Privacy Policy

Entity: Grex Labs LLC, a Wyoming LLC, d/b/a The Flock Effective date: August 30, 2026 · Version: 2026-08-v1

This Privacy Policy explains how Grex Labs LLC, d/b/a "The Flock" ("we," "us"), collects, uses, shares, and protects personal information when you apply to, join, or use our mobile and web application, our website theflock.co, and our community channels (the "Platform"). By using the Platform you agree to this Policy.

Written from the actual app (Flutter + Firebase); names the real data fields and service providers found in the code.

1. Information We Collect

1.1 Account and application data you provide

Identity and contact: first and last name, display name, phone number (our primary sign-in method), email address, and date of birth.
Profile and application answers: bio, sex, home country, work and work situation, travel experience and style, preferred length of stay, countries visited and want-to-visit, trips you're interested in, interests, social media handles/links, how you heard about us, and which guided/travel programs you've done.
Photos: profile, "goofy," group, and landscape photos you upload (stored in Firebase Storage).
Member-added content: self-promotion project links, community contributions, trip proposals, votes, pre-arrival form details, and messages you post in community chats.
Identity verification: information used to verify you during vetting.

1.2 Billing data

Membership is billed annually through our payment processor, Stripe. Stripe processes your payment-card details; we store billing identifiers and status (such as Stripe customer and subscription IDs, your membership rate, and renewal dates), not your full card number.

When you accept our Terms, Privacy Policy, Membership & Community Agreement, Liability Waiver, or give SMS/photo/marketing consent, we record which document version you accepted, the date/time, and basic device context. We keep these records to comply with law and to administer your membership.

1.4 Device, usage, and technical data (collected automatically)

Device and browser info: platform (iOS/Android/web), device model and name, manufacturer, OS version, user agent, system and keyboard languages, and locale.
Push-notification tokens (Firebase Cloud Messaging) and your notification/email preferences.
Usage, diagnostics, and crash/error data via analytics and monitoring tools.
Screen-capture events: our mobile app detects screenshots and screen recordings of member content and records a count of such events. Repeated capture may lock your account, consistent with our community rules protecting members' privacy.

1.5 Information from third parties

Referrals from existing members, and your interactions with us on social media (e.g., Instagram).
Analytics and advertising partners, consistent with their terms and your settings.

2. How We Use Your Information

To review applications, conduct vetting/screening, verify identity, and decide on membership. Review is a community process: parts of your application (your name, photos, bio, and answers) may be shown to current members, who can share private feedback, vouches, or testimonials with the review team and, if you are accepted, welcome messages that are delivered to you.
To operate the community: profiles, the member directory, community chats, trip proposals and voting, Flock Month coordination, the pre-arrival form, and matching (e.g., roommate/social planning).
To process membership billing and manage your subscription via Stripe, including renewal reminders.
To send you service communications and, where you've opted in, announcements, trip updates, and our newsletter — by email, in-app message, push notification, SMS, or messaging apps such as WhatsApp.
To secure the Platform, prevent fraud and abuse, enforce our rules (including screen-capture protections), and develop and improve our features.
To comply with legal, tax, and accounting obligations.
With appropriate consent where required, to feature member-submitted photos or content on our social media and marketing. If you do not want your identifiable likeness featured in future promotional materials, email community@theflock.co; see Terms of Service §8 for scope.

Where GDPR/UK GDPR applies we process personal data on these bases: performance of a contract (providing membership and community services); legitimate interests (operating, securing, and improving the community, and protecting members); consent (e.g., marketing, certain cookies/analytics, and use of your photos); and legal obligation. You may withdraw consent at any time.

We do not sell your personal information for money. We share it with vendors that help us run the Platform, under contracts limiting their use of the data:

Google Firebase — authentication, database (Firestore), file storage, hosting, app integrity (App Check), push notifications (Cloud Messaging).
Stripe — membership payment processing and billing.
Twilio — phone verification and/or messaging.
SendGrid — transactional and newsletter email delivery.
Mapbox — maps and geocoding for trip and location features.
Amplitude — product analytics; Sentry — crash and error monitoring.

With current members during application review: while your application is in review, we may show parts of it (your name, photos, bio, and answers) to existing members so they can help us vet applicants and leave feedback, vouches, or testimonials. Member feedback goes to the review team and is not published outside The Flock; welcome messages from members are shared with you if you are accepted.
With other members: limited profile information you choose to share (e.g., name, photo, bio, trip participation) so the community and directory can function.
Travel-related third parties only as you direct: if you follow a referral or discount link (e.g., Airbnb, Viator, a coworking space) or book a stay, your dealings are governed by that provider's own privacy practices. We do not book or pay providers on your behalf.
Legal and safety: to comply with law, enforce our agreements, or protect rights, safety, and property.
Business transfers: in connection with a merger, acquisition, or sale of assets.

6. Affiliate Links

Some experience and travel links we share (for example, Viator) are affiliate links, meaning we may earn a commission if you book through them, at no extra cost to you. We disclose this in line with applicable advertising rules. Using these links is optional, and your transaction is solely with the provider.

7. International Data Transfers

We are based in the United States, and your information may be processed in the U.S. and other countries with different data-protection laws. Where required, we use appropriate safeguards (such as Standard Contractual Clauses).

8. Data Retention

We keep personal information for as long as needed to provide the Platform and for legitimate business or legal purposes. Application data for declined applicants is retained for twelve (12) months and then deleted or anonymized. We may keep basic account, identity, billing, transaction, and consent records for seven (7) years after you stop being a member for tax, accounting, and legal-defense purposes.

9. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, to object to certain processing, and to opt out of certain sharing or targeted advertising. To exercise these rights, contact community@theflock.co. We will respond as required by law and will not discriminate against you for exercising your rights.

Notifications and email: manage push and email preferences in the app's notification settings, or unsubscribe via the link in our emails. Some operational messages are necessary to provide the Platform.
WhatsApp/SMS: reply STOP or ask us to stop non-essential messages.
Photos: email community@theflock.co if you do not want to be featured in future promotional materials (community/in-app use and already-published content are not affected — see Terms of Service §8).
Account deletion: request in-app or by email; some records are retained as described in Section 8.
EEA/UK residents (GDPR) and California residents (CCPA/CPRA) have specific rights; contact us to exercise them.

10. Security

We use reasonable administrative, technical, and physical safeguards (including Firebase security rules and App Check) designed to protect personal information. No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and authorities as required by law.

11. Children

The Platform is for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact community@theflock.co and we will delete it.

12. Cookies and Analytics on Our Website

Our website and apps use cookies and similar technologies for functionality, analytics, and (where applicable) marketing. You can control cookies through your browser and our cookie settings.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new version number and effective date and, for material changes, provide additional notice (email or in-app) and, where required by law, ask for renewed consent.

14. Contact Us

Grex Labs LLC (d/b/a The Flock) 111 NE 1st St, 8th Floor, #89108, Miami, FL 33132 (mailing address; Wyoming limited liability company) Email: community@theflock.co · Web: theflock.co