Privacy Policy

1. What we collect

There are no advertisements in Flock, no analytics, no trackers, no crash-reporting SDK and no third-party data brokers. Nothing you do in Flock is measured for anyone’s benefit but yours.

Your account

You sign in with Apple or Google. Flock never sees or stores a password. What the sign-in gives us, and what we keep:

There is no denomination field, anywhere. The only affiliation Flock records is the groups you choose to join.

We do not verify your email address and we do not use it as a way to sign in. Your Apple or Google identifier is what identifies you. This is stated because it is the reason an unverified address cannot be used to take over anything.

What you write and post

Posts, comments, prayer requests, reflections, sermons, photos, verse cards and links — the things you put into Flock on purpose. Alongside each we store the ordinary bookkeeping: who wrote it, when, and which group (if any) it went to.

A sermon imported from a link. If you give Flock a podcast or audio link instead of choosing a file, we keep that link with the import, so the recording can be fetched and so it is deleted with your account. It is never shown to anyone, never returned by any part of the app, and never written to a log.

Scripture references are stored as references, never as copied text. A post about Romans 12:2 stores “Romans, chapter 12, verse 2” — so every reader sees it in their own translation. The Bible text itself ships inside the app.

Your reactions and your prayers. When you tap Amen, or tap to pray for someone’s request, that is a row with your name on it. Prayer identities are the most carefully guarded thing in the app: the count is public, and the only person who can ever see who prayed is the person who asked for prayer. Nobody is notified that you prayed for them, and no other part of Flock will tell anyone.

Your follows, your blocks, your group memberships and your reading-plan progress. Ordinary relationship records; each is described in §5 where deletion is covered.

What your device keeps to itself, and never sends

Some things never reach the server at all. They live in local storage on your phone and stay there:

• Where you are in the Bible — your last-read book and chapter. This is a device setting, not an account setting. It does not follow you to another phone, because it never leaves this one.
• Where you are in a sermon — playback positions, per post.
• Your appearance, translation, text-size, narration and rain preferences.
• The name you were shown at onboarding, used to prefill a field.
• Your answer to the age question — kept as a yes or a no, never as an age or a birthday, and never sent to us.

Your session credential is held in the device keychain (iOS Keychain via expo-secure-store), not in ordinary storage.

Uninstalling the app removes all of it. None of it is backed up to Flock.

Approximate area

Flock can draw rain over the feed when it is actually raining near you. This is the only thing your approximate area is used for.

What happens: your connection’s IP address is looked up against a copy of the MaxMind GeoLite2 database that sits on our own server. Your IP address is not sent to any geolocation service. The coordinate that comes back is immediately rounded to a 0.5° grid cell — roughly 55 by 39 kilometres — and the centre of that cell, together with your country code, is what we ask Apple’s weather service about. Apple is told a grid square, not a person and not a place.

Retention: none. Your IP address is a parameter to a function and is gone on the next line. It is never written to a database, never written to a log, never used as a cache key, and never included in any operational alert. The coarse cell lives only in the server process’s memory, for at most a few hours, as part of a shared cache that has no user identity attached to any entry.

Formally: coarse location is derived from your IP address for weather presentation, is not stored, and is not linked beyond the authenticated request that derived it.

Honest qualification, because it matters: the request that derives the cell is an authenticated one — the app is signed in when it asks. So at the instant of the lookup, a coarse location exists alongside your identity, in memory, for the length of one request. Nothing joins the two, nothing writes either down, and the cell is 2,000-plus square kilometres wide. But “never stored” is a description of what we do with it, not a claim that it was never derived.

If we do not know where you are, we do not guess. If the database has no record for your address, or states an accuracy worse than 50 km, or your traffic egresses through a VPN, Apple’s iCloud Private Relay, a satellite ground station or a datacenter, the answer is “no rain” rather than a guess.

You can turn it off. Settings → Rain on rainy days. With it off, the app makes no weather request at all, so no location is derived.

Reports

When you report a post, a comment or a person, we store what you reported, why, and any note you added. §4 covers who can see it.

What we do not collect

Stated as a list, because absences are the part of a privacy policy nobody can verify from the outside:

• No analytics. No Firebase, no Amplitude, no Mixpanel, no Segment, no PostHog, no Google Analytics. There is no analytics library in the app.
• No advertising and no ad identifiers. No IDFA, no attribution SDK, no ad network.
• No crash-reporting or session-replay SDK.
• No contacts, no calendar, no microphone, no camera, no precise location. The app asks for two permissions — your photo library, when you choose a photo, and notifications, the first time you join a group or ask for prayer.
• Notifications only if you allow them. Your phone then gives us a device token that Apple uses to deliver them. It is deleted when you delete your account, or as soon as Apple tells us it no longer works — which is what happens after you uninstall the app. Turning a kind of notification off in Settings stops us sending it; the token itself stays until one of those two things happens.
• No email from us unless you write to us first, so no mailing list and no open tracking.
• No screen-level telemetry. We do not know which posts you read, how long you looked at them, which chapters you opened, or whether you finished the sermon. The app does not report any of it.

2. Why we collect it

Under the GDPR’s terms, our lawful bases are:

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we have never done either. Under the CCPA/CPRA these are the two questions that matter most, and the answer to both is no.

3. Where it lives, and who touches it

Flock runs on one server, in a Docker Compose stack, at Hetzner, in a data centre in Ashburn, Virginia, USA. There is no Kubernetes cluster, no data warehouse, no third-party backend platform, and no employee directory.

Nothing else. No data processor beyond this table receives anything.

Where audio is processed

If you post a sermon, the audio is transcribed for captions. If you post a reflection, it can be read aloud. Both happen on our own server, in sidecar containers running open-source models (faster-whisper for transcription, Kokoro for speech). Your audio is not sent to OpenAI, Google, Amazon, ElevenLabs or anyone else. It goes from your phone to our storage bucket and to our own process, and nowhere further. If you import a sermon from a link, our server fetches the recording from the address you gave it, stores it in the same bucket, and from there it takes the same path.

Media links

Photos, audio and narration are served over time-limited signed links that expire in four hours. The link is generated per two-hour window so your phone can reuse what it has already downloaded rather than fetching the same photograph twice.

4. Reports and moderation

This section is more specific than it has to be, because “we may share your information with moderators” is the kind of sentence that hides the interesting part.

Content filtering. Posts, comments and display names pass a server-side wordlist filter when they are created. Rejected content is refused with a neutral message and is not stored — there is no record of a post that was never published.

A group’s leaders see: that a report exists, what kind of thing it is about, which post it belongs to, the reason given, when it was made, whether it has been dealt with, and whether the content has been removed. They do not see who reported it, and they do not see the free-text note. They also do not see which leader dismissed a report — the same objection, one role along: these are people who sit next to each other on a Sunday.

The person running Flock sees the full report row, including the reporter and the note, in the database. There is no admin console; this is a database query. The commitment made to Apple’s App Review — action on a report within 24 hours — is what this exists to meet.

The operational alert channel receives a closed list and nothing else. When a report is filed, an alert goes to a chat room so it is noticed. That alert carries the report’s id, the kind of thing reported, its id, the reason and the timestamp. It carries no reporter identity and no free text, by design and by test — because that alert lands in a room hosted by a company that logs it.

The same rule governs every other alert the server sends. A join request tells the room that somebody asked to join a named group, never who. The weather alerts carry a month, a call count and an HTTP status — never a coordinate, never a cell, never a request URL — because a coordinate in an alert would ship a location to a third party through the back door that running our own geolocation exists to close.

Blocking. If you block someone, their content disappears for you and yours disappears for them, in feeds, threads and search alike. It is not announced to them.

5. Deleting your account

Settings → Delete account. It is one tap, it is immediate, and it is not a support request. Here is precisely what it does, in one database transaction:

Erased outright:

• Your email address.
• Your Apple identifier and your Google identifier — both cleared, which means the same Apple or Google account can sign up again later and gets a genuinely new, empty account.
• If you signed in with Apple, we also ask Apple to revoke Flock’s access to your Apple ID. If Apple cannot be reached at that moment, your account is still deleted, and we are alerted to finish the revocation by hand.
• Your profile photo, both the pointer and the image file itself.
• Every Amen you gave.
• Every prayer you offered. A prayer identity must not outlive the account that prayed, so these are deleted outright rather than marked deleted.
• Every follow, in both directions.
• Every block, in both directions.
• Every group membership, with each group’s member count corrected.
• Your reading-plan progress.
• Every sermon import you started, with the link you gave us.
• Your notification settings, every device token your phones registered, and any notification still waiting to be sent to you.

Removed from view:

• Your posts and your comments are marked deleted and stop appearing anywhere — including on the public share pages, which check for a deleted account as well as a deleted post. They are marked rather than shredded because a conversation with holes punched through it reads worse for the people still in it than one whose replies are simply gone.

Deleted from storage:

• Every photo, every audio file and every generated narration belonging to every post you ever wrote — including posts you had already deleted yourself. Each profile photo you replaced along the way was already deleted at the moment you replaced it.
• Every recording you imported from a link, whether or not you posted it.

Your session ends everywhere. A counter on your account is incremented, and every sign-in token ever issued to you stops working at once, on every device.

What is deliberately kept:

• Reports you filed about other people’s content. A report is a record about somebody else’s behaviour, and it is still ours to act on.
• A reading plan you started for a group. The plan belongs to the group, not to you; the reading goes on without the person who left.

One honest qualification. A request that was already in flight when you pressed delete can, in rare cases, finish and leave a row behind — a reaction, a membership, or an audio file that a background job was already generating. These residuals are documented in the source code, they are invisible on every screen in the app, and they are on the list to close. They are named here rather than papered over.

Backups. Your data will also be present in database backups taken before your deletion. Those backups are deleted automatically after 30 days, after which nothing of yours remains in them.

6. How long we keep things

7. Logs

Server logs are the part of a privacy policy most likely to be vague, so here is the specific one.

The application writes one line per request, containing: a timestamp, a request id, the HTTP method, the route pattern (/v1/posts/:id, not the actual id), the status code, how many milliseconds it took, and your user id if you were signed in.

Deliberately absent from that line: the request body, the query string, the Authorization header, your email address, and your IP address. The email exclusion is a rule the code states in so many words: a log file is not an exception to “email is never returned by anything”.

There is no HTTP access log. Our TLS proxy (Caddy) is not configured with a log directive, so it writes no per-request access log — which means no file on the server records the IP addresses that connect to it. Error and startup output from each container is captured by Docker on the box.

No log-retention policy is configured. In practice container output is discarded when the container is replaced, which happens on every deployment. This is a description of what happens, not a policy we have committed to — and it is written this way because the alternative was a sentence that sounded better and was not checkable.

Rate limiting counts requests per IP address (or per session, where you are signed in) in the server’s memory. Nothing is written to disk, and an entry lives for at most one minute.

8. Security

• Sign-in tokens from Apple and Google are cryptographically verified against the provider’s published keys — issuer, audience and expiry all checked — before an account is touched.
• The session token is signed by our server, expires after 30 days, and can be revoked instantly for all your devices by deleting your account.
• All traffic is over HTTPS, with certificates the server obtains and renews itself.
• Uploads are size- and type-limited, and the upload link your app receives can only write to a path belonging to your own account.
• The public pages (share links, invitations, chapter links, this page) carry a content-security policy that forbids the page from fetching anything at all, and send no referrer.
• No part of the app or its infrastructure is published to a public registry.

Flock is one person’s project on one server. It is careful, and it is not a bank.

9. Your choices and your rights

In the app, right now:

• Edit or clear your display name and profile photo.
• Delete any post or comment you wrote.
• Block anyone.
• Report anything.
• Turn narration off.
• Turn ambient rain off.
• Delete your account, completely, without asking anyone.

If you are in the UK, the EU, or a US state with a privacy statute (California, Colorado, Connecticut, Virginia, and others), you have rights to access, correct, delete and obtain a portable copy of your personal data, and to object to processing based on legitimate interests. Most of these you can exercise yourself, immediately, from Settings. For access or portability — or anything the app does not let you do yourself — write to the address in §12 and you will get an answer.

You will not be treated differently for exercising any of these rights. There is nothing to withhold: Flock has no paid tier and no loyalty programme.

Do Not Track / Global Privacy Control: Flock does not track you across sites or apps, so there is nothing for these signals to switch off.

10. International transfers

Flock’s server is in the United States. If you use Flock from anywhere else, your information is transferred to and processed in the United States. Your photos and audio are stored with Cloudflare R2 and may be served from Cloudflare’s network worldwide. Apple and Google process sign-in in their own infrastructure, and Apple processes the weather query — a grid square with no identifier — in its own.

11. Children

Flock is for people 13 and older. Before you can sign in, the app asks how old you are; it keeps only whether the answer was 13 or over, on your phone, and never sends it to us. We don’t knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we delete it. If you believe a child under 13 is using Flock, write to support@flock.family.

12. Contact

Flock is operated by Lang Ministries Inc, a nonprofit corporation incorporated in Florida, USA. It is responsible for the personal information described on this page.

If you have a question about anything here, or want to exercise a right described in §9, write to support@flock.family. You will hear back from a person.

If you are in the UK or EEA and are unhappy with the answer, you may complain to your national data protection authority.

13. Changes to this policy

If this policy changes, the date at the top of this page changes. Small corrections — a clearer sentence, a fixed typo — change the date and nothing else. Previous versions are available on request.