Your data

Privacy policy

Last updated: Oct 25, 2026.

A dating site handles intimate information. Here, without the jargon, is what Hugflirt does with it — and above all what it doesn’t: no reselling, no targeted advertising, no audience-measurement tools.

Data controller

The Hugflirt service is published by the Hugflirt team, an independent publisher based in France. For any question about your data: team@hugflirt.com.

Data we process

Account: email address, password (stored hashed, never readable), first name or nickname, date of birth, language.
Profile, entirely optional except for gender: photos, city, bio, gender you’re looking for, education, job, lifestyle habits, interests, languages spoken.
Activity: likes, matches, messages, profile visits, blocks and reports.
Security: IP address and timestamp of sign-in attempts, to limit attacks; technical server logs.
Payment: Hugflirt never receives your banking details. Stripe processes them; we only receive the plan you chose, its status and a customer ID.

Sensitive information

Your sexual orientation and your religion are sensitive data within the meaning of the GDPR (Article 9). They are optional and are only processed with your explicit consent, which you give by filling them in on your profile. You can withdraw it at any time by deleting them.

Why, and on what legal basis

Providing the service (sign-up, picks, matches, messaging): performance of the contract.
Securing accounts, preventing abuse, handling reports: legitimate interest of Hugflirt and its members.
Managing subscriptions: performance of the contract and accounting obligations.
Responding to requests from the authorities: legal obligation.

Who sees what

Your profile is only visible to signed-in members, never to visitors or search engines. You can remove it from discovery in your settings.
Your private photos are only visible to your matches.
Your messages can only be read by you and your match.
Only your city is shown: Hugflirt does not collect your precise location.
Your email address is never shown to other members.

Service providers

Hosting: OVHcloud (servers located in Canada, a country recognized by the European Commission as providing an adequate level of protection). Payments: Stripe. Email delivery: a transactional email provider, with no tracking pixels and no link rewriting. These providers do not use your data for their own purposes.

Retention periods

Account: as long as it is active. An account that has been inactive for three years is deleted.
Account deletion (Settings): profile, photos, likes, matches and messages are erased immediately; encrypted backup copies disappear within 14 days.
Reports: one year after they are handled.
Sign-in attempts: 24 hours at most. Technical logs: 30 days at most.
Invoices: kept by Stripe in line with accounting obligations.

Your rights

You can access your data, correct it, erase it, object to its processing, restrict its use and take it with you. From your settings, you can download all your data (JSON file) and delete your account. For any other request: team@hugflirt.com. You can also file a complaint with the CNIL (the French data protection authority, cnil.fr).

Cookies

Hugflirt only uses strictly necessary cookies: the session (staying signed in), your chosen language and protection against fraudulent requests. No advertising or audience-measurement cookies — so no consent is requested.

Security

Encrypted connection (HTTPS), hashed passwords (Argon2id), one-time sign-in code, rate-limited attempts, photos re-saved without metadata and served only to authorized members.