Privacy Policy
Version 2026-10 · Last updated: 28 September 2026 · Applies to the Quirky app and to thequirkyapp.com
In short. Quirky is a dating app for adults aged 18 and over. To work, it must process data the law treats as sensitive — such as your photos, your location and information revealing your romantic and sexual life. We process that sensitive data with your consent, collected at sign-up; other data is processed to perform our contract with you, to meet legal obligations or under legitimate interest, as detailed below. We never sell your data, and you can export or delete everything from inside the app at any time.
1. Who controls your data
The controller of personal data processed in Quirky is:
FIRENZE PROGRAMAÇÃO DE SITES E APLICATIVOS LTDA.
Company ID (CNPJ) 66.777.790/0001-24
Avenida Paulista, 2073, Suite 2220 — Bela Vista, São Paulo/SP, 01311-940, Brazil
Data Protection Officer: firenze@firenzeprogramacao.com.br
This Policy is specific to Quirky and prevails, as to this app, over Firenze's general policy.
2. What we collect and why
| Category | What it includes | Why we use it | Legal basis (LGPD) |
|---|---|---|---|
| Account | Email and password, or the identifier of the Google/Apple account used to sign in. | Create and authenticate your account; restore access. | Performance of a contract (art. 7, V) |
| Profile | Name or nickname, date of birth, gender, who you want to meet, photos and videos. | Build your profile, confirm you are 18 or older, and present you to other people. | Contract and consent (art. 11, I) |
| Content | Your quirks, chat messages, media sent in chat, testimonies you receive and testimonies you write about people you matched with (published on their profile only if they approve, with your name). | Provide the core experience: posting, chatting and receiving testimonies. | Performance of a contract (art. 7, V) |
| Location | Your approximate area (about 5 km × 5 km), when you allow it in your operating system. | Show nearby people and an approximate distance. The app rounds your position on the device itself to an area of about 5 km × 5 km before sending it, and only updates it when you move more than 3 km. Other people see that approximate area and the distance computed from it, never your exact position. You can hide your location in Settings. | Consent (art. 7, I) |
| Verification | A selfie taken on the spot with the device camera, for a member of our team to compare with your profile photo. We do not use facial recognition. The selfie is visible only to the team and is deleted after the review — or, if nobody reviews it, within 30 days; the badge is removed if you change your profile photo, and you can verify again. | Reduce fake profiles and make the community safer. | Specific consent (art. 11, I) |
| Interactions | Likes (Would Date), matches, blocks and reports. | Create matches, enforce blocks and investigate reports. | Contract and legitimate interest (art. 7, IX) |
| Technical | Device model, OS version, language, push notification identifier (token) and crash reports (Firebase Crashlytics, kept for 90 days). | Deliver notifications, fix errors and keep the app stable. | Legitimate interest (art. 7, IX) |
| App usage | Screens opened and actions taken (for example: sign-up, login, sending a message, posting a quirk, reporting, blocking), with a random installation identifier — without your name, without content and without an advertising identifier (Google Analytics for Firebase). | Understand where the app fails or confuses people and measure usage during the test phase. The identifier is reset when you sign out. | Legitimate interest (art. 7, IX) |
| Access records | Each time the app is started with your account signed in: date and time, the IP address the request came from, the device's operating system (Android or iOS) and the app version. Kept for 6 months and deleted automatically when they expire; included in your data export. Kept for the 6 months even if you delete the account — the mandatory retention of the Brazilian Internet Act (art. 15), which the law itself carves out of the right to erasure (art. 7, X; LGPD art. 16, I). | Comply with the legal duty to keep application access records (Brazilian Internet Act, art. 15) and investigate abuse. | Legal obligation (art. 7, II) |
| Technical logs | Our servers' operational logs, which may contain your account identifier (never content), deleted automatically after 30 days. | Diagnose failures and abuse. | Legitimate interest (art. 7, IX) |
3. Sensitive personal data
Because Quirky is a dating app, some of what you provide is sensitive personal data under art. 5, II of the LGPD — in particular data revealing your sexual life or sexual orientation, your image in photos and videos, and the selfie used for profile verification — which, being a photo of your face, we handle with the same care as sensitive data, although it is not processed by facial recognition.
We process such data with your consent, collected at sign-up as a separate authorization, ticked apart from your acceptance of the Terms, and, for the selfie, also at the moment you choose to request verification. You may withdraw that consent at any time by deleting the specific content, hiding your location or deleting your account, and we will then stop processing it.
4. Who sees what inside the app
- Visible to other users (once signed in): your name or nickname, photo, bio, age, gender and who you want to meet, verified badge, public quirks, published testimonies and your approximate area (about 5 km, or nothing if you hide your location).
- Never visible to other users: your email, password, exact date of birth, exact position, verification selfie, the list of people you blocked and the reports you filed.
- Blocks: for a block to work both ways, the app also records the block on the blocked person's profile; Quirky does not notify them, but we cannot guarantee they will never infer they were blocked.
- Likes (Would Date): the person you liked gets a notice without your name. If that person has Quirky Premium (or later gets it), they see your name and photo in their list of who liked them, even before a match. Undoing the like removes that record.
- Secret quirks: shown in the app only to people you expressly authorise and, for moderation, to our team. As with any photo or video in the app, the file can be saved or forwarded by whoever has access to it — do not post anything you would not accept seeing outside Quirky.
- Conversations: a conversation only exists between two people who matched (both chose "Would Date"). Nobody can send you a message, media or a testimony without a match, and there is no message button on your profile. As an extra layer, the option Only I can start a conversation (off by default, in Settings) means that, even after a match, only you may send the first message; if both people turn it on, nobody can start the conversation. The conversation is readable only by you, by the other person and, where there is a report or a legal obligation, by our team. Unmatching or blocking someone ends the conversation and deletes its messages on both sides.
5. Moderation, team access and automated decisions
To protect the community, every profile photo, quirk photo, photo sent in chat and the preview image of videos goes through automated analysis with Google Cloud Vision: quirks become visible to other people only after approval; profile and chat photos are analysed right after upload and removed if rejected. Videos are analysed through frames extracted on the server. Texts (messages, quirk descriptions and bio) go through an automated pattern check — requests for money, off-app contact details, slurs, threats and mentions of minors — that only flags the author for our team: no message is blocked, deleted or machine-read beyond that mark, and the flags are deleted with the account or after 12 months without new ones. Voice messages are not analysed automatically. An image indicating explicit nudity, violence or another breach of the Terms of Use is rejected and deleted immediately, and you are notified. A quirk the service cannot analyse is held for review by a member of our team; in chat and for the profile photo, the image is simply not delivered.
Under art. 20 of the LGPD you may request human review of any automated decision by writing to firenze@firenzeprogramacao.com.br. Because a rejected image is deleted at once, you will need to send it again by email for the review; we will tell you the outcome and, if the image complies with the Terms, how to repost it.
Identified members of our team access only what moderation requires: content held for review, verification selfies, reports (with the reporter's description) and, where there is a report or a legal order, conversations. Every moderation action (approve, remove, delete, verify, adjust a profile) is logged.
6. Who we share with
We do not sell your personal data and do not use it for third-party advertising. We share only with infrastructure providers acting as processors on our instructions:
- Google LLC (Firebase and Google Cloud) — authentication, database, file storage, server functions, notifications, crash reporting (Crashlytics) and usage statistics (Google Analytics for Firebase).
- Google LLC (Cloud Vision) — automated image moderation.
- Google LLC and Apple Inc. — only if you choose to sign in with your Google or Apple account: they give us the account identifier and email (Apple may provide a relay email). Their use of your data in that sign-in follows their own policies.
- Google LLC (Play Integrity) and Apple Inc. (DeviceCheck) — attestation that the app in use is genuine; they receive a technical device signal, without your name or content.
We may also share data where required by law, court order or a competent authority, and to investigate breaches of the Terms of Use.
7. Where data is kept and international transfers
Quirky's database, files (photos, videos, audio) and server functions are hosted in São Paulo, Brazil, on Google Cloud infrastructure. Some Google services we use have no regional residency and process data outside Brazil, mainly in the United States: authentication (email, credentials and account identifier), push delivery (device identifier), automated image moderation (images are sent to Google Cloud Vision for analysis and are not retained by the service after the analysis, under the Google Cloud data processing terms), usage statistics (Google Analytics for Firebase), crash reports (Crashlytics), the servers' technical logs and the hosting of this website. These transfers rely on art. 33, II of the LGPD, through the data-protection contractual clauses that form part of the Google Cloud and Firebase data processing terms, under which Google acts as a processor on our instructions.
8. How long we keep it
- While your account exists: we keep the data needed to run the app.
- After account deletion: your profile, quirks, media, likes, matches, blocks, conversations and sign-in credential are erased immediately. Technical copies of files and of the database kept for failure recovery are eliminated within 7 days; crash reports within 90 days.
- Access records: date and time, IP, operating system and version of each app start are kept for 6 months (Brazilian Internet Act, art. 15), including after account deletion, and deleted automatically when they expire.
- Technical logs: our servers' operational logs (which may contain your account identifier, never content) are deleted automatically after 30 days.
- Reports and moderation trail: reports received about your account (reason, the reporter's description and the account identifier) and the record of our team's actions on it (with the account identifier and, for content removed by the team, the address of the already deleted file) are kept for 12 months, even after deletion, to investigate abuse and answer authorities. When a report is received, we keep a copy of the reported content and of the last messages of the conversation between the two people for up to 12 months, to investigate, protect other people and answer authorities (LGPD art. 7, VI and IX; art. 16, I). Reports you filed are kept without your identity and without the text you wrote.
- Test phase: Quirky is currently in a closed testing phase. At the end of each testing round, all data collected during the test (participants' accounts, profiles, media, matches and conversations) will be permanently deleted, unless a participant expressly asks to keep their account for subsequent rounds.
9. Exporting or deleting your data
- Export: Settings → Export my data. After confirming your identity, the app generates a file (JSON) with your profile, registration data and preferences, your quirks, the testimonies you wrote and received, your likes, matches and blocks, the messages you sent (with links to their media), the reports you filed and your access records, and opens the share sheet so you can save it wherever you like. Received messages are not included in the automatic file (they also belong to their senders); you may request them at the email below. Usage data (Google Analytics) and crash reports are not included because they are not associated with your account. You may export up to 3 times a day; if your account holds an unusual volume of data, the file will say it is incomplete and you can request the rest at the email below.
- Delete your account: Settings → Delete account. Full instructions, and the list of what is erased, at thequirkyapp.com/delete-account.
10. Your rights
Under art. 18 of the LGPD you may at any time: confirm and access your data; correct incomplete, inaccurate or outdated data; request anonymisation, blocking or erasure of unnecessary or unlawfully processed data; request portability; learn who we share your data with; withdraw consent; request human review of automated decisions; and lodge a complaint with the Brazilian data protection authority (ANPD).
To exercise any of these, write to firenze@firenzeprogramacao.com.br. We reply within 15 days.
11. Under-18s
Quirky is not permitted for anyone under 18. At sign-up we ask for a date of birth and a declaration of adulthood; the app does not accept dates indicating under 18, and age is recomputed daily. We do not perform document-based age verification. If we learn that an account belongs to a minor, it will be deleted and the data erased. If you are responsible for a teenager and believe they created an account, tell us immediately at the email below.
12. Security
Data travels encrypted and is stored on Google Cloud infrastructure. Access is restricted by security rules that validate, on the server, who may read or write each piece of information. Sensitive operations — such as creating a match or deleting an account — run on the server, not on the device. No system is infallible: if an incident occurs that poses a relevant risk to you, we will notify you and the ANPD, as art. 48 of the LGPD requires.
13. Cookies
The app does not use cookies. The website thequirkyapp.com uses no cookies and no advertising tracking; it is hosted on Firebase Hosting (Google) and its public pages serve their own typefaces — nothing is loaded from third parties (the operations area, restricted to the team, uses the Firebase libraries served by Google) — so your IP address and browser type are seen only by the hosting provider when the pages open, as with any website visit.
14. Changes to this Policy
If we change this Policy materially, we will publish the new version on this page, with a new version number and date. The version you accepted is recorded on your account.
15. Contact
FIRENZE PROGRAMAÇÃO DE SITES E APLICATIVOS LTDA.
CNPJ 66.777.790/0001-24
Avenida Paulista, 2073, Suite 2220 — Bela Vista, São Paulo/SP, 01311-940, Brazil
firenze@firenzeprogramacao.com.br