of these fields except membership itself is optional. Health information is shown only to members you have exchanged messages with; the other fields are shown on your profile. You can withdraw your consent at any time by removing the information from your profile, or entirely by deleting your account; withdrawal does not affect processing that took place before. More on health data: Health Data Privacy.
4. Purposes, Legal Bases and Storage Periods
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Account and sign-in | Email address, password (stored only as a hash), user ID, sign-in sessions; Google account ID if you sign in with Google | Contract (Art. 6(1)(b)) | While your account exists; idle sign-in sessions are removed after 60 days |
| Your profile and showing it to other members | Display name, date of birth, profile details you choose to fill in, photos, approximate distance | Contract (Art. 6(1)(b)); for special-category data your explicit consent (Art. 9(2)(a)) — see Section 3 | While your account exists, or until you remove the item |
| Browsing and distance | Last known location of your device (or the place you pick) | Contract (Art. 6(1)(b)) | Overwritten by each new location; deleted with your account |
| Chat, likes and notifications | Messages, media you send, likes, read status, push-notification token | Contract (Art. 6(1)(b)) | While the conversation and both accounts exist; see Section 6 for deleted accounts |
| Profile views | Who viewed which profile and when | Contract (Art. 6(1)(b)) | 30 days |
| Premium subscriptions | Purchase token, product, period, renewal and acknowledgement status (never card details) | Contract (Art. 6(1)(b)); after account deletion our legitimate interest in handling refunds, chargebacks and disputes (Art. 6(1)(f)) | While your account exists; after deletion until the end of the third calendar year (regular limitation period, §§ 195, 199 BGB) |
| Safety: automated image moderation, reports, enforcement | Photos and media you upload, reports you send or receive, moderation decisions | Legitimate interest in a safe platform and in preventing illegal content (Art. 6(1)(f)); obligations under the EU Digital Services Act (Art. 6(1)(c)) | Moderation records 12 months; see Section 6 |
| Security and abuse prevention | IP address, request logs, rate-limit counters | Legitimate interest in running a secure service (Art. 6(1)(f)) | Web server logs 14 days; application logs (shortened account IDs, no content) up to 8 weeks |
| Legal obligations | Data that a court, authority or law requires us to keep or hand over | Legal obligation (Art. 6(1)(c)) | As long as the obligation requires |
| Website contact, feedback and waitlist forms | Name (contact and feedback forms), email address, your message | Pre-contractual / contractual request (Art. 6(1)(b)); legitimate interest in answering enquiries (Art. 6(1)(f)) | As long as needed to handle your request; waitlist emails until we have told you about the launch |
| Support assistant on the website | The questions you type, your IP address (only for rate limiting, in memory) | Legitimate interest in answering support questions (Art. 6(1)(f)) | Not stored — processed to answer and then discarded |
Where we rely on legitimate interests, the interest is named in the table. We send only transactional emails and notifications (for example a new message), never marketing without your consent. Providing data is not required by law; without the account and sign-in data the service cannot be provided.
5. Service Providers and Recipients
| Service | Purpose | Location |
|---|---|---|
| Hetzner Online | Server hosting for our self-managed backend, database, file storage and backups | EU — Helsinki, Finland |
| Zoho Mail | Support and transactional email | Global (Zoho Corporation) |
| Google Play Billing | Subscription payments (Android) | Global (Google) |
| Firebase Cloud Messaging | Push notifications (Android) | Global (Google) |
| Google Sign-In | Optional sign-in with a Google account | Global (Google) |
| Google Maps | Maps in the Android app | Global (Google) |
| Apple | App Store purchases, push notifications and maps on iPhone (once available) | Global (Apple) |
| GIPHY | GIF search & delivery in chat (only when you open the GIF picker or view a GIF) | USA (Giphy, Inc.) |
AI processing is self-hosted: the website’s support assistant and our image moderation run on Filltr’s own servers in the EU (Finland). Your questions and your photos are never sent to third-party AI providers.
GIFs in chat: when you open the GIF picker, your search terms go directly from your device to GIPHY; when you view a GIF, your device loads it from GIPHY’s content delivery network. GIPHY receives your IP address — as with loading any web image — but never your Filltr account identifier; see GIPHY’s Privacy Policy.
Where data is transferred outside the EEA (Google, Apple, Zoho, GIPHY), the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or by Standard Contractual Clauses.
We do not sell your personal data. Beyond the providers above we share data only with other members (your profile, photos, distance and intention mode, as described in Section 2), where the law or a court order requires it or it is necessary to protect someone’s life or safety, and in a merger or sale of the business, after telling you.
6. How Long We Keep Data
- Your account — while it exists.
- When you delete your account — your profile, photos, likes, views, favourites and messages are deleted immediately. Exceptions:
- a copy of your conversations is kept for 90 days so that reports about them can still be investigated, then deleted;
- if there were reports or moderation actions involving your account, the moderation record is kept for 12 months, then deleted;
- subscription records are kept until the end of the third calendar year after deletion for refunds, chargebacks and disputes, then deleted.
- When you block someone — the conversation disappears for both of you; a copy is kept for 90 days for reports, then deleted.
- Profile views — 30 days.
- Moderation records and the moderation audit log — 12 months.
- Feedback text and safety-system events — 90 days.
- Data exports — the download file is deleted after 7 days.
- Server logs — web server logs 14 days; application logs, which contain shortened account IDs but no content, up to 8 weeks.
- Backups — daily backups are kept for 7 days on the server, plus Hetzner’s server backups (the latest seven); deleted data disappears from backups when they roll over.
7. Your Rights
- Access (Art. 15) — a copy of the data we hold about you.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — delete your data; you can delete your account in the app under Settings.
- Data portability (Art. 20) — download your data as a machine-readable file in the app under Settings → Download my data.
- Restriction (Art. 18) — ask us to pause processing in certain cases.
- Withdraw consent (Art. 7(3)) — at any time, with effect for the future (see Section 3).
To exercise any right, email privacy@filltr.de. We answer within one month. You also have the right to lodge a complaint with a supervisory authority (Art. 77) — the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, or you can contact the authority where you live or work.
8. Account Deletion & Data Export
You can delete your account at any time in the app under Settings. Deletion is permanent and takes effect immediately, with the exceptions listed in Section 6. You can download a copy of your data first under Settings → Download my data. If you cannot use the app, see the Data Deletion Request page.
9. Moderation & Automated Decisions
We enforce our Community Guidelines in two ways:
- Automated: the self-hosted image classifier (Section 2.2) removes rejected photos from profiles and the feed without a prior human review. It does not compare images against databases of known illegal material.
- Human: reports and appeals are reviewed by our team. Access to profiles, photos and reported messages is limited to what a review needs, logged, and never used for any other purpose.
If we act on your content or account, we tell you why in the app. You can appeal directly in the app from that notice, or by email to support@filltr.de; a person reviews every appeal.
10. Security
We use TLS encryption in transit, row-level security policies in our database, token-based authentication and regular dependency updates. No system is perfectly secure — if you believe your account has been compromised, contact support@filltr.de immediately.
11. Children’s Privacy
Filltr is strictly for adults (18+). We do not knowingly collect data from children. If you believe a minor has created an account, report it to safety@filltr.de and we will act immediately.
12. Changes to This Policy
We update this Privacy Policy when the service or the law changes. We announce material changes in the app and update the date above. Where a change needs your consent, we will ask for it.
13. Contact
For privacy questions, data requests, or to exercise your rights:
- Email: privacy@filltr.de
- Legal: legal@filltr.de