Privacy Policy

Flock (“Flock,” “we,” “us,” or “our”) is a social investing application operated by Patrick Devoney, an individual sole proprietor based in the State of Florida, United States. Flock is offered as a mobile application for iOS and Android and through the website at www.flockinvesting.com.

For the purposes of the EU and UK General Data Protection Regulation, Patrick Devoney is the data controller for personal information processed through Flock.

If you have any question about this policy or about how your information is handled, you can reach us at any time at hello@flockinvesting.com.

This policy applies to the Flock mobile application, the Flock website, and all related services (together, the “Service”). It does not apply to the practices of third parties we do not own or control, including your brokerage, Apple, Google, or any website linked from within the Service. Those parties handle your information under their own privacy policies, and we encourage you to read them.

The short version, with the details in the sections that follow:

• We do not sell your personal information, and we do not share it with advertisers or data brokers.
• Flock is a social product. Your display name, handle, profile photo, posts, comments, votes, and chat messages are visible to other users in the contexts where you share them.
• If you connect a brokerage account, we import your holdings and transaction history in order to build your portfolio and create posts. The connection is read-only — Flock cannot place trades, move money, or withdraw funds.
• We never receive or store your brokerage username or password. Those credentials are entered directly with our brokerage-connectivity provider.
• When you use the AI assistant, your message and — if you choose to include it — portfolio context is sent to a third-party AI provider to generate a response. See Section 7.
• You can delete your account and its associated content at any time from within the app.
• Flock is intended only for users who are 18 years of age or older.

We collect information you provide directly, information generated by your use of the Service, and information we receive from third parties you connect to Flock.

4.1 Account and identity information

Flock offers two ways to sign in. Depending on which you use, we collect the following:

• Sign in with Apple — an Apple-issued user identifier, your email address (which may be an Apple private-relay address that forwards to your real address), and, if you choose to share it, your name.
• Sign in with Google — a Google-issued user identifier, your email address, your full name, and your Google profile photo URL.

4.2 Profile information

• Your display name.
• Your unique handle (username) that identifies you to other users.
• A profile photo, if you upload one. Photos are selected from your device’s photo library; Flock requests photo-library access only at the moment you choose to upload.

Your display name, handle, and profile photo are visible to other signed-in Flock users. Profile and group photos you upload are stored privately and are served only to users who are signed in to Flock — they are not publicly accessible on the internet, and they cannot be viewed by someone who simply has a link.

One exception: if you signed in with Google and kept your Google profile photo rather than uploading your own, that image is hosted by Google at a Google-controlled address and its accessibility is determined by Google, not by us. You can replace it at any time by uploading a photo in Flock.

4.3 Content you create

• Investment posts — the asset, whether the transaction was a buy or a sell, quantity, price, the time of the transaction, a title and description you write, and a confidence rating.
• Comments on posts, including an optional confidence rating.
• Group chat messages, including message text, replies and threads, edit timestamps, and emoji reactions.
• Groups you create or join — group name, description, group photo, channels, membership and invitation status, and invite links.
• Watchlists and votes — assets you add to personal or group watchlists, your rankings, and Bull/Bear votes you cast.
• Supports (endorsements) you give to other users’ posts.
• Read, unread, and mute state for channels and posts, which we use to show accurate badges and notifications.

4.4 Brokerage and financial information

If you choose to connect a brokerage or crypto exchange account, we work with a specialist brokerage-connectivity provider to establish that connection. That provider is identified to you by name in the app before you enter any credentials. Through the connection we receive and store:

• Your open positions — the assets you hold, quantities, and cost basis or average purchase price.
• Your transaction and trade activity, including buys, sells, quantities, prices, and transaction dates. Imported activity is turned into posts in your Flock account.
• Closed-position history, which we retain and display for up to five years.
• A provider-issued user identifier and secret that authenticate our requests on your behalf. These are stored in a database table that is unreachable from the app client and accessible only to our server-side functions.
• System-generated balance-adjustment records, which correct for gaps where a brokerage does not report complete trade history.

4.5 AI assistant conversations

• Your chat titles and the full text of every message you send and receive.
• Citations, source links, and chart tickers returned with each response.
• A count of AI tokens you have consumed within a rolling window, which we use to apply fair-use rate limits.

4.6 Device and technical information

• A push notification token for each device on which you enable notifications, so we can deliver alerts.
• Standard server and application logs generated when you use the Service, which may include IP address, timestamps, and error diagnostics.
• Authentication session and refresh tokens, used to keep you signed in securely.

4.7 Safety and moderation records

• Blocks — a record of which accounts you have blocked. Blocking is mutual: blocked users and blockers become invisible to one another across the Service.
• Reports — when you report content or a user, we record who submitted the report, the type and identifier of the reported content, the reported user, and the reason you give. Reports are visible only to us, never to other users.

4.8 Website visitors

If you use a form on our website, we collect what you submit there:

• Waitlist — email address, first and last name, an optional message, and whether you signed up as a prospective user or investor.
• Demo requests — name, university, role, email address, enrollment size, and an optional message.

We use the information described above to:

• Create and maintain your account, and authenticate you when you sign in.
• Operate the core features of the Service — displaying posts, groups, chat, watchlists, portfolios, and market data.
• Import and reconcile your brokerage holdings and trade activity so your portfolio and track record stay accurate.
• Generate AI assistant responses to the questions you ask.
• Send push notifications about activity relevant to you, where you have enabled them.
• Enforce our Terms of Service, investigate reports, remove objectionable content, and suspend or remove users who violate our rules.
• Detect, prevent, and respond to fraud, abuse, security incidents, and technical problems.
• Apply fair-use limits, such as AI token rate limiting.
• Respond to your support requests and communicate with you about the Service.
• Comply with legal obligations and enforce our legal rights.
• Understand, in aggregate, how the Service is used so we can improve and develop it.

We do not use your personal information to serve you third-party advertising, and we do not perform automated decision-making that produces legal or similarly significant effects about you.

If you are located in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

Like nearly all software, Flock depends on a small number of specialist service providers to operate. We share personal information with them only to the extent needed to run the Service, never for their own independent purposes. Each is bound by its own privacy policy and, where applicable, a data processing agreement requiring it to protect your information and process it only on our instructions.

The categories of provider we use, and what each receives, are:

We name Apple and Google specifically because you interact with them directly when you sign in. We identify our brokerage connectivity provider by name inside the app at the moment you connect an account, so that you know exactly who receives your brokerage credentials before you enter them.

If you would like the current list of our named service providers, email us at hello@flockinvesting.com and we will provide it. We will always tell you who processes your personal information on request.

Beyond these providers, we disclose personal information only: to comply with a law, subpoena, court order, or lawful government request; to enforce our Terms of Service or investigate a violation; to protect the rights, safety, or property of Flock, our users, or the public; or in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy.

Specific disclosure about the AI assistant

Flock is a social product, and understanding what is visible to whom matters. Other signed-in Flock users can see:

• Your display name, handle, and profile photo.
• Posts you create, and the group members you share them with. Posts shared into a public group are visible to anyone who can view that group.
• Comments, supports, votes, and chat messages you post, within their context.
• Portfolio positions and holdings you have chosen to share into a group, including quantities and performance where the group is configured to display them.

Other users cannot see:

• Your email address.
• Your AI assistant conversations, which are private to your account.
• Your brokerage credentials or brokerage connection secrets.
• Reports you submit, or the list of accounts you have blocked.
• Any holding or transaction you have not shared into a group.

Please treat anything you post as potentially permanent and public. Other users may screenshot, copy, or repeat content you share, and we cannot control what they do with it.

We keep your personal information for as long as your account is active. When you delete your account, we delete your account record and the content associated with it, including your posts, comments, chat messages, watchlist entries, votes, AI conversations, and stored brokerage connection credentials.

Some information persists after deletion:

• Moderation records. Reports submitted about your content are retained after your account is deleted so we can maintain a safety record and respond to repeated abuse. Reports are dissociated from your account identifier.
• Backups. Encrypted infrastructure backups may retain residual copies for a limited period before being overwritten on a rolling schedule.
• Legal and compliance records. We retain what we must to comply with legal obligations, resolve disputes, and enforce our agreements.
• Aggregated and de-identified data that can no longer be linked to you.

Waitlist and demo-request submissions are retained until you ask us to remove them, or until they are no longer relevant to the purpose for which they were submitted.

We take the following measures to protect your information:

• All traffic between your device and our servers is encrypted in transit using TLS.
• Data is encrypted at rest by our infrastructure provider.
• Database-level row security policies restrict what each account can read and write, so access is enforced by the database itself rather than only by application code.
• Brokerage connection secrets are stored in tables that are entirely unreachable from the mobile app and readable only by privileged server-side functions.
• Third-party API keys are held server-side in our edge functions and are never shipped in the mobile application.
• Incoming brokerage webhooks are cryptographically signature-verified before processing.

Controls available in the app

• Access and correct your profile information from the settings screen.
• Delete your account at any time from account settings. This removes your account and associated content, subject to Section 9.
• Disconnect a brokerage at any time from the brokerage connections screen.
• Delete AI conversations individually.
• Turn off push notifications in the app or in your device’s system settings.
• Block users and manage your blocked list.
• Delete individual posts, comments, and messages you have created.

Rights you can exercise by contacting us

Depending on where you live, you may have the right to request access to the personal information we hold about you, request a portable copy of it, request correction of inaccurate information, request deletion, object to or restrict certain processing, withdraw consent you previously gave, and not be discriminated against for exercising any of these rights.

To make a request, email hello@flockinvesting.com. We will respond within the time required by applicable law — generally 30 days, and 45 days under California law, each extendable where permitted. We may need to verify your identity before acting, which we will normally do by confirming control of the email address on the account.

California residents

Under the California Consumer Privacy Act as amended by the CPRA, California residents have the rights described above, including the rights to know, delete, correct, and to opt out of the sale or sharing of personal information and limit the use of sensitive personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We collect the categories of personal information described in Section 4, including identifiers, financial information, internet activity, and, where you provide it, a profile photo. Financial account information is treated as sensitive personal information; we use it only to provide the Service and never for purposes requiring a right to limit.

EEA and UK residents

In addition to the rights above, you have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first, so please consider contacting us before doing so.

Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, and other states with comprehensive privacy laws have comparable rights to access, correct, delete, and obtain a copy of their personal information, and to appeal a denied request. To appeal, reply to our response or write to us at the address above.

Flock is operated from the United States, and our infrastructure and service providers are located primarily in the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your country.

Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses, as implemented in our agreements with our service providers.

Flock is intended solely for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us at hello@flockinvesting.com and we will delete the account and its information promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If we make a material change — for example, a new category of information collected or a materially new use or disclosure — we will provide more prominent notice, such as an in-app notice or an email, before the change takes effect. Your continued use of the Service after an update means you accept the revised policy.

For any privacy question, request, or complaint, contact us at hello@flockinvesting.com. We aim to respond to all inquiries within a few business days.

See also our Terms of Service.