Privacy Policy

Leroy Labs LLC ("Flock", "we", "us", or "our"), the company behind Flock, respects your privacy. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have when you use the Flock mobile app and the flock.pics website (together, the "Service"). Flock is the event photo-sharing app: a way to gather everyone's photos from an event into one shared album.

By using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Information we collect

• Account information. When you create an account we collect basic profile details such as your name and the email address or sign-in identifier provided by the sign-in option you choose (for example, Apple or Google sign-in). We do not receive or store your password for those sign-in providers.
• Event content. The photos, videos, event titles, and join activity that you or other members add to an album. Each item is associated with the member who contributed it so the album can show who took each photo.
• Purchase information. When you buy an optional per-event upgrade or add-on, we receive a record of the transaction (such as the product purchased and a confirmation identifier) from the App Store or Google Play. We do not collect or store your full payment-card details; the store processes payment.
• Device and usage data. Device type, operating system, app version, language, and diagnostic and analytics data (such as which features are used and how the app performs) that help us keep the Service working and improve it.
• Notifications. If you enable push notifications, we store a push token for your device so we can send you updates about your events. You can turn notifications off at any time in your device settings.
• Support and safety. If you contact us or submit a report about content or another member, we collect the information you provide so we can respond and take appropriate action.

2. How we use information

• To create, host, and display shared event albums.
• To let members join events via QR code, link, or join code.
• To operate, maintain, secure, and improve the Service.
• To process optional per-event upgrades and add-ons through the App Store or Google Play.
• To find the photos you appear in, if you turn on Find me (see section 5).
• To send you service-related communications about your events and account.
• To keep the Service safe: reviewing reports, removing content that violates our rules, and enforcing our Terms of Service and Community Guidelines.
• To comply with legal obligations and respond to lawful requests.

3. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data under one or more of the following legal bases: performance of a contract (to provide the Service you request); your consent (for example, where you enable optional features or notifications); our legitimate interests (to secure, analyze, and improve the Service and keep it safe); and legal obligation (where the law requires us to process or retain certain data).

4. How we share information

Photos and videos added to an event album are visible to the other members of that event. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described below:

• Service providers. We use trusted third parties to run the Service on our behalf, in categories such as authentication and sign-in, cloud hosting and storage, analytics and diagnostics, App Store payment processing, and push-notification delivery. These providers may process your information only to perform services for us and are bound by contract to protect it to a standard at least as protective as this Policy.
• Legal and safety. We may disclose information if required by law, to respond to lawful requests, to enforce our terms, or to protect the rights, safety, and property of our members, the public, or Flock.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

5. Find me (face matching)

Find me is an optional feature that helps you find the photos you appear in at events where it's on: events upgraded to 50 guests or more, and events whose host added it. It uses face recognition, so it involves biometric information. It runs only if you turn it on, and Flock works the same without it.

• What we collect. If you turn on Find me, you take a selfie in the app. When an event you belong to where Find me is on ends, we create face templates (numerical representations of facial features) from your selfie and from the faces in that event's photos, and compare them to find the photos you appear in. Photos added after the event ends are checked as they arrive. The photos can include people who don't use Find me: templates of their faces are used only to find members who turned Find me on, and are never used to identify them.
• Who sees the results. Only you. Hosts and other members can't see which photos you appear in, and no one can search for another person.
• Who handles it. A trusted cloud service provider does the face matching on our behalf. We never use face data for advertising, and we never sell, lease, trade, or otherwise profit from it.
• How long we keep it. The face data made from an event's photos is permanently deleted 30 days after the event stops taking new photos, or sooner if the event or its album is deleted. When a photo is deleted, its face data is deleted too. The list of photos you were found in stays with the album, visible only to you, until the album is deleted. Your selfie and the face data made from it are deleted when you delete your face data (You → Find me), when you delete your account, or after 12 months without joining an event, whichever comes first.
• Your consent. We ask for your explicit consent in the app before your selfie is taken. You can withdraw it at any time by deleting your face data.

6. Data retention and event lifespan

Events have a limited lifespan, and album content is associated with the event rather than published permanently online. An event's album, including its photos and videos, is permanently deleted at the end of its plan's retention period: 7 days after the event ends on a free event, and 3 months, 6 months or 1 year after it ends on an upgraded event, or later if the host keeps it another year. The app shows each album's deletion date. We retain your other information for as long as your account is active or as needed to provide the Service, and afterward only as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Hosts of upgraded events can remove photos from them, and you can delete your account at any time (see below).

7. Security

We protect your information using technical and organizational measures, including encryption in transit, encryption at rest where appropriate, and access controls that limit who can access data. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we work to protect your information and to address security issues promptly.

8. Your rights and choices

• Delete your account. You can permanently delete your account and associated personal data from within the app (Profile → Delete account).
• Access, correct, port, or object. Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To make a request, email us at support@flock.pics.
• Withdraw consent. Where we rely on consent, you can withdraw it at any time without affecting prior processing.
• Device permissions. You control camera, photo, and notification permissions in your device settings, and you can change them at any time. The app remains usable if you decline a permission, though some features may be limited.
• Leave an event. You can leave an event or ask a host to remove your contributions.

9. California privacy rights

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use and disclose it, to request access to or deletion of that information, to correct inaccurate information, and to not be discriminated against for exercising your rights. We do not sell or share your personal information as those terms are defined under California law. To exercise your rights, email support@flock.pics; we will verify and respond as required by law.

10. EEA and UK residents

If you are in the EEA or UK, you may exercise the rights described in Section 8 and you have the right to lodge a complaint with your local data protection authority. Where we transfer personal data outside your country, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect it.

11. Children's privacy

The Service is intended for people aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact us at support@flock.pics and we will delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice where appropriate. Your continued use of the Service after an update means you accept the revised Policy.

13. Contact us

Questions about privacy or this Policy? Email us at support@flock.pics. For formal legal or privacy notices, contact legal@flock.pics. The Service is operated by Leroy Labs LLC.