Privacy policy

Who is responsible

Gasta AB, Stockholm, Sweden, is the controller for personal data processed by Flock. Contact us at hello@flock.rocks for privacy questions or requests.

Data we collect

We collect only data needed to operate Flock and the features you choose to use.

• Account and profile data: email address, account and Member IDs, display name, profile photo, birth date, sex, height, country, units and app preferences.
• Health and fitness data: weight, body measurements, steps, active and resting energy, nutrition and macros, workouts, activity details, notes, goals, source choices and data you choose to import from or write to Apple Health.
• Flock data: memberships, roles, invitations, sharing choices, goals, progress and cheers. Other members only receive the categories and level of detail you choose to share.
• Food library data: foods, recipes, portions and barcode-based product selections that you save or log.
• Service and security data: consent records, waitlist email and campaign source, a short-lived hashed IP address for abuse prevention, and technical request or error information produced when the service is used.
• Photos and camera: profile and flock images you upload are stored. Barcode scanning happens on your device; Flock does not store camera images from a scan.

How we use data and our legal bases

We process account, profile, log and flock data to provide the service you request, keep your account secure, synchronise your choices and let you export or delete your data. We use limited technical data to prevent abuse, diagnose faults and protect the service based on our legitimate interests in security and reliability.

Health data is sensitive. We process it only for Flock's health-tracking and sharing features at your direction and, where required, with your explicit consent. We do not use health or fitness data for advertising, marketing, profiling for ads, insurance decisions or unrelated data mining.

Waitlist and beta email is sent only with your consent. You can withdraw that consent at any time by using the unsubscribe link or contacting us.

Apple Health

Apple Health access is optional and controlled through Apple's permission screen and system settings. Flock reads only the categories you authorise and only when you choose Apple Health as a source. When Flock is the chosen source, it can write the weight, steps, meals and workouts you log to Apple Health.

Flock does not sell, advertise with or mine HealthKit data, and does not store HealthKit data in iCloud. You can revoke access in iOS Settings at any time. Revoking access stops future exchange; it does not automatically delete data already stored in Flock or Apple Health.

Sharing and service providers

We do not sell personal data. We disclose it only when you choose to share inside a flock, when a service provider needs it to operate Flock, when required by law, or when necessary to protect people and the service.

• Supabase provides authentication, database and file storage. Flock's production data is hosted in Frankfurt, Germany.
• Vercel hosts the website and its server functions.
• Expo/EAS provides app build and update infrastructure and may receive technical device and request information.
• Resend delivers waitlist, account and invitation email.
• Cloudflare Turnstile helps prevent automated abuse on public forms.
• OpenFoodFacts receives a product name, barcode and country preference when you search its public product database. We do not intentionally send your account or health log to OpenFoodFacts.
• Apple processes Apple Health data under your device settings and Apple's terms when you enable the integration.

International transfers

Some providers may process limited data outside the EU or EEA. Where that happens, we rely on an adequacy decision, standard contractual clauses or another lawful safeguard required by data protection law.

Retention and deletion

Account and health data is kept while your account is active. Deleting your account in Flock deletes the account and associated data from the live service. Limited encrypted backups and security logs may remain for a short period under provider backup and security cycles before being overwritten or deleted.

Waitlist data is kept until you withdraw, unsubscribe or it is no longer needed for the beta programme. Hashed IP rate-limit records are deleted after 15 minutes. Flock invitations expire after 14 days. We may retain a minimal record where law requires it or to establish, exercise or defend legal claims.

Your choices and rights

You can change tracking, source and flock-sharing choices in the app, revoke Apple Health access in iOS Settings, export your core account and health data, and permanently delete your account from Account in Flock.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent without affecting earlier lawful processing. Email hello@flock.rocks to make a request. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Security and children

We use access controls, row-level database security, encrypted transport and device-secured session storage. No service can promise absolute security, so please protect your sign-in details and contact us if you suspect misuse.

Flock is not intended for children under 16. Contact us if you believe a child has provided personal data without appropriate authorisation.

Changes

We may update this policy as Flock changes. We will publish the new date here and give additional notice when a material change requires it.