Privacy policy
Last updated: 20 October 2026 (provisional version, under legal review). The French version prevails.
1. Who is responsible for your data
Tablao is published by Kickapp. Kickapp is the controller of your data.
For any question or to exercise your rights: contact@natura-app.eu. In the app: Settings → Contact us.
2. What we collect, and why
Tablao asks for no name, no email address and no phone number. Your account is linked to a random identifier stored on your phone. We collect no location.
| Data | Why | Who sees it | How long |
|---|---|---|---|
| Device identifier (random) | Signing you back into your account | Nobody else | Until the account is deleted |
| Nickname | Identifying you in games and rooms | Other players | Until the account is deleted |
| Age (18 or over) and gender | Keeping the app adults-only, showing your mini-profile | Other players | Until the account is deleted |
| Acceptance of the terms (version, date, "18 or over" box) | Proving your agreement | Nobody else | Until the account is deleted |
| Flirt profile (optional): orientation, bio, photos, discovery preferences | Suggesting profiles and showing you to others, only if you turn it on | Players who see the deck, only if you chose to appear in it | Until the account or the data is deleted |
| Private photos | Showing them only to the people you give access to | Those people, through a link valid for 10 minutes | Until you delete them |
| Likes, matches, winks, profile visits | Running the Flirt mode | The person concerned, and for matches only after a mutual like | Until the account is deleted |
| Room messages and private messages | Letting you chat | Room members, or the two people in the private conversation | Until the account is deleted |
| In-game chat messages | Chatting during a game | The players in the game | For the duration of the game |
| Gifts received and sent, charm | Gifts between players | Charm is public on your profile | The last 50 gifts |
| Flouzz balance and transactions | Running the in-app currency | Nobody else | Until the account is deleted |
| Purchases (product, transaction identifier) | Crediting what you paid for, exactly once | Nobody else | 10 years (accounting obligation) |
| Notification token and language | Sending you notifications in your language | Nobody else | Until the account is deleted |
| Reports and blocks | Protecting players, moderation | The moderation team | Evidence 90 days, record 1 year |
| Crash reports (if enabled) | Fixing bugs | The technical team | 90 days |
Photos are re-encoded on upload: their metadata (including GPS position) is removed. App content (nicknames, bios, messages, rooms) goes through a filter that hides insults.
3. Legal basis
- Performance of the contract (the terms of use): account, games, rooms, messages, wallet, purchases.
- Your consent: Flirt profile, and in particular your orientation, which you can withdraw at any time; notifications (requested by your phone).
- Our legitimate interest: security, moderation, handling reports, fixing bugs.
- A legal obligation: keeping proof of purchase, answering the authorities.
4. Who we share it with
We sell no data and show no targeted advertising. Our service providers:
| Provider | Role | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts the server and the database | Germany (EU) |
| Bunny.net (BunnyWay d.o.o.) | Stores and delivers photos | Europe |
| Expo (650 Industries) | App updates, sending notifications | United States |
| Apple, Google | Notifications, stores, payments | United States |
| RevenueCat | Confirms purchases with the stores | United States |
| Sentry (Functional Software) | Crash reports, without your identity | EU (Europe region) |
Private message notifications contain the sender’s nickname and the beginning of the message; they therefore go through Expo and through Apple or Google.
5. Deleting your account
Settings → Delete my account. Your photos are erased, then your account and everything attached to it, including traces left with other players (likes, matches, blocks, photo access).
To handle reports and requests from the authorities, we keep a sealed archive for one year, accessible to no one in the app: your nickname, your identifiers, the account creation date, your age, your gender, your bio and the messages you sent. It is erased automatically after one year.
Our encrypted database backups, kept off the server, still contain your account for at most 8 weeks after deletion, until they are replaced.
6. Your rights
You can ask to access your data, correct it, erase it, receive it in a portable format, object to or restrict its processing, and withdraw your consent. Write to the address in section 1 with your account identifier (Settings → Contact us fills it in for you). We answer within one month.
You can also contact your data protection authority; in France, the CNIL (www.cnil.fr).
7. Minors
Tablao is for people aged 18 and over. An account reported as belonging to a minor is suspended.
8. Changes
If this policy changes significantly, the app will tell you before the change applies.