Legal
Last updated: 31 August 2026
Flirtly is an 18+ service. The age gate is a legal duty in a growing set of jurisdictions and a hard requirement of the payment networks we work with. It exists so the service can exist.
| Tier | Where | What happens |
|---|---|---|
| Standard | Jurisdictions with no specific age-assurance mandate | You confirm you are 18+ at entry. The confirmation is recorded with a timestamp and your IP-derived country and region, and it is cryptographically signed at the edge. |
| Strict | US states with age-verification mandates, the United Kingdom, the EEA, and any request whose location cannot be resolved | The same 18+ confirmation, plus the explicit content rungs are withheld entirely — they are not offered, not priced and not generated for this tier. |
Your tier is resolved at the network edge from your location before the app loads, and the result is cryptographically signed so it cannot be forged by direct requests. A request whose location we cannot resolve is treated as strict, not as standard: the fallback fails towards the tighter rule, never away from it.
By subtraction, not by a gate. In a strict-tier jurisdiction the explicit rungs are removed from the menu before it is rendered: they are not shown, not priced, and the generation routes refuse them independently if one is requested anyway. There is nothing to click through and nothing to buy past, because the option is not there.
Non-explicit use — creating a companion, chatting, and the clothed image rungs — works normally in every tier. The boundary sits at the explicit rungs and nowhere earlier.
Stated plainly, because the alternative is a lie: Flirtly does not currently operate third-party age verification. There is no facial age estimation, no document check, no liveness check and no open-banking or mobile-operator check integrated in this product today. The 18+ confirmation is a self-declaration, and it is recorded as one. What protects the strict tier right now is that the explicit content is withheld from it entirely.
Integrating a verification vendor is a launch-gate item that must close before paid plans open, and it is tracked as one. When it ships, this page will describe the methods actually in use, and section 5 will describe what the vendor actually returns. Until then it describes what is here.
Today an attestation record holds the fact of the 18+ confirmation, a locally generated reference, the tier, the time, and the expiry. When a verification vendor is integrated, the record will hold, and will only hold:
We never receive or store the identity document, any document image, the document number, your name as it appears on the document, your date of birth, the face scan or any biometric template — in any table, log, backup or error report. The vendor holds the evidence; we hold the boolean. That is deliberate: the less identity we hold, the less a breach can expose.
Attestation records a timestamp, your IP-derived country and region, the method, and a hash of your browser identifier. Raw IP addresses are kept for no more than 30 days, and then only the derived location remains.
An age assurance expires after 12 months, immediately if you move to a jurisdiction with a stricter tier, or on a safety flag. When it expires, you are re-checked at the mature content boundary — not at signup.
Do not use Flirtly. Attempts to bypass the age gate are logged, the account is closed, and nothing is served in the meantime.
Age data is personal data; how it is protected, retained and deleted is in the Privacy Policy.