Privacy Policy

Last updated: November 11, 2026

theflock is a private, invite-only community of Christians who help each other and meet in real life. We collect only what the community needs to work. No ads, no tracking, no selling of data.

This policy explains which personal data the theflock app (iPhone and Android) and the website theflock.community process, why, who can see it, how long we keep it, and what rights you have.

1. Who is responsible

SmartReach LLC, 2880 W Oakland Park Blvd, Suite 225C, Oakland Park, FL 33311, United States, runs theflock.
Contact for everything about your data: support@theflock.community

2. Your account and profile

When you create an account, we store:

• Name, e-mail address and password. The password is stored only as a secure hash; nobody at theflock can read it.
• Profile photo (required). We cut it to a square and save it again as a new image, which removes hidden metadata such as the GPS position from your camera.
• Gender (woman or man). It is used only to open the women-only and men-only channels. It is not shown on your profile.
• Home town. You pick a town from a list, or set an approximate point. We store the town and a point rounded to about 1 km. Other members see only the town's name, never the point.
• Optional: a sentence about you, and a place where you are staying for a while (with an end date).
• Settings: your language, the radius for "Near me", the channels you follow, and whether you want push notifications and the weekly e-mail.
• Your consent at sign-up: that you ticked the two boxes (Terms of Use and Privacy Policy; your faith, see section 11), which versions of these texts were in force, the time and your IP address. We keep this as proof of your consent while your account exists.

What other members see: your name, photo, home town, the sentence about you, who invited you, when you joined, and what you share in the community. Your e-mail address and gender are not shown to other members.

We use this data to run your account and the community. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3. Invitations

theflock is invite-only, so everyone here is known by someone. When you invite someone, we store the invitation link, the name you give the person, and your answer to "How do you know this person?". When they join, the invitation is linked to both accounts, and their profile shows that you invited them. The theflock team can see the invitations and the answers, to keep the community trustworthy.

4. What you share

We store what you create in the app, so it can be shown to the people it is meant for:

• posts, polls and events, with their photos (photos are resized and their metadata is removed);
• answers, emoji reactions, poll votes, event replies ("going" or "maybe") and event invitations;
• friendships and friend requests;
• direct messages between two members.

Posts are visible to members of theflock, not to the public internet. Some posts are visible only to women, only to men, or only to invited members. A post you mark as local stores its approximate area (the centre of a cell of about 5 km, never your exact point), so it can be shown to members nearby.

Direct messages are stored on our servers so you can read them on any of your phones. They are not end-to-end encrypted. The theflock team does not read your messages. If someone reports a message to us, we look at that reported message.

5. Your location ("Near me")

If you allow it, the app uses your phone's current location to show posts, events and channels near you. Before it leaves your phone, the location is rounded to about 1 km. It is used only to answer that one search and is not stored: not in your profile, not in our logs, and nobody else can see it. If you don't allow it, we use the place you're staying at (if you set one) or your home town instead. You can change the search radius (5 to 100 km, or the whole country) in your settings, and turn location access off in your phone's settings at any time.

theflock never tracks your location in the background.

6. Reports, blocks and moderation

• Reports: when you report a post, answer, message or member, we store who reported what, the reason, and what the team decided. Only the theflock team sees reports. The reported person is not told who reported them.
• Blocks: we store whom you blocked, so that person can no longer contact you. They are not told.
• Moderation: reports are reviewed personally by theflock's founder, within 24 hours. The team may remove content, ask for a new profile photo, or suspend an account. We store these decisions and their reason.

Legal basis: our legitimate interest and duty to keep the community safe (Art. 6(1)(f) GDPR) and our contract with you.

7. Notifications and e-mails

Push notifications: if you allow them, your phone gets a push token from Apple or Google, which we store with your account. We use it to tell you about answers, messages, friend requests, event invitations and reminders. Notifications are delivered through Google Firebase Cloud Messaging and Apple's push service. You can turn push off in theflock's settings or your phone's settings; signing out stops push notifications to that phone.

E-mails: we send e-mails that your account needs (codes to reset your password or confirm deleting your account, and messages about your profile photo), and a weekly e-mail with what's new near you. You can turn the weekly e-mail off in settings or with the link in every weekly e-mail.

The app also keeps a list of your notifications (for example "Ana answered your post") on our servers.

8. Permissions on your phone

• Camera and photos: only to take or choose your profile photo or a photo for a post. Only the photos you pick are uploaded.
• Location: only while you use the app, for "Near me" (see section 5).
• Calendar: to open your calendar's "New event" screen when you want to save an event. theflock reads nothing from your calendar or your contacts.
• Notifications: see section 7.

On your phone, the app keeps your sign-in token in the phone's secure storage (Keychain on iPhone) and a few settings, such as whether to show the Bible verse on the start screen.

9. Data processed automatically

• Server logs: when you use the app or the website, our hosting provider processes technical data such as your IP address, the date and time, and the app or browser version. This is needed for security and to keep the service running (legitimate interest, Art. 6(1)(f) GDPR). Logs are deleted after a short period.
• Abuse protection: to stop people from guessing passwords or invitation codes, we count requests for a short time (minutes to hours) by IP address or account.
• Cookies: the website uses only a technically necessary session cookie on pages that need it. There are no tracking or advertising cookies.

We do not use analytics, advertising, tracking or marketing SDKs in the app or on the website.

10. Service providers

• Laravel Cloud (Laravel Holdings Inc.): hosting of the website, the app's server and the database, and storage of photos.
• Resend (Plus Five Five, Inc.): sending e-mails.
• Google Firebase Cloud Messaging (Google Ireland Ltd. / Google LLC) and Apple Push Notification service (Apple Inc.): delivering push notifications.

Town names come from GeoNames and are stored on our own servers, so searching for a town sends nothing to a third party. These providers may process data in the United States. Where required, transfers are based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. We do not sell or rent your data to anyone, and we share it with no one else unless the law requires it.

11. Your faith

theflock is a community of Christians. Being a member, and what you share in it (for example prayer requests or church events), says something about your religious beliefs. We treat this as sensitive data.

Your explicit consent. When you create an account, you tick a separate box to agree that theflock processes the fact that you are a Christian and take part in a Christian community, and the faith-related things you choose to share, in order to run the community you join (Art. 9(2)(a) GDPR). You can't become a member without this tick, because theflock can't be offered without it. We never use this data for anything else, never use it for advertising, and never share it outside theflock.

Withdrawing your consent. You can withdraw it at any time: delete your account in the app (section 13), or write to support@theflock.community from your account's e-mail address and we delete your account for you. Withdrawing doesn't affect what happened before it.

12. How long we keep data

• Your account, profile and content: as long as your account exists, or until you delete a post, answer or photo yourself.
• Your location for "Near me": not stored at all.
• A photo uploaded during sign-up that is never used: deleted automatically after it expires (within hours).
• Codes for password reset and account deletion: valid for a short time, then useless.
• Push tokens: until you sign out, delete your account, or the token stops working.
• When you delete your account: deleted immediately as described in section 13. Backups are overwritten within 30 days.

13. Deleting your account

In the app, open Settings, scroll to the bottom and tap Delete account. Confirm with your password, or with a code we send to your e-mail address. You can also write to support@theflock.community from your account's e-mail address and we delete it for you.

Deleting is immediate and can't be undone. We delete:

• your name, e-mail address, password, profile photo, profile and settings;
• your posts and their photos. A post that other members already answered stays as an empty placeholder without your text or photos, so their answers stay readable;
• the text of your answers;
• your direct conversations (for both people), reactions, votes, event replies, friendships, blocks, followed channels, notifications and push tokens;
• the record of your consent at sign-up;
• your unused invitations, and the name and note your inviter wrote about you.

What stays, without anything that identifies you: an empty account shown as "Deleted member", so that threads and invitation chains still make sense ("invited by Deleted member"), and reports you filed about others, for the safety of the community.

14. Your rights

You have the right to access, correct, delete and receive a copy of your data, to restrict or object to its processing, to withdraw your consent, and to complain to a data protection authority (for example in your EU country, or PRODHAB in Costa Rica). You can change most of your data yourself in the app. For everything else, write to support@theflock.community.

15. Age

theflock is for adults. You must be at least 18 years old to create an account. We do not knowingly collect data of anyone younger. If you think a child has an account, please tell us and we will delete it.

16. Security

All connections are encrypted (HTTPS). Passwords are hashed, the app's content is only available to signed-in members, and only the theflock team can open the admin area. No system is 100% secure, but we take reasonable measures to protect your data.

17. Changes

We update this policy when theflock changes. The current version is always at theflock.community/privacy. If a change is important, we tell you in the app or by e-mail.