The short version
We collect what is needed to run an event you registered for, and we use it for that. We do not sell it. We do not use it to advertise to you. The organization running your event can see it, because it is theirs.
Who is responsible for your information
FlockCentral is operated by Coding Brothers, a small software business in Northern California.
The organization you registered with decides what to collect and why. Coding Brothers stores and processes it on that organization’s behalf. If you want your information corrected or removed, the organization is usually the right first contact; you can also write to us and we will help.
What we collect
- Your mobile number, because it is how registrants log in. We send a one-time code to it.
- An email address you give us when you register — see the next section for exactly what it is used for.
- Names — yours, and of anyone you register.
- Whatever else the organization asks for on its registration form, which may include a date of birth, a grade, allergies or medical notes, and emergency contacts. The organization chooses these questions; we store the answers for them.
- Registration and payment records — what was registered for, what it cost, what was paid or refunded, and any lodging assigned.
- Basic technical information our servers record to operate and secure the service, including your IP address at login.
- If you write to us through the contact form on flockcentral.com: your name and email, your phone number and organization if you give them, and your message. It is emailed to our support inbox and is not stored in FlockCentral.
We never see or store your card number. Card details go directly to Stripe.
What your email address is used for
The address you give when registering is used to send you messages about that registration, and for nothing else:
- your registration confirmation
- a decision on a scholarship request, if you made one
- a change to a session or a lodging assignment
- a payment or balance that needs your attention
These messages come from the organization’s name, sent through FlockCentral. They are not marketing, and we do not sell, rent or share your address for advertising.
We do not currently send promotional email. If that ever changes, those messages will be separate, will carry an unsubscribe link, and unsubscribing from them will never stop the messages listed above — you would still receive confirmations and receipts for money you paid.
Your mobile number and text messages
Your mobile number is how you log in. We text it a one-time code when you log in, verify the number or reset a password, and we text a short security notice to your old number when the mobile number on your account is changed — nothing else. By giving us a mobile number you agree to receive those texts. There are no marketing texts. Message and data rates may apply. We send to US and Canadian numbers only. Reply STOP to any of our texts to stop them (reply START to allow them again); without the codes you cannot log in.
Who else touches your information
Each of these services does one job for us:
- Stripe — payments. Receives your name, email and payment details. Stripe is the card processor; we are not.
- Twilio — sends the one-time login code by text message. Receives your mobile number and the code.
- Resend — sends the email described above, and messages sent through the contact form. Receives your email address and the message.
- Cloudflare — runs the network in front of FlockCentral: its domain names, the encryption of every connection, the security check on our forms (Turnstile, which reads signals from your browser to tell people from bots), Web Analytics, which counts visits to flockcentral.com without cookies and without identifying you, and the routing of email sent to our support address.
- Amazon Web Services (S3) — stores images organizations upload for their events.
- Google — our support mailbox is a Gmail inbox, so a message to our support address, or through the contact form, ends up there.
- A hosting provider in the United States — runs the servers and the database.
We do not share your information with anyone else, except where the law requires it.
Cookies
FlockCentral sets only the cookies a login needs: one for the current session (renewed every 15 minutes), one that renews it for up to 7 days, and, if you chose to trust a browser, one that remembers that choice for 30 days. They are set for the site address you logged in on, and a login on one organization’s address is never sent to another’s. There are no advertising or tracking cookies, and flockcentral.com’s visit counting (Cloudflare Web Analytics) uses none, so there is no cookie banner to click through.
How long we keep it
- Account and organization data — for as long as the organization is active, and until it asks us to delete it.
- Registration records — for as long as the organization keeps them; it needs its own registration and payment history. When you ask us to remove something, we delete what we are not required to keep.
- Login codes, reset links and sessions — codes expire within minutes and reset links within an hour; both are deleted nightly once they have. Sessions are deleted within 30 days of ending.
- Contact-form messages — kept in our support mailbox for up to 24 months.
- Payment records — held by Stripe under its own policy, and kept where tax or accounting rules require it.
Your choices
- See or correct your information — ask the organization you registered with, or write to us.
- Delete it — write to us and we will delete what we are not required to keep.
- Login codes — these are how you log in, so they cannot be switched off. They are not marketing.
If you are in California, the CCPA gives you the right to know what we collect, to ask us to delete it, to correct it, and not to be treated differently for asking. We do not sell personal information, and we do not share it for cross-context behavioral advertising. To exercise any of these, email us at the address below.
People under 18
FlockCentral is used to register people of any age for events, including minors, but accounts belong to adults. Someone 18 or older registers another person in their care, for example a minor, and provides that person’s information. We do not knowingly let anyone under 18 create an account. If you believe someone under 18 has created one, write to us and we will remove it.
Security
Connections are encrypted. Passwords are stored hashed, never in a readable form. Each organization’s data is separated from every other’s, and staff access is limited to the organizations they belong to. No system is perfectly secure; if a breach affects you, we will tell you. More on how we protect accounts, payments and data is in our Security overview.
Changes
If we change this policy in a way that matters, we will say so here and update the date above.