Status: DRAFT for attorney review. Not yet published.
Both app stores require a publicly hosted privacy policy URL at submission;
host this (on the project website or a public repo page) once counsel has
reviewed it and the operating entity (OPERATOR) is real. Keep it in lockstep
with the in-app claims: the Settings → Privacy card, the Learn article "What
Flock U itself collects," and SECURITY.md all state the same facts — a change
to one is a change to all four.
Effective date: [SET AT PUBLICATION] · Operator: [LEGAL ENTITY — P1.1]
Flock U is built so that we know as little about you as possible. This policy
describes everything the service collects, why, and what control you have. It
is written to be read; there is no fine print.
Identity. Using Flock U requires no email, phone number, or name — your
first launch creates an anonymous account identified only by a random token.
If you choose to create a named account, we store a handle you invent and a
one-way cryptographic hash of your passphrase. There is deliberately no place
in our database for real-world identity.
Routes and address searches. Answered on demand and not stored. We do not
retain origins, destinations, searched addresses, route geometry, or the map
areas you look at, and none of them are ever written to logs with any
identifier. The only routing record we keep is an aggregate daily counter —
how many routes were planned and how many cameras were avoided, attached to no
account. Address searches are forwarded by our server to the OpenStreetMap
Nominatim geocoding service without your identity or IP.
Camera reports. When you publish a camera to the map, we store the
camera's location — not yours. The camera record has no reporter field, and
submitting a report does not cast a vote, so no row in our database links that
location to your account. It becomes part of a public, openly licensed dataset
(ODbL) and is permanent by design.
Votes. Confirm/flag votes are recorded against your account. That is
deliberate: one vote per person per camera is what keeps a handful of
throwaway accounts from erasing real cameras. Stated plainly, because it is
the one place we hold data of this kind: a vote row is your account, a precise
camera location, and a timestamp — so your voting history is, in effect, a
list of places you have been near. Vote selectively if that matters to you.
Every vote is deleted with your account.
Maps on Android. The map view on Android is rendered by the Google Maps
SDK, so Google receives your device's map activity there as it would in any
app built on their maps. That exchange is between your device and Google; it
never passes through our server and we receive nothing from it. Moving to an
open map renderer is on our roadmap.
Watched areas. If you save an area to be alerted about, we store that area
(a bounding box) against your account. This is the one place we deliberately
hold a location attached to an identity, because we have to check it whenever
new camera data arrives. We store the area you chose to watch — not where you
are, and not where you have been. Deleting the area, or your account, deletes
it.
Usage counts. None. We previously stored a count of how many routes each
account had planned, in order to meter the free trial. The trial is now a
seven-day period administered by Stripe, so that counter has been removed from
our database and nothing has replaced it. We do not record how much you use the
app.
Subscriptions. Using the app requires a subscription. There is a seven-day
free trial, but a payment method is collected before it begins, and the
subscription renews automatically at $4.99 per month once the trial ends unless
you cancel first.
Payments are processed entirely by Stripe — we never see or store card details.
Our server stores Stripe's customer and subscription identifiers, your
subscription status, and your renewal date, which together are what keep your
access on.
Because payment is required to use the product at all, this is worth stating
plainly rather than leaving in the fine print: Stripe knows who you are. A
payment method carries a name, and often a billing address and an email. That
is inherent to taking money and is not something we add — but under our previous
model it applied only to users who chose to subscribe, and it now applies to
everyone. What crosses that boundary is an identifier and an amount: we never
transmit your routes, searches, watched areas, or any location to Stripe or to
any other payment processor.
Session activity. Each sign-in session records when it was last used. This
is a single timestamp per session — when, not what — kept so expired
sessions can be cleaned up and a stolen token does not live forever. It is never
joined to routes, searches, or locations, because those are not stored to join
it to.
Terms acceptance. The version of the Terms you accepted and when.
News. Headlines in the News tab are fetched by our server from public
feeds and cached; your device requests them only from us, and no reading
history is kept.
Server logs. Standard operational logs record request paths and status
codes for reliability and abuse response. They never include query strings or
request bodies — a map query is a location, so we structurally exclude it —
and they are not tied to accounts.
libraries — the app's dependency list is short and contains none. (The
Android map SDK above is Google's and is disclosed rather than counted as an
exception.)
above, are places you asked us to monitor, which is a different thing, and we
name it rather than hide it behind this line.)
permission you explicitly grant for map centering and navigation (used live,
never stored).
your account, sessions, votes, terms-acceptance records, and subscription
records from our systems. Published camera locations remain on the public
map — they were never connected to you.
map and all data remain usable without it.
We disclose information only if required by valid legal process. Because of
the design above, what exists to disclose about any individual user is: an
anonymous or pseudonymous account, its vote rows, a subscription expiry, and a
terms-acceptance date. We cannot produce location history, search history, or
route history for any user, because none is recorded.
The service requires users to be 18 or older (see Terms §1) and is not
directed at children.
Material changes to this policy will be posted here with a new effective date,
and in-app claims will be updated in the same release.
Questions about this policy, or a request to delete data we hold about you:
If you find a place where our practice does not match this policy, tell us at
that address. We will correct the practice or the policy, whichever is wrong.
Flock U is operated by Waterview Technologies LLC (Missouri, USA).
*Maintainer note: the technical enforcement of each claim above is documented
in SECURITY.md (log serializer, schema minimalism, aggregate-only
route_metrics, hashed tokens, deletion cascade). If code changes make any
sentence here untrue, treat it as a release blocker — under this product's own
identity, a false privacy claim is a core product failure (ROADMAP §Product
identity, P0.A4).*