Privacy policy

Last updated: 12 October 2026

FlirtLogin signs you in to our partner sites with an account you already have at Google, Microsoft, netID or Yahoo. It passes your email address, name and provider account ID to the partner site you came from and keeps no user accounts of its own. This policy explains the details.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) for flirtlogin.com and the sign-in service at auth.flirtlogin.com is:

arimo GmbH also operates all partner sites that offer sign-in with FlirtLogin, so data passed to a partner site stays with the same company.

2. Visiting flirtlogin.com

This website sets no cookies, runs no scripts and uses no analytics, tracking or advertising services. Fonts and images are served from our own domain.

To deliver the pages and protect them against attacks, our hosting provider Cloudflare processes technical connection data such as your IP address, the requested page, the time of the request and your browser's user agent (see section 7). We keep no access logs of our own. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the website securely and reliably.

3. Signing in with FlirtLogin

3.1 How sign-in works

When you choose a provider on a partner site, your browser is sent to our sign-in service at auth.flirtlogin.com and from there to your provider's own sign-in page. You enter your password only there; FlirtLogin and the partner sites never see it. Your provider asks whether it may share your data with FlirtLogin. If you agree, it sends you back to us, and we forward you to the partner site.

3.2 Data we receive from your provider

• the ID your provider uses for your account,
• your email address and whether your provider has verified it,
• your name, if your provider shares it.

Some providers also send basic profile information such as a profile picture or language setting. We discard it without using or passing it on. We have no access to your password, emails, contacts, files or any other content of your provider account.

3.3 Data we pass to the partner site

We pass the data listed above, together with the name of your provider, only to the partner site where you started the sign-in. For this, the partner site receives a one-time code and uses it to retrieve your data directly from our server. The partner site uses the data to sign you in or to create your account; from then on, its own privacy policy applies.

3.4 How long we keep the data

A one-time code is valid for 60 seconds and works only once. We delete the data behind it as soon as the partner site has retrieved it; data behind an unused code is deleted automatically after a few minutes. FlirtLogin keeps no user database, no sign-in history and no profiles.

3.5 Cookies

During sign-in, auth.flirtlogin.com sets three cookies that protect the sign-in against forgery and remember where to return you:

• fl_state: a random value that ties your provider's answer to your own sign-in,
• fl_return: the partner site and address to return you to,
• fl_pkce: a one-time key that secures the exchange with your provider.

The cookies expire after 10 minutes at the latest and are deleted when the sign-in is complete. They are strictly necessary for the sign-in you requested, so no consent is required (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). We use no tracking or advertising cookies.

3.6 Legal basis

We process this data to sign you in to the partner site at your request, which is necessary to perform our contract with you for the partner site (Art. 6(1)(b) GDPR). Security measures such as the cookies above are also based on our legitimate interest in protecting your account and our services against misuse (Art. 6(1)(f) GDPR). Providing the data is voluntary, but without it you cannot sign in with FlirtLogin.

3.7 Your provider

Your provider processes your sign-in under its own responsibility and its own privacy policy. You can withdraw FlirtLogin's access at any time in the security or privacy settings of your provider account. This stops future sign-ins with FlirtLogin; your account at the partner site remains until you delete it there.

4. Google user data

If you sign in with Google, we request only the permissions openid, email and profile. From Google we use your Google account ID, your email address, whether it is verified, and your name.

• We use this data only to sign you in to the partner site you chose (section 3).
• We share it only with that partner site and with Cloudflare as our hosting provider.
• We do not sell it, use it for advertising, or use it to develop or train artificial intelligence models.
• Our staff do not read it, except when you ask us for help, to investigate security incidents or misuse, or where the law requires it.

FlirtLogin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove FlirtLogin's access at myaccount.google.com/permissions.

We handle data from Microsoft, netID and Yahoo in the same way.

5. Error monitoring

To detect and fix technical errors in the sign-in service, we use Sentry, provided by Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. When an unexpected error occurs, and for a small sample of requests, our service sends Sentry a technical report: the type of error, the affected sign-in step and provider, the time and the location in our code.

Before a report leaves our service, we remove email addresses, names, cookies, request headers, query parameters, codes and tokens. We do not send your IP address to Sentry. Sentry deletes the reports automatically after at most 90 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a reliable and secure sign-in service.

6. Contacting support

If you email us, we use your message and contact details only to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns the use of FlirtLogin or a partner site, and Art. 6(1)(f) GDPR otherwise. We delete your request once it has been handled, unless statutory retention periods require us to keep it longer.

7. Service providers and transfers outside the EU

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, hosts flirtlogin.com and the sign-in service, including the short-term storage of one-time codes described in section 3.4, and protects both against attacks. Sentry provides error monitoring (section 5). Emails to our support address are processed by our email service provider.

These providers process data on our behalf under data processing agreements (Art. 28 GDPR). Their processing may take place outside the European Union, in particular in the USA. Such transfers are based on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. Your rights

Under the GDPR, you have the right to:

• access your personal data (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20).

Where we process data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, email support@flirtlogin.com. Because FlirtLogin deletes sign-in data within minutes, it usually holds no data about you. For your account at a partner site, name the partner site in your email and we will handle the request there.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

9. Adults only

FlirtLogin and its partner sites are intended for adults only. We do not knowingly process data of people under 18.

10. Changes to this policy

We update this policy when our service, our service providers or the law change. The version published on this page applies.