Privacy Policy

3.1Data you give us

• Account: your email address. In the app you can also give your name and, if you choose to add it, a phone number. You can create your account in the app or on the website; it is the same account.
• Sign-in: a password, stored as a salted hash and never in clear text, or your Apple sign-in identifier if you use Sign in with Apple in the app. If you sign in with Google, Google confirms your email address to us and we do not store a separate Google identifier.
• Pet profile: species, name, breed, date of birth, sex, whether your pet is spayed or neutered, for a dog of mixed or unknown breed its expected adult size, weight, notes and photos you add.
• Health and care records: vaccinations, treatments and doses, medications, vet visits, lab results, weekly check-in answers, symptom notes, and any documents you choose to scan or upload.

3.2Answers about you

When you set up Flok in the app, or answer the questionnaire on the website, we ask a few questions about you and how you care for your pet.

• In the app: your gender, your age group, what matters most to you in caring for your pet, how often you travel with your pet, how often your pet sees a vet, how confident you feel about noticing changes in your pet, how you heard about Flok, and where you look for pet care information. You can choose “Prefer not to say” for gender.
• On the website: your main goal as a pet parent, the challenges you face in caring for your pet, whether you would notice if your pet felt unwell, whether you have had a vet bill you did not expect, what your pet eats, whether you know which foods are not safe for your pet, how you keep track of your pet’s care, how much time a day you want to give to pet care, how often your pet sees a vet, and how you would feel to see your pet doing better. The website works out a care score and the lines it shows you from these answers in your browser.

We use these answers only to understand who uses Flok and how (analytics). They are stored in your analytics profile, which is linked to your Flok user ID. On the website they stay in your browser while you answer. If you create an account, our server adds them to your analytics profile. They are not added to your pet’s records.

3.3Data collected by the app

• Device and usage: device model, operating system version, app version, language, crash reports, the screens you open, and events that describe how features are used, such as which setup step you reached. These events are linked to your Flok user ID and your username.
• Install and campaign data: which link or campaign led to the install, and events such as sign-up and the start of a subscription, linked to your Flok user ID. We do not send your name, email address or pet records to our attribution provider. The app does not use Apple’s advertising identifier (IDFA) and does not ask for permission to track you across other companies’ apps.
• IP address: our servers and our providers receive your IP address when the app connects to them, as every internet service does.
• Camera and photos: only when you grant permission, to take or choose a pet photo or a picture of a vet paper.
• Location: Flok has no feature that follows your location, and the app never reads it in the background. A screen that shows a map, such as the one where you choose a place for an event, can ask iOS for your location while you use that screen. It does so only if you allow it, and you can refuse and still use Flok. If you save a place with a record, the place is stored with that record.
• Notifications: if you allow notifications, we keep a push token for your device so that reminders can reach you.
• Subscription status: whether you have an active subscription or trial, and the transaction details Apple gives us to confirm it, or the order details Stripe gives us for a subscription bought on the website (section 3.5). We do not receive your payment card details.

3.4Data collected on the website

• Measurement: pages you view, buttons you use (such as links to the App Store), what you choose in a tool on the website (such as species, breed and region), the page you arrived on, the referring site, campaign tags in the link you followed (UTM parameters), browser and device type, and page speed measurements. In the questionnaire, Google Analytics records which screens you saw and passed, not what you answered. Cloudflare counts visits without cookies. Google Analytics runs only if you allow analytics or advertising, and it recognises your browser across visits with cookies only if you allow analytics (section 13). Section 13 explains the tools and the storage they use.
• Advertising measurement: with your consent in the European Economic Area, the United Kingdom and Switzerland, and by default elsewhere unless you turn it off (section 13), the website tells Meta, Airbridge and Google which page you opened, the ad or link that brought you, and four events: you started the questionnaire, you created an account, you went to checkout, and your subscription or trial started, with its price and currency. It never sends your answers to the questionnaire, your email address, your name or your pet’s records, and the page addresses it sends carry no questionnaire answers. These tools also receive your IP address and browser details and set cookies (section 13).
• Questionnaire analytics and recordings: on the questionnaire pages, PostHog records which screens you see and pass, the buttons you use without their text, and a session recording: how the pages look as you go through them, where you tap and how you scroll, so we can see where the questionnaire is unclear. The recording shows the questionnaire’s text and the answers you pick, but never what you type in a field, email addresses or your pet’s name: your browser hides them before anything is sent. It does not record network traffic or the browser console. With analytics allowed (with your consent in the European Economic Area, the United Kingdom and Switzerland, by default elsewhere), PostHog keeps an identifier in your browser (section 13) and, once you create an account or sign in, links the events and the recording to your Flok user ID, the identifier the app uses. In the European Economic Area, the United Kingdom and Switzerland, until you make a choice in the banner, the questionnaire is recorded with all its text hidden, nothing is stored on your device and nothing is linked to your user ID. If you turn analytics off, nothing more is recorded. The website’s server passes these events to PostHog, which receives your IP address and does not store it.
• IP address: the services that deliver and measure the website receive your IP address when your browser connects to them. When the website’s server passes your request to our servers, it also passes your IP address and the country that Cloudflare works out from it. Our servers use them to limit abuse and to show prices and taxes for your country.
• The questionnaire: the questionnaire keeps your answers in your browser, so you can come back to where you stopped (section 13). Apart from the analytics and the recording above, it sends nothing to our server until you give your email address in it.
• Your account on the website: the email address you give in the questionnaire makes your Flok account. You set its password after you buy Flok Premium, or later with “Forgot password?”; we store the password only as a salted hash. You can also sign up with a password on the website’s sign-up form, or Google confirms your email address to us. An account made from the questionnaire is deleted after 30 days, together with the pet saved to it, if it has no password, no one has signed in to it with Google or Apple, and it has never had Flok Premium. We store the time zone set on your device with your account, so that the dates in your pet’s plan match your calendar, and we save the pet from your questionnaire to your account, with the weight you gave as its first weight. When you sign up with a password, we send a code to your email address to confirm it.
• Email forms: if you leave your email address in a form on the website, such as the Android waitlist or the Pet Records Organizer template, we receive the address, which form and page you used, and any campaign tags from your visit. The form sends this directly to our email provider, Loops. We do not send your email address to our measurement tools.
• Emails from the questionnaire: the questionnaire asks for your email address. If you tick the box under the address, you ask for pet care tips, offers and the latest news from Flok. If you do not tick it, the next screen asks whether you want pet care tips, and “Yes, send it” asks for the tips only. In both cases the website sends the address to Loops in the same way as the other forms, and Loops sends you the emails you asked for. If you do not ask for any, Loops does not receive the address, and we use it only for your account.
• Your country: a small script in your browser reads the time zone set on your device and works out a likely country from it. The website uses it only to show information for your country, such as the right poison hotline or vaccination schedule. The country worked out this way stays on your device and is not sent to us or to anyone else. If you pick a region yourself in the vaccination schedule tool, that choice is kept in your browser (section 13) and is included in the measurement events of that tool.

3.5Purchases on the website

In some countries you can buy Flok Premium on the website. The purchase is sold through Link: the merchant of record is Sold through Link, LLC, a company of the Stripe group (“Link”). Link collects your payment details, your billing address and the information it needs to calculate taxes, and uses them under its own privacy policy, link.com/privacy. For the purchase, Link decides how that data is used, not us.

Stripe shares the order details with us: the plan, the price and currency, the start and end of the trial, the dates of each payment and renewal, whether a payment failed or was refunded or disputed, and a Stripe customer identifier linked to your Flok account. We use them to give you Flok Premium in the app, to show your subscription in your account on the website, and to send you the emails about it. We never receive your full card number.

3.6Pet health records

Pet medical records are not “special category” data under Art. 9 GDPR, which covers people. We treat them with care anyway. We store them because keeping them is the service you asked for.

3.7Children

Flok is intended for people 13 years of age or older. Some countries set a higher age, up to 16 in parts of the European Economic Area, below which a parent or guardian must agree to the use of a service like Flok. If that applies to you, use Flok only with their agreement. We have no means of checking a person’s age or a parent’s agreement. Link sells Flok Premium on the website only to adults.

We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact info@flokpetapp.com and we will delete it.

5.1Service providers

We use the service providers below. Each one receives only the data needed for the job described.

The app and your account

Our servers can also send error reports to an error monitoring service, Sentry, when we switch it on. An error report describes the request that failed and can include technical details of it.

The website

The seller on the website. When you buy Flok Premium on the website, Link, a company of the Stripe group based in the United States, is the seller, not a service provider of ours. It takes the payment, calculates and collects taxes, sends receipts and handles payment support and refunds. It decides how it uses the data it collects for the purchase, under its own privacy policy, link.com/privacy, and it shares the order details with us (section 3.5).

If we add or replace a provider that matters for your data, we will update this list.

5.2Vets and other people you choose

You can export your pet’s card and papers as one PDF and send it to a vet or a sitter. You choose the recipient. We do not send your records to anyone without your action.

5.3Legal and safety disclosures

We may disclose personal data when we believe in good faith that it is required to comply with a binding legal order, to protect the vital interests of a person or animal, or to investigate fraud or abuse of the service.

5.4Corporate transactions

If Flok is acquired, merged or sold, your data may transfer to the successor under the same commitments made in this policy. We will tell you before any such transfer changes how your data is used.

5.5Selling and sharing

We do not sell your pet records or the data in your account, and we do not give them to anyone for their own marketing. The app shows no ads.

The website measures which of our ads bring people to it and whether they subscribe, with Meta, Airbridge and Google (sections 3.4 and 13). In the app, Airbridge measures which of our own links and ads lead to installs, and it can exchange information about an install with the advertising platform that showed the ad. Some laws, including several US state privacy laws, may treat this kind of measurement as “selling” or “sharing” personal information or as “targeted advertising”. Section 9.2 explains how to opt out.

9.1European Economic Area, United Kingdom, Switzerland

You have all the rights in section 8, and the right to lodge a complaint with:

• Poland (our lead authority): Urząd Ochrony Danych Osobowych (UODO), uodo.gov.pl.
• United Kingdom: Information Commissioner’s Office, ico.org.uk.
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch.
• Any EEA member state: your local data protection authority.

Where we rely on legitimate interest, you can object at any time. Where we rely on consent, you can withdraw it at any time.

9.2United States

Some US states give their residents additional privacy rights, including California, Virginia, Colorado, Connecticut, Utah, Oregon and Texas. We honour the requests below from any US resident.

You can:

• Know what personal information we have collected about you, the sources, the purposes and the categories of recipients.
• Delete personal information we collected from you.
• Correct inaccurate personal information.
• Opt out of “sale”, “sharing” and targeted advertising. We do not sell your pet records or the data in your account. The advertising measurement described in section 5.5 may count as “selling”, “sharing” or “targeted advertising” under your state’s law. On the website, use Your privacy choices at the bottom of every page to turn it off in that browser. The website also treats a Global Privacy Control signal from your browser as this opt-out. In the app, this data is linked to your Flok user ID: write to us and we will delete the attribution data linked to your user ID.
• Sensitive personal information. We use your account sign-in details only to provide the service.
• Non-discrimination: using a privacy right does not change the price or level of service.

California “Shine the Light”: we do not disclose personal information to third parties for their own direct marketing.

To use any of these rights, email info@flokpetapp.com with the subject line “Privacy request”. We respond within 45 days. The law allows one extension of 45 days, and we will tell you if we need it.

Authorised agents can submit requests for you with a signed permission. We verify before acting.

Children under 16: we do not knowingly sell or share the personal information of people under 16.

9.3Canada

You have access and correction rights and the right to withdraw consent, subject to legal or contractual limits. In Quebec, you also have a right to data portability and the right to be informed of automated decisions with significant effects. We do not make such decisions.

Complaints: Office of the Privacy Commissioner of Canada, priv.gc.ca. Quebec: Commission d’accès à l’information, cai.gouv.qc.ca.

9.4Brazil

You have rights to confirmation, access, correction, anonymisation, portability, deletion, information about sharing, information about the consequences of refusing consent, and revocation of consent. Complaints go to the Autoridade Nacional de Proteção de Dados (ANPD), gov.br/anpd.

9.5Australia

You have access and correction rights under the Australian Privacy Principles. Complaints: Office of the Australian Information Commissioner, oaic.gov.au.

9.6Other countries

If your local law gives you rights not listed above, we honour them to the extent required. Email info@flokpetapp.com.

13.1Your choice

In the European Economic Area, the United Kingdom and Switzerland, the website shows a banner and uses analytics and advertising cookies only if you allow them. Elsewhere it uses them by default, and you can turn them off with Your privacy choices at the bottom of every page. The website works out where you are from the time zone set on your device (section 3.4). If it cannot tell, it treats you as outside those countries. Before you choose, the questionnaire is recorded with all its text hidden, and the recording stores nothing in your browser (section 3.4).

You can change your choice at any time with Cookie settings or Your privacy choices at the bottom of every page. A Global Privacy Control signal from your browser turns advertising off.

13.2What the website uses

Necessary. Always on.

• Your cookie choice: the cookie flok_consent remembers what you chose, for 6 months.
• Cloudflare may set cookies that are strictly necessary for security. Cloudflare visit statistics, where enabled, do not use cookies.
• Sign-in cookies: when you create an account or sign in on the website, it sets two cookies that keep you signed in, __Host-flok_at and __Host-flok_rt. They are strictly necessary for the account you asked for. The website’s scripts cannot read them, and they expire after up to 24 hours and up to 31 days, or when you sign out.
• Questionnaire: your answers, the email address you give in it, a random number that identifies your draft and, once you create an account, that account’s email address are kept in your browser’s local storage, so you can come back to where you stopped. They leave your browser only when you ask for emails (the address alone) or create an account (section 3.4).
• How you signed in: whether you last signed in on the website with Google or with your email and password is kept in your browser’s local storage, so your account page can tell you how to sign in to the app. It never leaves your browser, and it is removed when you sign out or delete your account.
• Sign-in with Google: on the sign-up and sign-in screens, Google’s sign-in button loads from Google. Its script keeps a small cookie on this site, g_state, that remembers the state of Google’s sign-in prompt, and Google may read or set its own cookies for the sign-in you choose, under Google’s privacy policy.
• Checkout: the payment pages of Stripe and Link open on their own domains and use their own cookies, under Link’s privacy policy.
• Session storage: the website keeps the campaign tags from the link you followed, the first page you opened and the referring site in your browser’s session storage. This is cleared when you close the tab.
• Local storage: if you choose a region in the vaccination schedule tool, the choice is kept in your browser so the tool remembers it.

Analytics. With your consent in the European Economic Area, the United Kingdom and Switzerland; by default elsewhere.

• Google Analytics 4 sets the cookies _ga and _ga_…, which last up to 2 years, to recognise your browser across visits. We ask Google to anonymise IP addresses. Without this choice, Google Analytics sets no cookies, and it does not run at all unless you allow advertising.
• PostHog, on the questionnaire pages only, keeps ph_phc_…_posthog as a cookie and in local storage, for up to 1 year, to recognise your browser across visits, and a few ph_… entries in session storage for the current visit. Without this choice it keeps nothing in your browser, and turning analytics off removes them.

Advertising. With your consent in the European Economic Area, the United Kingdom and Switzerland; by default elsewhere, unless you turn it off or your browser sends a Global Privacy Control signal.

• Meta Pixel sets the cookie _fbp and, when you arrive from a Meta ad, _fbc. Both last 90 days.
• Airbridge sets the cookies ab180ClientId, airbridge_session__flokpetapp and airbridge_migration_metadata__flokpetapp to recognise your browser. Airbridge gives them no practical end date, so they last as long as your browser allows: up to 400 days in Chrome and Edge, 7 days in Safari, and until you delete them in Firefox. If your browser allows third-party cookies, Airbridge also keeps the same identifier in a cookie on its own domain, abr.ge, under its own settings.
• Google: when advertising is allowed, Google Analytics may be used to measure our Google ads. It sets no other cookies on the website.

13.3Blocking in your browser

You can also block or delete cookies and site storage in your browser settings, and block the measurement tools with your browser’s tracking protection or a content blocker. The website works without them, including the guides, the tools, the questionnaire and the email forms. If you block the sign-in cookies, you cannot sign in on the website.

13.4The app

The app does not use browser cookies. It uses storage on your device for your session and preferences, and the analytics and attribution tools in section 5.1 keep an identifier on your device.