Privacy Policy

Last updated: October 11, 2026

1. Who we are

FlatStrike is operated by the FlatStrike developer team. You can contact us at developer@flatstrike.com.

This policy applies to the FlatStrike mobile app, the FlatStrike backend API, and the flatstrike.com website, including its public pages for rental flats and the account-deletion page.

2. Data we collect

Account and authentication data

• Email address, Firebase user ID, display name, and optional avatar URL.
• Authentication provider information from Firebase Authentication, including email/password, Google sign-in, and Sign in with Apple.
• For Sign in with Apple, a refresh token may be stored server-side only so FlatStrike can revoke the Apple grant if you delete your account.

Search and listing data

• Search profiles, including city, districts, postal codes, price and size filters, room filters, property type, rental-status filters, and notification settings.
• Saved or reviewed listings, review decisions, personal notes, application status, viewing dates, and timestamps.
• Which listings you open in the app, where in the app you opened or reviewed them, and how long each was on your screen. We keep these listing views for 90 days and do not share them.
• Listing URLs and listing metadata needed to display, deduplicate, and track listings.
• Shared-listing link metadata if you create or open a FlatStrike listing link.

Location data

• If you choose to enable location in Strike Mode, FlatStrike accesses your device location while the app is in use to show your position on the map and your distance from a listing.
• The first location successfully captured for your account is rounded to four decimal places (roughly 10 metres) and saved once with its reported accuracy and the time it was saved. This initial snapshot is linked to your account and may be used to improve future listing recommendations.
• The saved initial snapshot is not replaced by later locations. In later Strike sessions, a fresh location may be used in app memory for the live map and distance only; it is not uploaded to or stored by FlatStrike and is discarded when the session ends.
• FlatStrike does not access location in the background and does not create a location history.

Easy Apply profile and templates

• Email address, name, salutation, phone number, street, house number, postal code, city, and age.
• Household and financial/application details, including home-owner status, income type, monthly net income, number of adults and children, and WBS eligibility fields such as WBS availability, validity date, type, and room count.
• Easy Apply message templates and application-job metadata, such as the listing URL, site, application status, timestamps, and error or success evidence needed to show progress and troubleshoot failed submissions.

Subscriptions and purchases

• FlatStrike Plus and FlatStrike Autopilot are auto-renewing subscriptions bought through the Apple App Store or Google Play. Apple or Google processes the payment. FlatStrike never receives your card number, bank details, or billing address.
• To unlock paid features, FlatStrike stores a purchase record linked to your account: the plan and product you bought, the billing period, purchase, renewal, and expiry dates, the subscription status (for example active, in a grace period, or cancelled), and the transaction and subscription identifiers the store assigns.
• Apple and Google send FlatStrike's servers a notification when your subscription renews, changes, is cancelled, refunded, or expires, so the app can keep your access current. FlatStrike may also ask the store to re-verify a purchase.
• Purchase records are deleted with your account. Apple and Google keep their own purchase history under their terms.

Installation ID

• When the app is first opened, it creates a random installation ID and stores it on the device. It is not derived from hardware identifiers, is not an advertising ID, and is not shared with other apps.
• The app sends this ID with Easy Apply and Review Mode requests. FlatStrike's servers keep only a one-way hash of it, together with first-seen and last-seen times and usage counters, to count the free Start plan allowance per installation so that the allowance cannot be reset by creating another account on the same device.
• The hashed installation record is not stored with your account and is kept after account deletion. Deleting the app or clearing its data creates a new installation ID.

Uploaded documents

• Documents you upload for application workflows, currently including WBS-related documents.
• Document metadata such as filename, content type, file size, purpose, creation time, and deletion time.
• The uploaded file contents themselves, stored in FlatStrike's backend database for app functionality.

Device, notification, usage, and diagnostic data

• Firebase Cloud Messaging registration tokens, platform, and timestamps used to send push notifications.
• Notification delivery and read/open records, including batch IDs and sent/opened timestamps, and whether a notification was opened by tapping it, from the inbox in the app, or by marking all as read.
• Firebase Analytics data such as app interactions, screen views, Firebase app instance identifiers, and the authenticated Firebase user ID for product analytics.
• When the app starts, on which platform (iOS or Android) and with which app version, and the product events the app also sends to Firebase Analytics (for example that a plan screen was shown). We keep these app visits and product events on our own servers for 90 days and do not share them.
• On Android, which FlatStrike link the app was installed through: the short tag of that link (for example the name of the post it was in) and the kind of link, as Google Play passes them to the app. We store this with your account to learn which posts bring people to FlatStrike, and do not share it.
• Crash and diagnostic data collected through Firebase/Google tooling to understand and fix app issues (see "Crash reports" below).
• Error reports from FlatStrike's servers, sent to Sentry to understand and fix server issues (see "Server error reports" below).
• Feedback or support messages you submit to us, such as feature requests or source suggestions.

Crash reports

• Release builds of the app use Firebase Crashlytics (Google). When the app crashes or hits an unhandled error, it sends a report containing the error type and message, the stack trace, the app version and build number, the operating-system version, the device model, and a Crashlytics installation identifier that groups reports from the same installation.
• Before a report leaves the device, the app removes email addresses, tokens, applicant-profile values, message text, document contents, and long numbers from it. Reports carry no account ID, no email address, and no uploaded document.
• We use crash reports only to find and fix defects. They are processed by Google as a service provider and are not used for advertising.

Server error reports

• When FlatStrike's servers hit an error, they send a report to Sentry (Functional Software, Inc.), which stores it in the European Union. A report contains the error type and message, the stack trace, the software version, and, for an error in a request from the app, the method and path of that request.
• Before a report leaves our servers, it is reduced to a fixed set of fields, and email addresses, tokens, the values of applicant-profile fields, database values, and long numbers are removed from its text. No account ID, IP address, request header, request content, or uploaded document is attached to a report.
• We use these reports only to find and fix defects. They are processed by Sentry as a service provider and are not used for advertising.

Visiting flatstrike.com

• flatstrike.com and FlatStrike's API are delivered through Cloudflare. Cloudflare therefore receives every request to them, and with it your IP address, the address of the page you asked for, and the technical details a browser sends with a request, such as its type and version. For the home page and the public pages for rental flats, our part of the website that runs at Cloudflare also keeps a log of the requests it answers, with details of each request and its answer; Cloudflare stores this log for up to seven days (see "Cloudflare" under "Sharing and third-party services").
• On the public pages for rental flats (flatstrike.com/flats), we count how often a page is viewed and how often a link that leads to the app is tapped. We do this on our own servers. No script runs on these pages for it, no cookie is set, and nothing is stored on or read from your device.
• For each page view we record the kind of page (a flat, a flat that is no longer available, or a list of flats), which flat it was, the tag of the post you came from if its link carried one, the kind of device (Android, iOS, or other), the app whose built-in browser showed the page if your browser names one (for example Facebook or Instagram), the language of the page, your country as Cloudflare reports it, whether the page was found, and the time. For each tap on a link that leads to the app, we record which link it was, where it led (the app, an app store, or our website) and the same details about the page it was on.
• With a page view or a tap we also record: the website you came from, by its name alone (for example facebook.com), or the kind of page of ours you came from; the languages your browser asks for; the kind of browser and operating system (for example Chrome on Android) and whether it is a phone, a tablet or a computer; whether the link you opened carried an advertiser's click marker (we record which advertiser's, never the marker itself) or campaign words; the region, the city and the time zone that Cloudflare derives from your IP address, and the name of your network operator; technical details of the request (whether, as your browser states it, the request came from a link on another website, from one of our own pages or from neither, whether it was a reload or a preload, whether your browser asked to save data, whether it sent a Do Not Track or Global Privacy Control signal, the connection's protocol, and the Cloudflare data center that answered); what the page showed (which list of flats it was, the flat's rent, rooms and district, whether it had a photo, how long ago we found the flat, how many similar flats it listed, whether it showed a code to scan, and whether it showed when an application was last sent with FlatStrike or how many applications were sent to the flat); and how long the page took to load.
• To count how many visitors a day brings, a record can also hold a visitor value. Our server calculates it from your IP address, the type and version your browser reports (its User-Agent), and a random key that we create anew every day (Berlin time) and delete when that day is over. Your IP address is passed to our server for this calculation and is not stored, and neither is the User-Agent. Once a day's key is deleted, the value can no longer be traced back to an IP address, and because every day has its own key, the values of different days cannot be linked to each other.
• If your browser sends a Do Not Track or Global Privacy Control signal, your IP address is not passed to our server and no visitor value is calculated, and your page views and taps are counted without your city, without your network operator and without the list of your browser's languages (only the first of them is recorded). The other details named above are still recorded. Among them are your country, your region and your time zone, which Cloudflare derives from your IP address.
• We use these records only to see how much the pages are used and whether a change to them helps. We rely on our legitimate interest in that (Art. 6(1)(f) GDPR). The records are not linked to an account, are not used for advertising, and are not shared. We delete them after 90 days.
• You can object to this at any time: turn on Do Not Track or Global Privacy Control in your browser, or write to us at the address under "Contact".

Data we do not collect

• We do not collect payment card data or bank-account details. Payments are handled by the Apple App Store or Google Play (see "Subscriptions and purchases" above).
• We do not collect or store your third-party rental-portal passwords.
• We do not use your data for third-party advertising or cross-app tracking.

3. How we use data

• To authenticate you and keep your account secure.
• To provide the app's core features: search profiles, listing review, saved listings, pipeline tracking, notifications, shared links, document upload, and Easy Apply.
• To fill rental-application forms when you deliberately use Easy Apply.
• To submit applications automatically on FlatStrike's servers when you have turned Autopilot on for a search profile (see "Automatic applications with Autopilot" below).
• To check which plan you are on and unlock the features you have paid for.
• To remember what you have reviewed or applied to, so your pipeline stays consistent across sessions and devices.
• To show your live position and listing distance in Strike Mode, and to use the single saved initial location snapshot to improve future recommendations.
• To let authorized support operators view the rounded initial location snapshot, its reported accuracy, and save time when investigating an account issue. If an operator opens that position in Google Maps, we send its rounded coordinates to Google.
• To send push notifications about relevant listings and app activity if you enable notifications.
• To measure product usage, diagnose crashes, fix bugs, and improve reliability.
• To show figures that name no one on FlatStrike's public web pages about rental listings: when the last application was sent with FlatStrike, in all and to each listing that is online, and, for a listing that is no longer online and that at least two people applied to with FlatStrike, how many such applications were sent to it and how soon after we found the listing the first one was sent.
• To count how often the public pages for rental flats on flatstrike.com are viewed and how often their links to the app are used (see "Visiting flatstrike.com").
• To process account-deletion requests and prevent deleted account identities from being recreated.

4. Sharing and third-party services

We do not sell your personal data. We do not use your data for third-party advertising or tracking.

We share or process data in the following limited ways:

• Firebase and Google services. We use Firebase Authentication, Firebase Cloud Messaging, Firebase Analytics, and Google/Firebase infrastructure to authenticate users, send notifications, analyze app usage, and run the backend service. The app also uses Google Maps SDK features for map display. If an authorized support operator opens a saved location in Google Maps, the rounded coordinates are sent to Google.
• Sentry. We use Sentry (Functional Software, Inc.) to receive error reports from our servers, as described under "Server error reports". The reports are stored in the European Union.
• Cloudflare. flatstrike.com and FlatStrike's API are delivered through Cloudflare (Cloudflare, Inc.), which therefore handles the IP address and the request data of everyone who visits the website or uses the app, as described under "Visiting flatstrike.com". Cloudflare states that it processes the data of its customers' visitors on its customers' behalf, in its data centers in the United States and Europe and for a limited period of time, and that it is itself the controller of other information it collects. For transfers of personal data to the United States, Cloudflare states that it relies on its certification under the EU-U.S. Data Privacy Framework and on the European Commission's standard contractual clauses. See Cloudflare's privacy policy.
• Apple. If you use Sign in with Apple, Apple authenticates your Apple ID. FlatStrike may store a server-side Apple refresh token only so we can revoke the Apple grant if you delete your account.
• Rental portals and landlords. When you use Easy Apply, FlatStrike fills and submits a rental enquiry or application to the third-party portal on your behalf, using the profile/template data you chose to provide. Depending on the listing source, this happens either on your device (in the in-app browser, using your own portal session) or on FlatStrike's backend servers, which submit the application to the portal for you. In both cases this discloses your personal, household, and financial application data — and, where the application form requires it, your uploaded documents — to that portal, landlord, property manager, or recipient.
• Uploaded documents. Uploaded documents are stored for FlatStrike app functionality and are not sold. When you use Easy Apply on a listing source whose application form requires a document (for example a WBS certificate), FlatStrike attaches and submits the relevant uploaded document to that portal on your behalf as part of the application.
• Legal and safety. We may disclose information if required by law, to protect users, or to protect FlatStrike's rights and service security.

Third-party rental portals loaded inside the in-app WebView may set their own cookies and process data under their own privacy policies. FlatStrike does not collect your portal credentials from those WebView sessions.

Automatic applications with Autopilot

Autopilot is a paid feature that submits applications for you without a tap per listing. It runs on FlatStrike's servers, so it also works while the app is closed. It only does anything after you have turned it on for a search profile.

• What is sent. The same data as a manual Easy Apply: your Easy Apply profile (name, contact details, address, household and income details, WBS eligibility), the message template you selected for that search profile, and, only where the landlord's form requires it, your uploaded WBS documents. The "Review and turn on" screen shows you exactly these details, your search rules, and your plan's allowance before Autopilot starts. If your profile, template, documents, or search rules change later, Autopilot pauses until you review and approve the new setup.
• To whom. The landlord or housing company that published the listing, through its own application form or portal. Autopilot only covers listing sources that FlatStrike has enabled for automatic applications; FlatStrike can disable a source, or Autopilot as a whole, at any time.
• When. When a new listing appears that matches the search profile and rules you approved, within the daily and monthly allowance of your plan. Autopilot never applies to a listing you have already applied to.
• Records. Every automatic application is logged with the listing, time, and outcome and shown in the app, and it keeps the same application-job evidence described above under "Easy Apply profile and templates".
• Your controls. You can pause or turn Autopilot off at any time from the Autopilot tab; while it is paused or off, nothing is sent. It also pauses automatically when your Autopilot subscription ends. Deleting your account stops Autopilot and removes its setup and records.

5. Storage and security

• FlatStrike stores account and app data on its backend systems associated with your authenticated Firebase account.
• The initial location snapshot is stored with your account as rounded coordinates, reported accuracy, and save time. It is not replaced and is retained until your account is deleted.
• Uploaded document files are stored in the backend database with access limited to app workflows that need them.
• Authentication is handled by Firebase. FlatStrike does not store your password.
• Communication between the app and FlatStrike's API uses HTTPS.
• We use administrative, technical, and access-control measures intended to protect account data, but no system can be guaranteed to be perfectly secure.

6. Account deletion and retention

You can delete your account in the app:

1. Open the FlatStrike app.
2. Go to Settings.
3. Tap Account.
4. Tap Data & privacy.
5. Tap Delete account.
6. Enter the email address currently associated with your account.
7. Tap Permanently delete account to confirm.

If you no longer have the app installed, you can request deletion at https://flatstrike.com/delete-account/. Email requests are processed within 30 days after we verify account ownership.

When your account is deleted, FlatStrike deletes your user account row and account-related rows, including search profiles, Easy Apply templates, device tokens, notifications, saved/reviewed listing rows, suggestions, Easy Apply jobs, Autopilot setup and activity, subscription and purchase records, uploaded documents, and the saved initial location snapshot.

We retain an irreversible deletion tombstone keyed by your Firebase user ID to prevent the same account identity from being recreated after deletion. Shared global listing records may remain in FlatStrike's listing database, but FlatStrike user provenance fields such as source user, details source user, and field provenance references are removed.

If you used Sign in with Apple, FlatStrike also attempts to revoke the Apple grant during account deletion. Data you already submitted to third-party rental portals, landlords, or property managers is outside FlatStrike's systems and must be handled with that recipient directly.

7. Your choices

• You can update your profile, search preferences, notification preferences, templates, and uploaded documents in the app.
• You can turn off push notifications in the app or in your device settings.
• You can decline or revoke location permission in your device settings. Revoking permission stops future device-location access but does not erase the initial snapshot already saved with your account; deleting your account removes it.
• You can sign out at any time. Signing out does not delete your account; use Delete Account for permanent deletion.
• You can turn on Do Not Track or Global Privacy Control in your browser. Your visits to the public pages for rental flats on flatstrike.com are then counted without a visitor value, your city, your network operator and the list of your browser's languages (see "Visiting flatstrike.com").
• You can contact us to ask questions about your data or request help with deletion.

8. Children

FlatStrike is not directed to children. If you believe a child has provided personal data to FlatStrike, contact us so we can review and delete it where appropriate.

9. Changes to this policy

We may update this policy when FlatStrike's features, data practices, or legal requirements change. The "Last updated" date at the top of this page shows when the policy was last changed.

10. Contact

Questions or requests can be sent to developer@flatstrike.com.