Privacy Policy

The following notes provide a simple overview of what happens to your personal data when you use the City-Flock website or the City-Flock app. Personal data is any information that can identify you directly or indirectly.

This privacy policy applies to the website and the mobile app. It explains which data we process, why we process it, and which rights you have.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Join the Flock UG (haftungsbeschränkt)

Seegefelder Weg 443

13591 Berlin

Germany

Email: info@city-flock.de

Data processing on this website is carried out by the website operator. You can find the contact details in the 'Controller' section.

Your data is collected in part by you providing it to us (e.g. by entering it in a contact form or signing up for the newsletter).

Other data is collected automatically or after your consent when visiting the website by our IT systems. This is mainly technical data (e.g. internet browser, operating system or time of page access).

Our website is hosted by the following providers:

• Netcup GmbH (domain management, DNS)

• Vercel Inc., San Francisco, USA (hosting and delivery of website content)

When visiting the website, technical data (so-called server log files) are automatically processed. These include IP address, browser type, operating system, referrer URL and time of access.

Legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in secure and efficient provision of the website).

A data processing agreement (DPA) has been concluded with Vercel. Transmission to the USA is based on the EU Commission's Standard Contractual Clauses (SCC).

The provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version

• Operating system used

• Referrer URL

• Hostname of the accessing computer

• Time of server request

• IP address

This data is not combined with other data sources. Log files are usually automatically deleted after 30 days.

Legal basis is Art. 6 para. 1 lit. f GDPR.

This website uses cookies. Cookies are text files that are stored on the user's device.

• Necessary cookies: We use necessary cookies to enable basic functions of this website. These are set on the basis of Art. 6 para. 1 lit. f GDPR.

• Analytics/marketing cookies: These are only set after explicit consent (Art. 6 para. 1 lit. a GDPR).

You can revoke or change your consent at any time via our cookie banner.

An overview of the cookies used can be found in the cookie settings.

If you subscribe to our newsletter, we need your email address. Additional data (e.g. name) may be processed optionally.

Delivery is via the service provider Brevo (Sendinblue GmbH, Germany/France).

Purpose: Sending information about our offers and news.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent, double opt-in).

Data stored: Email address, registration time, IP address at registration.

Storage duration: Data is stored until you unsubscribe from the newsletter.

Revocation: You can unsubscribe from the newsletter at any time via the unsubscribe link or by email to info@city-flock.de.

This website uses Google Analytics (GA4) to analyze website usage. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: Analysis of user behavior to improve our website.

Legal basis: Only after consent (Art. 6 para. 1 lit. a GDPR).

Data collected: Page views, dwell time, device information, approximate location.

IP anonymization: Activated, so your IP address is shortened.

Data transfer: Data may be transferred to the USA. The basis is the EU's Standard Contractual Clauses (SCC).

A data processing agreement (DPA) has been concluded with Google.

Revocation: Possible at any time via the cookie banner.

To provide the app, we process the following data depending on the features you use:

• Account and profile: email address for sign-in, user ID, display name, and optional profile details and profile images.

• Location and routes: precise location while actively using the app, start and destination points, route and matching data, and coordinates of reports and saved places.

• SOS: SOS requests you initiate, helper availability, temporary live locations of participants, status and time information, and optional emergency contacts.

• Community content: safety reports, descriptions, categories, photos, comments, reactions, and moderation status.

• Communication: messages in route matches and active SOS connections, including related delivery, read, and timestamp information.

• Support and feedback: feedback you send and images you choose to attach.

• Device and notifications: device and platform information and push tokens if you allow notifications.

The app does not access your location in the background. Location data is processed only while the app is active and for features you choose to use.

We process account, profile, community, matching, chat, and SOS data to provide the app features you request (Art. 6(1)(b) GDPR).

Location, camera, photo library, and notification access takes place only after your choice and the relevant system permission. You can change permissions in your device settings.

Security, abuse prevention, and moderation measures are based on our legitimate interest in operating a safe and reliable service (Art. 6(1)(f) GDPR).

Firebase Analytics and Firebase Crashlytics are activated only after your voluntary consent (Art. 6(1)(a) GDPR). You can withdraw each consent separately at any time in the app's privacy settings.

We use the following services to operate the app:

• Supabase: authentication, database, realtime features, file storage, and server-side functions.

• Google Maps Platform: map display and, depending on the feature, place, geocoding, Places, and routing requests.

• Google Firebase Cloud Messaging: technical delivery of push notifications.

• Google Firebase Analytics and Crashlytics: usage analytics and error diagnostics only after consent.

• Apple App Store and Google Play: distribution, installation, and platform-level management of the app.

Data may be processed outside the EU/EEA. Where required, providers rely on recognized safeguards, particularly adequacy decisions or the EU Standard Contractual Clauses.

Account and profile data is generally stored until you delete your account, unless a legal obligation or a legitimate security reason requires limited further retention.

Reports, comments, reactions, and related media you created are removed from production systems when your account is deleted.

Ended route chats are routinely deleted after seven days. Closed SOS chats are routinely deleted after seven days; completed or stale SOS session and matching data is routinely deleted after 90 days.

Push tokens are removed when they are no longer required, during relevant sign-out processes, or when the account is deleted.

Support, security, and technical log data is retained only as long as required for its purpose or legal obligations. Backup data is overwritten according to the technical deletion cycles of the providers used.

If data is required to establish, exercise, or defend legal claims, deletion may be restricted until the relevant period ends.

• Location: only while using the app; used for maps, routes, matching, reports, and SOS features you explicitly start.

• Camera and photo library: only when you choose to capture or select a profile, report, or feedback image.

• Notifications: optional; you can change the system permission in device settings at any time.

• Analytics and error diagnostics: disabled by default and controlled separately under Privacy in the app.

You have the following rights regarding your personal data:

• Right to information (Art. 15 GDPR)

• Right to correction (Art. 16 GDPR)

• Right to deletion (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to object (Art. 21 GDPR)

• Right to withdraw given consent (Art. 7 para. 3 GDPR)

To exercise your rights, please contact: info@city-flock.de

Would you like to completely delete your City-Flock account? Detailed information about the deletion process and your right to deletion can be found on our Delete Account page.

You have the right to complain to a data protection supervisory authority about our processing of personal data.

The responsible supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information.

Friedrichstr. 219, 10969 Berlin, Phone: 030 13889-0, Email: mailbox@datenschutz-berlin.de

We use appropriate technical and organizational measures to protect your data against loss, destruction or unauthorized access.

Data transmission on the Internet is encrypted via HTTPS.

This privacy policy is currently valid (as of: July 2026).

Due to the further development of our website or due to changed legal requirements, an adjustment may become necessary.

The current version can always be found at /privacy.