Effective date: May 14, 2026
Last updated: September 25, 2026
MindFlock is published by Create 67 LLC, a California limited liability company ("MindFlock," "we," "us," or "our"). Create 67 LLC is the data controller for the information described in this policy.
This Privacy Policy explains what information the MindFlock iOS app and the mindflock.app website collect, how we use it, who we share it with, how long we keep it, and the controls and legal rights you have over your data.
We built MindFlock to help people spend less time on their phones — not to monetize their attention. We do not sell or share your personal information. We do not show ads in the app or use your data for advertising. We do not use advertising or tracking SDKs, and we do not track you across other companies' apps or websites. We use one analytics tool to understand how the app itself is used (see §3.6) — it never receives your screen-time data — and a cookieless analytics tool on our website that counts visits without identifying anyone (see §3.7).
MindFlock is a social screen time management app. It uses Apple's Family Controls framework (FamilyControls, DeviceActivity, ManagedSettings) to block apps you choose on your own device. Some features — shared challenges, coops, and the ability to "catch" or "peck" a friend who is using a blocked app — require us to keep a small amount of data on a server so the friends you have chosen can see it. This policy is primarily about that small amount of server-stored data.
A note on how blocking works, because it matters: every block in MindFlock enforces rules you set for yourself. You choose which apps to manage, you set (or explicitly agree to) the limits and the game rules that decide when a block happens, and you see the game's rules before you join — joining a coop with catching on is how you opt in. When a coop member catches you, they aren't controlling your device — they're triggering an enforcement you pre-authorized, on your own terms, as part of managing your own screen time. The blocks themselves happen via Apple's Family Controls framework on your device; the other participants never learn which specific apps were blocked. Joining a coop, opting into catching, and each game's rules are all individual opt-in actions you can decline, and you may leave a coop at any time — which immediately revokes anyone's ability to trigger further blocks through MindFlock.
Apple's Family Controls framework gives MindFlock only opaque tokens for the apps you pick — not their names, identifiers, or per-app usage. That information stays inside Apple's frameworks on your device, and your app selection never leaves it: it is stored in iOS App Group storage and read only by MindFlock's own on-device extensions to enforce blocking. So we never receive app names, per-app usage, a list of your installed apps, or browsing history. App names you see in the app (like "Instagram" or "TikTok") come from a catalog we ship inside the app, not from reading your device.
Our Screen Time commitment. The only screen-time information that leaves your device is what your coop needs to play: your total minutes on tracked apps today, and whether you're on one right now. It is used to run MindFlock's features and, in anonymized aggregate form, to understand how well MindFlock works. It is never used for advertising, never sold, never disclosed to anyone beyond the cloud infrastructure that hosts MindFlock (Google Firebase, acting only on our instructions), and never fed into analytics. This is both our policy and a condition of the Apple entitlement that makes MindFlock possible.
We collect only what we need to operate the features you signed up for.
To power shared challenges and "is my friend currently on a blocked app" features, the app uploads the following aggregate values:
We do not upload an hour-by-hour or minute-by-minute log of your phone usage. Hourly usage data, where it exists, stays on your device only. Your historical daily archive stores only your day's total minute count — no timestamps and no live-state flags.
The app is free during open beta. If we offer paid subscriptions in the future, we will receive the receipt-validation information Apple's StoreKit returns. We never receive your full payment details — those stay with Apple.
Analytics. We use Firebase Analytics, a Google service, to understand how MindFlock is used so we can make it better — things like which onboarding steps people finish, which features get used, and whether the app is working. These events are about *the app*, not about *you*: we never send your screen-time minutes, the apps you track or block, your messages, or your friends' identities to analytics. Analytics data is not used for advertising, and MindFlock contains no advertising or tracking SDKs and does not track you across other companies' apps or websites.
Diagnostics. The app keeps a local debug log on your device. It is uploaded to us only when you choose to send it — by tapping Report a Problem in Settings (which sends your description plus the recent log) or by attaching it to a support email. The report also includes a short device summary to help us reproduce the problem: iOS version, device model, app version, battery level, whether Low Power Mode and Background App Refresh are on, and your timezone. Because the log records what your app displayed, it can include activity of your coopmates as your app saw it (their display names and game events). We use these logs only to investigate your issue, and they are deleted along with your account.
Crash reporting. We use Firebase Crashlytics, a Google service, to learn when the app crashes so we can fix it. When a crash happens, the next launch sends us a crash report: the technical stack trace, the app version, iOS version and device model, and basic device state at the time (for example whether the app was in the foreground). Crash reports are tied to an anonymous installation identifier, not to your name, email, or account. They never include your screen-time data, the apps you track or block, your messages, or your friends' identities. Crash data is used only to diagnose and fix bugs, never for advertising, and is deleted with your account.
Website analytics. We use Cloudflare Web Analytics to see how many people visit mindflock.app and which pages they land on. It is privacy-first by design: it sets no cookies, uses no localStorage, and does no browser fingerprinting. It does not follow you to other websites and it does not build a profile of you. What we see is aggregate and anonymous — page views, the country a visit came from, device and browser type, and the referring site — never who you are. The site is served through Cloudflare, our hosting and security provider, which may also set strictly-necessary cookies for security and bot protection. We place no advertising cookies and run no advertising or cross-site tracking pixels on the website.
For California residents, the categories of personal information we collect, mapped to the statutory categories under the CCPA/CPRA:
| Statutory category | Do we collect it? | Examples |
|---|---|---|
| Identifiers | Yes | Email, display name, account ID, device push tokens |
| Customer records (Cal. Civ. Code §1798.80) | Yes | Email, display name |
| Internet or other electronic network activity | Limited | Aggregate daily minute totals and an active/inactive flag — no browsing history, no per-app data; in-app interaction events for analytics (see §3.6) |
| Geolocation data | No | — |
| Commercial information | Limited | Subscription status, if you ever purchase one |
| Biometric information | No | — |
| Audio/visual information | No | — |
| Professional, education, or financial information | No | — |
| Sensitive personal information | See §5 | — |
| Inferences / profiles | No | We do not build profiles or inferences about you |
Sources of this information: directly from you, and automatically from your device as you use the app. Business purpose for collecting it: to operate the features you signed up for, send notifications you permitted, and keep the community safe. We do not sell or share personal information.
Aggregate screen-time data could be considered "sensitive personal information" under the CPRA. We want to be clear about how we treat it:
We use the information described above only to:
We do not use your information for advertising, profiling, retargeting, or sale of any kind. We do not engage in automated decision-making that produces legal or similarly significant effects about you.
If you are in the United Kingdom or the European Economic Area, we process your personal data under the following lawful bases:
| Processing purpose | Lawful basis |
|---|---|
| Creating and maintaining your account; providing blocking, coop, and challenge features | Performance of a contract (Art. 6(1)(b)) |
| Sending push notifications you enabled | Consent (Art. 6(1)(a)) — withdrawable any time in iOS Settings |
| Keeping the community safe; detecting and acting on abuse | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Playing with your flock is the point of MindFlock — and it only works if your coop can see how you're doing.
We use a small number of third-party providers to operate MindFlock. They process data on our behalf, under contract, and do not use your data for their own purposes:
| Service | Provider | What it handles |
|---|---|---|
| Authentication, database, cloud functions, push delivery | Google Cloud / Firebase (Google LLC) | Account login, the account and screen-time data in §3, push-token routing |
| Crash reporting | Firebase Crashlytics (Google LLC) | The crash reports described in §3.6 |
| Website hosting and security | Cloudflare, Inc. | Serving mindflock.app; security and bot protection |
| "Sign in with Apple" and Apple Push Notifications | Apple Inc. | Optional authentication; APNs routing for push |
| "Sign in with Google" | Google LLC | Optional authentication |
| On-device app blocking | Apple Inc. (Family Controls) | Enforcement happens on your device; no data is sent to Apple by us through this framework |
Google's Firebase privacy and security documentation: https://firebase.google.com/support/privacy.
We may disclose information if required by valid legal process. We will resist overbroad requests and, where legally permitted, notify you.
Do Not Sell or Share My Personal Information: We do not sell or share your personal information, and we have not done so in the preceding 12 months. There is nothing for you to opt out of, but if this ever changes we will provide a clear opt-out mechanism before doing so.
If Create 67 LLC is acquired, merges with another company, or sells MindFlock, your information may be transferred to the new owner as part of that transaction. The new owner would be bound by this policy until they notify you of any change, and you would keep every control in §11, including deletion. A transfer like this is not a "sale" of your personal information under the CCPA, and we will not sell your data to anyone outside such a transaction.
| Data | Retention |
|---|---|
| Live presence snapshot (current minute count, active flag, recency timestamp) | Most recent value only; overwritten on every update |
| Daily total minute count (one number per day) | Kept while your account exists, so trends and Insights can be shown to you |
| Account information (email, display name) | Kept while your account exists |
| Coop and challenge participation history | Kept while your account exists |
| Blocks and reports | Kept while your account exists, so safety controls keep working; we may retain a minimal record of an enforcement action after the related account is removed |
| Coop chat messages you send | Kept with the coop's chat thread; remain visible to that coop after you delete your account, shown as from “Someone” rather than under your name (see §10) |
| Diagnostic logs you upload | Kept only as long as needed to investigate your issue; deleted with your account |
| Game ledgers (XP/egg history, weekly counters, cooldown records) | Kept while your account exists; deleted with it |
| Device push tokens | Until you sign out, uninstall, or the token becomes invalid |
| All of the above on account deletion | Deleted as described in §10, typically within minutes and in all cases within 30 days |
We retain data only as long as needed for the purposes described in this policy or as required by law.
When you delete your account from inside the app (Settings → Delete Account), MindFlock:
A few things deliberately survive deletion, and we want to be straight about them:
If you'd like any of these removed too, email support@mindflock.app and we'll handle it case by case. Beyond the items above, MindFlock retains nothing personally identifying about you; we may keep anonymized, aggregate counts that cannot be linked back to you (for example, "number of coops created last week") for product and general reporting purposes.
You can also request deletion by emailing support@mindflock.app from the email address tied to your account.
You have the right to: know what personal information we collect and how we use it; access a copy of it; delete it; correct it; and not be discriminated against for exercising these rights. We do not sell or share personal information, so there is no "opt out of sale" to exercise. Under California's "Shine the Light" law (Cal. Civ. Code §1798.83), we do not share personal information with third parties for their own direct marketing.
You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests; and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority (in the EU) or the Information Commissioner's Office (in the UK).
Use the in-app controls where available, or email support@mindflock.app. We will verify your request against your account and respond within 30 days (45 days for California requests where an extension is permitted). We will not charge you for exercising your rights except where a request is manifestly unfounded or excessive.
MindFlock is operated from the United States. If you use MindFlock from outside the U.S., your information will be transferred to, stored in, and processed in the United States. Where we transfer personal data of EU/UK residents to the United States, that transfer relies on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum), which our service providers, including Google Cloud, incorporate into their data-processing terms.
We use industry-standard security practices to protect your data, including:
No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and any relevant regulator without undue delay, as required by applicable law.
MindFlock is intended for users age 13 and older. Creating an account requires confirming you are 13 or older, and we record that confirmation and when it was made. We do not knowingly collect personal information from children under 13; if we learn that a user is under 13, we will delete the account and its data. If you believe a child under 13 has created a MindFlock account, contact us at support@mindflock.app and we will delete the account and associated data promptly. Users under 18 should have a parent or guardian's permission to use MindFlock (see our Terms of Service).
The app or website may link to third-party sites or services (for example, a service provider's privacy documentation). We are not responsible for the privacy practices or content of those third parties. We encourage you to read their policies.
Some browsers offer a "Do Not Track" (DNT) signal. Because the mindflock.app website does not track users across websites or over time — our website analytics is cookieless and aggregate (§3.7) — our behavior is the same whether or not a DNT signal is present: we do not track you either way.
If we make material changes, we will notify you through the app or by email before the changes take effect. The "Last updated" date at the top of this policy always reflects the most recent revision. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.
Create 67 LLC (California, USA)
Email: support@mindflock.app
For general questions, account help, or any privacy request, email us. We aim to respond within 7 business days, and never later than the deadlines in §11.4.