Privacy policy

FlockStack Cloud is run by KMF Ventures LLC, a Wyoming limited liability company ("we"). Questions, requests and complaints about privacy go to hello@flockstack.io. This policy covers FlockStack Cloud. A FlockStack server run by someone else is theirs, and they set its policy.

We are two things here. For the people who sign up (account holders, the creators), we are the controller of their account data. For a creator's subscribers, the creator decides why and how their data is used and we are their processor: we handle it for them. Each section says which one it is about.

• Your account: your email address, and the name and photo if you add them. Sign-in codes are stored hashed, work once, last 5 minutes and die after 3 wrong tries. If you add a passkey we store its public key; if you sign in with Google or Apple we store that link to your Google or Apple account. With Apple, your email can be a private relay address that Apple forwards to your inbox, and we get your name only the first time, if you choose to share it.
• Sessions and sign-in records: each session records the IP address and browser it started from. Our logs have a line for each sign-in (your email, IP address and browser) and for some actions: sending a campaign, creating an API key, connecting an app, deleting an account.
• Your newsletters: their names, addresses, sender details, postal address, issues, images, products, domains and settings, which are what you put in them.
• API keys and connected apps: keys are stored hashed. Apps you connect (such as an AI assistant) get a token and full access to the account until you disconnect them.
• Your plan: which plan, monthly or yearly, its status and period dates, and the IDs of your customer and subscription at our billing provider. The provider handles your payment details. We don't store card numbers.
• If you sell: the ID and status of your connected Stripe account (charges and payouts enabled), and the orders described below.
• Alerts and messages: the emails we send you about your account, and your messages if you write to us.
• How you use FlockStack's own pages: we use PostHog, our product analytics, to see page views, clicks and actions, your device and browser, your approximate location and, when you are signed in, your user ID, email address and plan. One PostHog project, on PostHog US Cloud, serves both flockstack.io and eu.flockstack.io. It runs on FlockStack's own pages only (the home page, the docs, the legal pages, sign-in and the dashboard), never on a newsletter's public pages or on the pages readers use (the archive, unsubscribe, confirm, keep, referral and comment pages, and the recommendations directory). It uses its own cookies or local storage, so it runs only after you accept if you are in the EU, the EEA, the UK or Switzerland, or on eu.flockstack.io. Elsewhere it runs unless you decline in Cookie settings. A Global Privacy Control or Do Not Track signal from your browser turns it off, without a banner. Session recording is off. Retention: PostHog keeps analytics events for up to 7 years (1 year on its free plan) and then deletes them. On request, we delete the analytics data tied to your account in PostHog.
• The support assistant: FlockStack's own assistant answers from our docs and from what you type to it. It runs on Cloudflare Workers AI, which runs on Cloudflare's global network, so what you type may be processed outside your region. Stored: nothing by FlockStack. The conversation stays in your browser tab. Each question, with the conversation before it, is sent to Cloudflare Workers AI to write the answer, with logging turned off for it, and our servers only count questions by IP address and user ID, with no text, to limit how many are asked. If you click Email a human, the conversation and your account email are emailed to our support inbox. How long: FlockStack keeps nothing of the conversation: it is gone when you close the tab or sign out, and the counters expire within two days and are then cleaned up. A conversation you email to us stays in the support inbox as long as we need it to answer you, and you can ask us to delete it. Cloudflare's Workers AI documentation says that Cloudflare does not use Customer Content processed by Workers AI to train AI models, and does not retain inputs or outputs after they are no longer needed to process the request.
• Rate-limit counters: to stop abuse, we count requests to sign-in, signup and similar forms by IP address, and questions to the support assistant by IP address and user ID. The counters last minutes to two days and are cleaned up.

These are the creator's data, which we hold and process for them.

• The list: each subscriber's email address, status (active, pending, unsubscribed, bounced, complained or dormant), where they signed up from, the dates they signed up, confirmed and left, and the tags and fields the creator sets. Imports can carry the engagement a subscriber had on the previous platform.
• Emails sent: a record of each email (recipient, kind, status, and when it was sent, delivered, opened, clicked, bounced or complained) and the issues themselves. Bounce and complaint events are kept with the address.
• Opens and clicks: emails carry a one-pixel image and links that pass through FlockStack, so the creator sees that an email was opened or a link clicked, and when. We store the fact and its time, not the reader's IP address or device. Visits that look like security scanners aren't counted as clicks.
• Referrals: when a signup comes through a referral link, a keyed hash of the visitor's IP address is stored, to tell a household from a farm. The IP address itself is only used to limit signups per visitor.
• Orders: when readers buy from a creator, the creator's Stripe account takes the payment. We keep the buyer's email and name, the product, the amount and the download count.
• Comments: if the creator turns comments on, a subscriber signs in to a newsletter's website with a link emailed to them (no password) and a cookie keeps them signed in for that newsletter for 30 days. A comment is stored with a display name that starts as the part of the email address before the @ and is never shown with the address, its text and its status, the reason it was held, hidden or removed, and two keyed hashes: one of the IP address (to limit spam) and one of the text (to catch a repeat). Reports of a comment, with the reason if given, are kept too. A reader gets an email when someone replies, and can turn those off.
• Recommendations: a newsletter can recommend others to its readers. Nothing is ticked beforehand. A reader's email address reaches another newsletter only when that reader ticks it and subscribes, as a normal signup with that newsletter's own confirmation email. That newsletter's owner then sees where the subscriber came from. Pages that showed a recommendation are counted without personal data.
• Web pages: a newsletter's website counts a view per issue, browser and day, with no personal data.

Never-email list. Across all accounts we keep one list of addresses that are known not to exist (hard bounces, kept 180 days) or that are spam traps (kept with no end date). It is stored as a keyed hash that can't be turned back into an address and doesn't say which creator it came from. We run it to protect everyone's sending reputation, on our legitimate interest, and it is the one place where something about a subscriber is shared between creators.

• No advertising and no selling or renting of personal data.
• No sharing of one creator's subscribers with another creator or anyone else, apart from the hashed never-email list above, a reader ticking a recommendation, and the sub-processors we need to run the service.
• We don't use subscribers' data for anything but running the creator's newsletter, and we don't track readers with analytics: PostHog is not loaded on newsletters' pages or on the pages readers use.
• FlockStack sends your newsletters and subscribers to no AI service. The one AI feature is the support assistant, which sees what you type to it. If you connect your own AI assistant to your account, that is your choice, and its provider's terms apply.

For people in the EU, the UK and similar places, the GDPR asks for a legal basis. Ours:

• Contract: your account, your plan, and sending your newsletters are what you asked us to do.
• Legitimate interests: keeping the service secure and free of abuse (sign-in records, rate limits, the never-email list, the record we keep of deleted accounts), protecting the sending reputation every customer shares, and, on visitors outside the EU, the EEA, the UK and Switzerland, who see no banner and can switch it off in Cookie settings, understanding how people use FlockStack's pages.
• Legal obligation: records our billing provider and we must keep for tax and accounting.
• Consent: where we ask for it, and you can withdraw it. On eu.flockstack.io and for visitors in the EU, the EEA, the UK and Switzerland, FlockStack's analytics runs only after you accept it. For a creator's subscribers, the creator chooses the basis (usually consent) and we process on their instructions.

• An account's data stays while the account exists. If a plan ends, the data stays and nothing is deleted on a timer: delete the account to remove it.
• Deleting an account (account page, with a code sent to your email) stops it at once, signs you out everywhere and revokes keys and apps. You can restore it by signing in within 30 days. After that we delete the user and sessions, contacts, issues, sent-email records and events, API keys, images, product files, exports, domains and the sending set-up at our email provider. A paid plan has to be cancelled first.
• What stays after that: a record with a keyed hash of the owner's email address, the dates the account was created, deleted and purged, and its internal ID. It lets us notice the same address signing up again, so abuse can't simply start over. It has no end date yet. Our billing provider and Stripe keep their own records under their own rules.
• Deleting a subscriber. A creator deleting a contact removes the contact and its fields. For a subscriber who unsubscribed, bounced or complained, a keyed hash of the address and the status are kept so the newsletter never emails them again. The records of emails already sent to the address, and of its bounces and complaints, stay until the account is deleted. The subscriber's comments stay, shown as written by "Deleted reader", with the link to the person and the two hashes removed; the text of a comment stays as it was written. The reports they made are deleted.
• Exports are private files, deleted when their links expire after 7 days.
• Logs: Cloudflare keeps the Workers logs for 7 days.
• Backups: Cloudflare keeps restore points of the database (D1 Time Travel) for 30 days, so deleted data can still exist in a restore point for up to 30 days.

You choose a region when you sign up: the United States or the European Union. Each region has its own database and storage. An account lives in exactly one, and what you store is stored in that region. Data stored in the EU is the most we say: some things pass through, or are kept, beyond the region.

• Where the code runs. A request is handled by the Cloudflare data center closest to the visitor, which can be outside the region. Nothing is stored there, but the request passes through it.
• Pictures in Cloudflare's cache. A public picture is cached near the readers who load it, wherever they are.
• Email in transit. Mail goes to the recipients' own servers, wherever those are.
• Billing. Polar and Stripe hold your name, email address and payment details under their own terms. The region's database keeps their customer and subscription IDs and your plan's status.
• Logs. Cloudflare keeps the Workers logs. They hold request details and FlockStack's own log lines: errors, IDs and event types, and a line for each sign-in with the email address, IP address and browser.
• Alerts to the FlockStack team. They name account IDs and never email content. They go by email, and to Telegram when it is set up.
• Product analytics. One PostHog project on PostHog US Cloud serves both regions, so what it collects from eu.flockstack.io, after a visitor accepts, is processed in the United States.
• The support assistant. It runs on Cloudflare Workers AI, which runs on Cloudflare's global network, so what you type to it may be processed outside the region. FlockStack stores none of it: the conversation stays in your browser tab.
• Google or Apple, when you sign in with one of them.

The regions page lists where each kind of data is stored. The sub-processors page lists who runs what.

Our services are run by companies based in the United States, and some data crosses borders however you choose: the code runs in the Cloudflare data center closest to a visitor, emails travel to wherever the reader's mailbox is, billing is one account for both regions, and the support assistant runs on Cloudflare's global network. When data goes to a country without the same protection as yours, we rely on the safeguards in the provider's own data processing terms. This is what each one says on the page we link, no more:

• Cloudflare. Its data processing agreement applies the EU standard contractual clauses, with the UK addendum and Swiss changes, and says Cloudflare complies with the EU-US Data Privacy Framework. (source)
• Amazon Web Services. Its data processing addendum applies the EU standard contractual clauses automatically when a customer uses AWS services to transfer personal data. (source)
• Upstash. Its data processing agreement commits it to safeguards such as standard contractual clauses or another recognized transfer mechanism, and names the Data Privacy Framework as one. (source)
• Polar. Its privacy policy says it has entered into the standard contractual clauses adopted by the European Commission. (source)
• Stripe. Its data processing agreement names the EU-US Data Privacy Framework, the EU standard contractual clauses and the UK addendum as its transfer mechanisms. (source)
• PostHog. Its data processing agreement applies the standard contractual clauses (EU, UK and Swiss) and says it participates in the EU-US Data Privacy Framework. (source)
• Google. Its data processing terms apply the standard contractual clauses where no other transfer solution is available, and say Google has certified under the Data Privacy Framework. (source)

You can ask to see your data, correct it, export it, delete it, restrict how it is used or object to it, and, where you gave consent, withdraw it. Most of it you can do yourself: change your details on the account page, export everything in one click, or delete the account. For anything else, write to hello@flockstack.io. We may ask you to prove that you control the email address first. We answer privacy requests within 30 days. If you think we got it wrong, you can complain to your data protection authority.

If you are a creator's subscriber, the creator is the one to ask: the sender's name and postal address are in every email, and you can reply to it. To stop getting a newsletter, use the unsubscribe link in any of its emails or the one-click unsubscribe in your mail app: you are marked as unsubscribed at once, and the address stays on the list as unsubscribed so the newsletter can't email it again. To have your address deleted, ask the creator, who can delete it from their dashboard or API. If you can't reach them, write to hello@flockstack.io and we will tell you who to contact.

FlockStack itself sets these, all needed for the service:

• A session cookie (better-auth.session_token in the United States, flockstack-eu.session_token in the EU) while you are signed in, and short-lived sign-in cookies while you use a passkey, Google or Apple. They are needed to sign you in.
• region, for a year: the region you picked on the home page or sign-in page.
• fs_consent, for a year: whether you accepted or declined analytics, so we don't ask again.
• tz and newsletter, for a year, in the dashboard: your time zone, and the newsletter you have open.
• fs_reader_<newsletter> and a marker, fs_reader_<newsletter>_on, for 30 days, on a newsletter's website: they keep a subscriber signed in to comment on that newsletter, and only exist after the subscriber used a sign-in link.

Analytics. FlockStack's own pages load PostHog, which sets its own cookies or local storage (their names start with ph_) to tell visits apart. One PostHog project, on PostHog US Cloud, serves both flockstack.io and eu.flockstack.io. It runs on FlockStack's own pages only (the home page, the docs, the legal pages, sign-in and the dashboard), never on a newsletter's public pages or on the pages readers use (the archive, unsubscribe, confirm, keep, referral and comment pages, and the recommendations directory). It uses its own cookies or local storage, so it runs only after you accept if you are in the EU, the EEA, the UK or Switzerland, or on eu.flockstack.io. Elsewhere it runs unless you decline in Cookie settings. A Global Privacy Control or Do Not Track signal from your browser turns it off, without a banner. Session recording is off. Those are not on this list because they are not needed for the service. When you sign up, set up your first newsletter or start a plan, FlockStack also sets fs_goal for ten minutes, which the next page reads once to count that step and removes. It is set only while analytics is on. Change your choice any time with Cookie settings in the footer of the home page, the docs and the legal pages, and on the sign-in page. Declining deletes the PostHog cookies and local storage.

Your browser's own storage keeps your light or dark theme, the support assistant's conversation in that tab's session storage until you close the tab or sign out, and on a newsletter's website, whether you subscribed, whether you snoozed the signup prompt, a referral code for 30 days, the newsletter that sent you there through a recommendation for 7 days, and a marker that you viewed an issue today. None of it is sent as a cookie.

Pages are served over HTTPS. API keys and sign-in codes are stored hashed, unsubscribe and tracking links are signed, every query is scoped to one account, and product files and exports sit in private storage and leave it only through signed links that expire. No system is perfectly safe, so please tell us at hello@flockstack.io if you find a problem.

FlockStack is not for people under 16, and we don't knowingly collect their data. If you think a child has an account, write to hello@flockstack.io and we will delete it. Creators are responsible for who is on their lists.

When we change this policy we update the date at the top. We email account owners at least 30 days before a change to the terms of service or to the privacy policy takes effect.

KMF Ventures LLC, a Wyoming limited liability company, hello@flockstack.io. See also the terms of service.