Privacy Policy

Last updated: 2 August 2026

This Privacy Policy explains how Flokka ("Flokka", "we", "us", or "our") collects, uses, and protects your personal data when you use our website and services at flokka.me (the "Service").

Flokka is operated by ShePlaysPro OÜ, a company registered in Estonia (registration number 17201843), which acts as the data controller for the purposes of the EU General Data Protection Regulation (GDPR).

If you have any questions about this policy or your data, contact us at support@flokka.me.

1. Who this policy applies to

Flokka is intended for students aged 16 or older. We do not knowingly collect personal data from anyone under 16. If you are under 16, please do not use the Service. If we learn that we have collected data from a person under 16, we will delete it.

By using Flokka, you confirm that you are at least 16 years old.

2. What data we collect

2.1 Data you provide

When you create an account and use Flokka, we collect:

• Account data: your email address and a securely hashed password.
• Profile data: your name, university, study programme, course, degree level, skills you know and want to learn, languages, avatar image, and (optionally) a username.
• Your CV: if you choose to upload one, we store the PDF file you provide. A CV usually contains additional personal data such as your contact details, education history, and work experience. Uploading a CV is entirely optional, and you can remove it at any time.
• Content you create: messages, files you share in chats, polls and your votes in them, checklists and tasks, study resources you save (including titles, subjects, topics, comments, tags, and any files or links attached), shared documents and notes, decisions and tasks in groups, chat folders you create, chat appearance settings such as wallpapers, mentions of other users, reviews and endorsements you write, and connection requests.

2.2 Data we collect automatically

When you use the Service, we automatically collect:

• Technical data: your IP address, browser type, device information, and cookies.
• Approximate location: your country and city, derived from your IP address. We do not collect precise GPS location.
• Usage data: how you interact with the Service, collected through analytics.

2.3 Cookies

We use cookies for two purposes:

• Essential cookies: required for the Service to function, such as keeping you logged in. These do not require your consent.
• Analytics cookies: used to understand how the Service is used (see Section 4). These are only set after you give your consent through our cookie banner.

You can withdraw your consent to analytics cookies at any time through your browser settings or our cookie settings.

3. Why we collect your data and our legal basis

Under the GDPR, we must have a legal basis for processing your data. We process your data for the following purposes:

4. Analytics

We use Google Analytics, a service provided by Google LLC, to understand how visitors use the Service. Google Analytics uses cookies and collects data including your IP address and usage patterns.

This data is processed by Google, which may transfer it to servers in the United States. Google participates in the EU–U.S. Data Privacy Framework, which provides a legal basis for such transfers.

We only enable Google Analytics after you consent through our cookie banner. You can learn more about how Google uses data at policies.google.com/privacy and opt out using the Google Analytics Opt-out Browser Add-on.

5. Who we share your data with

We do not sell your personal data. We share data only with service providers who help us run the Service:

• Supabase — database, authentication, and file storage. Your data is hosted in the European Union.
• Vercel — website hosting.
• Cloudflare — DNS and email routing.
• Resend — sending transactional emails (such as sign-up confirmation and password reset).
• Google Analytics — usage analytics (with your consent).

Each of these providers processes data on our behalf under a data processing agreement, and only for the purposes described in this policy.

We may also disclose your data if required by law, or to protect the rights, safety, and security of Flokka, our users, or the public.

What other users can see

Some of your data is visible to other users by design:

• Your profile (name, university, skills, etc.) is visible according to your privacy settings.
• Your CV, if you upload one, can be viewed by other users who can see your profile. It is shown inside the Service and is not made publicly available on the internet.
• Messages and files you send are visible to the people or groups you send them to.
• Polls, checklists, resources, and documents you create in a chat are visible to the members of that chat. In polls marked as anonymous, your individual vote is never shown to anyone, including the poll's author.
• Reviews and endorsements you write may be shown to others (anonymised where applicable).

Your chat folders and chat appearance settings are private to you and are not visible to other users.

You control much of this visibility through Settings → Privacy.

6. Where your data is stored

Your core data is stored in the European Union through Supabase's EU-region infrastructure. Some service providers (such as Google Analytics) may process limited data outside the EU, as described in Section 4, under legal safeguards such as the EU–U.S. Data Privacy Framework.

7. How long we keep your data

We keep your personal data for as long as your account is active.

When you delete your account:

• Your profile and personal data are deleted.
• Your avatar is removed.
• Your CV file is permanently deleted from our storage.
• Messages you sent in shared chats and groups remain, but are shown as sent by a "Deleted user" without your name, avatar, or a link to your profile — this keeps conversations readable for other participants.
• Reviews you left for others are anonymised (the ratings remain, but they are no longer linked to you).

We may retain limited data longer where required by law.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (you can delete your account at any time in Settings → Account → Delete account).
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with a supervisory authority. If you are in the EU, you may contact your local data protection authority, or the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

To exercise any of these rights, contact us at support@flokka.me.

9. How we protect your data

We take reasonable technical and organisational measures to protect your data, including:

• Encrypted connections (HTTPS).
• Row-level security on our database, so users can only access data they are authorised to see.
• Hashed passwords.
• Stripping of location metadata (EXIF) from uploaded images.
• Optional two-factor authentication for accounts.

No system is completely secure, but we work to protect your data and to address any vulnerabilities promptly.

10. Changes to this policy

We may update this Privacy Policy as the Service evolves. If we make material changes to how we handle your data, we will update the "Last updated" date and notify you through the Service. Your continued use of Flokka after changes take effect means you accept the updated policy.

11. Contact

If you have any questions, requests, or complaints about this Privacy Policy or your data, contact us at:

ShePlaysPro OÜ
Allveelaeva tn 4-158, 10415 Tallinn, Estonia
Registration number 17201843
Email: support@flokka.me