1. Who is responsible for your data
The controller of your personal data is BlockFlock, operator of blockflock.app.
Privacy contact: privacy@blockflock.app
Security reports: security@blockflock.app
We have not appointed a data protection officer, because the Service does not carry out large-scale monitoring or process special categories of data. Privacy requests are handled by the team at the address above.
2. Scope
This policy covers the BlockFlock website at blockflock.app and the product available through it. It does not cover third-party websites you reach through links from the Service.
3. What we collect
Registration data. Your Flock ID, which is your permanent public name inside the Service. Your email address, used to identify your account, confirm it and contact you about it. Your password, which is handled by our authentication provider and stored only as a salted hash, so we never see it or store it in readable form. The referral code contained in the link you registered through.
Account and authentication records. The time your account was created, the confirmation status of your email address, sign-in events, password reset events and similar security records produced by the authentication provider.
Product activity data. Your position or positions, the block you are placed in, your cycle and stage progress, your point balance, the daily tasks you complete, and the timestamps of these events.
Referral relationship data. The link between your account and the account that invited you, and the link between your account and any accounts that register through your link.
Technical data. Your IP address, browser type and device information, processed by our hosting and authentication providers and recorded in their logs. We use this to keep the Service running, to investigate errors and to detect abuse such as automated registration and multi-accounting.
Correspondence. If you write to us, we keep your message, your email address and our reply.
4. What we do not collect
We do not ask for your name, postal address, city, phone number, date of birth or any identity document at registration.
The Service does not accept payments. We do not collect or store payment card details or bank account details.
We do not use advertising cookies, third-party analytics or tracking scripts. If that changes, this page will be updated before the change takes effect and, where the law requires consent, you will be asked for it first.
5. Why we process your data and on what legal basis
| What we do | Data used | Legal basis under the GDPR |
|---|---|---|
| Create and operate your account and run the product features available to it | Registration data, product activity data | Performance of a contract, Article 6(1)(b) |
| Confirm your email address and send service messages about your account | Email address, account records | Performance of a contract, Article 6(1)(b) |
| Record and maintain the referral relationship you registered with | Referral code, Flock ID, account identifiers | Performance of a contract, Article 6(1)(b) |
| Keep the Service secure and prevent, detect and investigate abuse, automated use and multi-accounting | Technical data, authentication records, product activity data | Legitimate interests, Article 6(1)(f) |
| Fix errors and improve reliability | Technical data, error logs | Legitimate interests, Article 6(1)(f) |
| Answer your questions and handle your requests | Correspondence, account identifiers | Legitimate interests, Article 6(1)(f) |
| Send optional product updates, if we introduce them | Email address | Consent, Article 6(1)(a), withdrawable at any time |
| Meet legal obligations and respond to lawful requests | Any of the above, as required | Legal obligation, Article 6(1)(c) |
Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that the processing is limited to what the stated purpose requires. You can object to this processing, see section 9.
6. What other participants can see
Your Flock ID is visible to other participants in the parts of the product that display it: the block your position sits in, and the referral structure connected to your account.
The account that invited you can see that your account registered through their link, together with your Flock ID and the date you joined. Accounts that register through your link are visible to you in the same way.
Your email address is never shown to other participants.
8. International transfers
Account and product data is stored in the European Union.
Some providers process limited data, mainly technical and log data, outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by the European Commission's standard contractual clauses together with additional technical and organisational safeguards, or by an adequacy decision where one applies to the provider concerned.
You can ask us for details of a specific transfer at privacy@blockflock.app.
9. Your rights
Under the GDPR you have the right to do the following.
- Ask for a copy of the personal data we hold about you.
- Ask us to correct data that is inaccurate. Your email address can be corrected at any time. Your Flock ID is permanent by design, and this is stated on the registration page before you choose it.
- Ask us to delete your account and the personal data connected to it.
- Ask us to restrict processing in certain situations.
- Object to processing we carry out on the basis of legitimate interests.
- Receive the data you provided to us in a structured, commonly used, machine-readable format, and ask for it to be transmitted to another controller where that is technically feasible.
- Withdraw consent at any time where processing is based on consent. This does not affect processing carried out before you withdrew it.
To exercise any of these rights, write to privacy@blockflock.app from the email address registered to your account. We reply within one month. If a request is complex we may extend that period by up to two further months, and we will tell you if we do.
If you believe we are handling your data incorrectly, you can complain to the supervisory authority in your country of residence. In Spain this is the Agencia Espanola de Proteccion de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
10. How long we keep data
Account data is kept for as long as your account exists.
When you ask us to delete your account, the account record and its profile are deleted within 30 days. Backups containing that data are overwritten within a further 30 days.
Authentication and security logs are kept for 90 days and then deleted.
Correspondence is kept for 24 months after the matter is closed.
When an account is deleted, the referral relationship it was part of is kept in a form that no longer identifies you: the account identifier and Flock ID are removed and only the structural link between the remaining positions is retained, so that the network structure stays consistent. That record can no longer be connected back to you.
Where a legal obligation requires us to keep specific records for longer, we keep only what the obligation covers, and only for as long as it applies.
11. Security
Data is transmitted over encrypted connections and stored with our managed backend and authentication provider. Access is restricted by per-account access rules at the database level and, on our side, limited to the people who need it to operate the Service. Passwords are stored only as salted hashes and are not accessible to us.
No system can be guaranteed completely secure. Use a password you do not use anywhere else, and write to security@blockflock.app if you think your account has been accessed by someone else.
If a data breach occurs that is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority as the law requires.
13. Children
The Service is not intended for anyone under 18 and accounts may not be created by minors. If we learn that an account belongs to a person under 18, we will delete it. If you believe a minor has registered, write to privacy@blockflock.app.
14. Automated decision-making
We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.
Automated checks are used to detect abuse. Where such a check leads to a restriction on your account, you can ask for it to be reviewed by a person by writing to support@blockflock.app.
15. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. Where a change materially affects how we use your data, we will tell you by email and through the Service before it takes effect. Earlier versions are available on request from privacy@blockflock.app.
16. Contact
This policy is published in English and in translation. In the event of a conflict between versions, the English version prevails, except where mandatory law in your country of residence provides otherwise.