FLOKK · PRIVACY
Privacy Policy
Last updated: 17 August 2026
Flokk is a social app for airline crew. This policy explains what personal data we collect, why we collect it, who we share it with, and what you can do about it. It is written to be read, not to be survived.
1. Who we are
Flokk is operated by Pallasite OÜ, a company registered in Estonia.
| Controller | Pallasite OÜ |
|---|---|
| Registry code | 17348411 |
| Registered address | Tallinn, Estonia |
| Privacy contact | info@pallasite.net |
Because we are established in the EU, the General Data Protection Regulation (GDPR) applies to our processing. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
2. What we collect
We only collect what the app actually needs to work. Everything below corresponds to a real field in our systems.
Account
Your email address and account identifier, created when you sign up or sign in with Apple or Google.
Profile
- Display name, date of birth, gender, job title, short bio, profile photo.
- Your airline and your base airport. This is employment-related information, and it is central to how Flokk works — it is how we connect you with other crew.
- Your selected interests.
Roster entries
Destination airport, city, start and end dates, optional hotel name, optional notes, and the visibility setting you choose for each entry (private, followers, or public).
Location
When you tap to confirm your location, we capture your device location once, at that moment. We reduce it to city level for anything we show to other people. We do not track you in the background, and we do not collect location while the app is closed.
Verification photos
- A selfie and a second photo you submit to get verified as crew.
- These are stored in a private storage area and are never shown to other users.
- They are reviewed by a person. We do not run facial recognition, and we do not use these photos to identify you by automated biometric means — so they are not "biometric data" in the special-category sense under GDPR Article 9.
Content you create
- Posts, photos attached to posts, comments, likes, and who you follow.
- Photos attached to posts are stored in a public storage area — treat anything you post as public.
- Places you save.
Device and consent records
- A device identifier that the app generates itself — a random value stored in your device's keychain. It is not Apple's advertising identifier, and not the vendor identifier.
- The date and time you accepted our Terms, Privacy Policy, and Community Guidelines, which we keep as proof of consent.
What we do not collect
- No advertising identifier and no cross-app tracking. The app contains no tracking framework at all.
- No third-party analytics. We do not send your behaviour to an analytics vendor.
- No background location.
- No data about anyone under 18 — Flokk is 18+ and the app enforces this at sign-up.
3. Why we use it, and our legal basis
| What | Why | Legal basis |
|---|---|---|
| Account, profile, airline and base, interests | To create your account and provide the service | Art. 6(1)(b) — contract |
| Date of birth | To confirm you are 18 or over | Art. 6(1)(f) — legitimate interest in an adults-only service |
| Roster entries | To show you crew in the same place at the same time, at the visibility you chose | Art. 6(1)(b) — contract |
| Location | To confirm the city you are in | Art. 6(1)(a) — your consent, given at your device's permission prompt and withdrawable in iOS Settings |
| Verification photos | To verify you are crew | Art. 6(1)(b) — contract |
| Posts, comments, likes, follows | To operate the social features | Art. 6(1)(b) — contract |
| Device record | To keep your session secure and tie it to your device | Art. 6(1)(f) — legitimate interest in security |
| Consent timestamp | To demonstrate that you agreed to our terms | Art. 6(1)(c) — legal obligation (accountability) |
4. Who we share it with
We do not sell your personal data, and we do not share it for advertising. We use a small number of service providers:
| Provider | What they receive | Why |
|---|---|---|
| Pallasite identity and backend services | Your account, profile, content and photos | These are our own systems — they run the app |
| Google Places | Place search terms and city context, sent from our servers, not from your device | Place search and place details |
| Mapbox | Map tile requests made by your device | To draw maps |
| Apple / Google | Authentication data only | Sign in with Apple / Sign in with Google |
A current list, with each provider's role and location, is at Sub-processors.
Other Flokk users see what you choose to show them: your profile, your posts and comments, and any roster entry you set to followers or public. Your verification photos are never shown to other users.
We may also disclose data where we are legally required to, or where it is necessary to investigate abuse or protect someone's safety.
5. International transfers
Our systems and providers may process data outside the European Economic Area. Where that happens we rely on the transfer mechanisms permitted under Chapter V of the GDPR — an adequacy decision where one applies, and otherwise Standard Contractual Clauses.
For users in Türkiye, transfers abroad are made under the mechanisms in Article 9 of Law No. 6698 (KVKK), including standard contracts notified to the Turkish Personal Data Protection Board. See our Turkish notice.
6. How long we keep it
- Your account data is kept while your account exists.
- When you delete your account, we delete your profile, your interests, your roster entries, your saved places, your posts and comments, and your device records.
- Verification photos are deleted within 30 days of account deletion.
- Location captured at a confirmation is not retained beyond that session.
- We may keep a minimal record that an account existed and was deleted, and records of reports and enforcement actions, where we need them to comply with the law or to stop a removed user from simply returning.
7. Your rights
Under the GDPR you can ask us to:
- See the personal data we hold about you (Art. 15)
- Correct it if it is wrong (Art. 16)
- Delete it (Art. 17) — you can do this yourself, in the app, under Account → Delete account
- Restrict or object to our processing (Art. 18 and 21)
- Take it with you in a portable format (Art. 20)
- Withdraw consent at any time where we rely on it — withdrawing does not affect processing that already happened
To exercise any of these, email info@pallasite.net. We respond within one month. If you are unhappy with our response you can complain to the Estonian Data Protection Inspectorate, or to the supervisory authority where you live.
If you are in the UK: the same rights apply under the UK GDPR and you can complain to the Information Commissioner's Office.
If you are in Türkiye: your rights under Article 11 of Law No. 6698 apply — see our Turkish notice for how to make a request.
If you are in the United States: we do not sell or share your personal information, and we do not process sensitive personal information to infer characteristics about you. Where your state gives you rights to access, correct, delete, or appeal, we honour them through the same address above.
8. Security
Your session credentials are stored in your device's keychain. Verification photos are held in a private storage area that is not publicly readable. Access to production data is limited to people who need it.
No system is perfectly secure. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant authority as the law requires.
9. Children
Flokk is for adults working in aviation. You must be 18 or older to use it, and the app enforces this at sign-up. If we learn that we hold data about someone under 18, we delete it.
10. Changes to this policy
If we make a material change we will tell you in the app before it takes effect. The date at the top of this page always shows the current version, and previous versions remain available on request.
11. Contact
Pallasite OÜ, Tallinn, Estonia — info@pallasite.net