Legal

Privacy Policy

Last updated 13 October 2026

Floc is a network for developing sustainable ideas together, so much of what you add is meant to be seen. This policy explains what personal data Floc uses, why, what is public, what stays private, who helps us run the service, how long data is kept and what rights you have.

1. Who is responsible

Floc is currently operated by Sander Riis Specht, a private individual, who is the data controller for the personal data described here. Floc has not yet been registered as a company, and a postal address will be added here once one is available. There is no separate data protection officer. For any privacy question or request, write to hello@floc.world.

2. What we collect

Account details — your email address and password, or, if you sign in with Google or Apple, the name, email address and profile picture those services share with us.
Profile content — display name, headline, bio, Skills, Interests, ways you want to contribute, links, organisations you belong to, and your location (country and place). For organisations: mission, focus areas, team size and founding year.
Ideas and what you add to them — Ideas, Needs, Updates, Contributions, offers, Comments, mentions, files, images and the Progress history and Audit record of changes.
Opportunities — Opportunities you publish or respond to, and their editing history.
Interactions — follows, retained historical connection records, likes, saved items, private messages and attachments, invitations, notifications and your notification settings, mutes and blocks.
Feedback and reports — feedback you give on feed items (including anonymous "Something else" feedback) and reports you file or that concern you.
Technical data — basic logs needed to run the service securely and diagnose faults.

3. Why we use it, and on what legal basis

To provide Floc to you (contract): your account, profile, Ideas, collaboration, messages, notifications, Opportunities and matching.
To keep Floc safe and fair (legitimate interests): security logs, moderation, reports and the records that keep attribution and confidentiality traceable.
To improve Floc (legitimate interests): administrators see combined totals, such as how many people signed up or how many Offers led to a conversation. These totals are calculated from records Floc already holds and never show individual people or content.
To meet legal obligations (legal obligation): for example responding to lawful requests.
Where you choose to (consent): optional features such as importing a LinkedIn data file. You can withdraw consent at any time.

We do not sell your data and we do not use it for advertising.

4. What is public

Your profile, Ideas developed under Open-source development or Public but protected development, and your Contributions, Updates and Comments on them are public and visible to anyone on the internet, including search engines. Attribution is part of how Floc works: Contributions are credited by name in an Idea's Progress history. Being visible grants no reuse rights except under an Idea's open licence (see the Terms of Use).

5. What stays private

Your email address, password, private messages and their attachments, offers, saved items, notification settings, mutes, blocks and reports you file are not public. Private messages are visible only to the people in the conversation, and to a moderator if a message is reported. Offers are visible only to the sender and the Creator. Your map coordinates are visible only to you. Drafts and deleted Ideas are not shown publicly.

6. Confidential Ideas

Confidential Ideas are access-controlled at the database level, not merely hidden in the interface. Their content is readable only by the Creator, the Creator and participants whose access is active. They are excluded from feeds, search, recommendations, public profiles, previews and search-engine indexing. Only a limited public card (for example stage and broad Topics) and Need outreach approved by the Creator or an Admin may appear publicly, containing only the text written for that purpose.

For each Confidential Idea we keep a Disclosure Log of invitations, acceptance of confidentiality terms and the version accepted, access granted and revoked, and changes to the Idea's sharing status. The log is append-only and visible only where the relevant access rules permit. Historical confidentiality evidence is distinct from ordinary Idea content: the current evidence-only review copies have a fixed deletion deadline of 26 November 2026, with no automatic renewal. Longer retention requires a separate documented decision. The Creator can export permitted records as a CSV file; once exported, the file is under the Creator's control. An invitation notification says only that you have been invited to a Confidential Idea.

7. Location and Reach

When you add a location, you choose your country first and then a place. We send that text to OpenStreetMap's Nominatim service to turn it into approximate map coordinates. The coordinates are stored privately, visible only to you, and used only to rank matches by Reach (Local, Regional, National, Continental or Global). Floc does not use GPS or store street addresses. Only the place name you choose is shown publicly. Maps in Floc are displayed using OpenStreetMap map images, which means your browser loads them directly from OpenStreetMap.

8. Matching and recommendations

Floc suggests Ideas, Opportunities, Needs and People that may be relevant to you, based on your Interests, Skills, Topics, organisations, ways of contributing and Reach. This is a form of profiling. Each suggestion shows the reasons it was made. Matching only changes the order and selection of what you see; it does not make decisions with legal or similarly significant effects. You can influence it by changing your profile, Interests and location, and you can object to it by writing to us.

9. AI Topic suggestions

When you create or edit an Idea, Floc can suggest Topics from a fixed list. To do this, the Idea's text is sent to an AI service provided through Lovable's AI gateway, which passes it to an AI model provider. The text is used to produce the suggestion only. Suggestions are optional — you choose which Topics to keep. Please consider this before writing highly sensitive detail into a Confidential Idea.

10. LinkedIn import

You can fill in your profile from a data export file you download from LinkedIn yourself. Floc reads the file in your browser and saves nothing until you review and confirm. Floc does not connect to your LinkedIn account.

11. Identity verification (not yet available)

Floc plans to require identity verification before someone can be granted access to a Confidential Idea, and possibly for certain roles on public Ideas. Verification cannot be completed yet, because no verification provider has been chosen. When it becomes available, this policy will be updated to name the provider, describe exactly what is collected and how long it is kept, before anyone is asked to verify. Verification alone will never grant access to an Idea.

12. Moderation and safety

Anyone can report content or an account. Reports record the people involved, the linked content, the reason, the explanation and the date and time, together with their status and history. Warnings are sent only to the reported person. When content is removed from feeds, moderators keep a permanent snapshot of it, visible only to moderators, so decisions can be reviewed. Moderators may also change an organisation's status or suspend an account; these actions are recorded.

13. Notifications, mentions and feedback

Notifications are sent when someone takes an action that concerns you, such as mentioning you, inviting you or responding to your Idea. You can turn categories on or off, mute and block. Anonymous "Something else" feedback on feed items is readable by admins without showing who sent it.

14. Services that help run Floc

We share personal data only with the services needed to operate Floc, or where the law requires it:

Lovable and Lovable Cloud — hosting, database, file storage, sign-in and the AI gateway.
Email delivery — sign-in and notification emails sent from notify.floc.world.
Google and Apple — only if you choose to sign in with them.
OpenStreetMap (Nominatim and map images) — the place text you enter and, for maps, your browser's request.
AI model provider — Idea text for Topic suggestions, through Lovable's AI gateway.

Some of these services may process data outside the EU/EEA. Where that happens, we rely on the safeguards the provider offers, such as the EU Standard Contractual Clauses or an adequacy decision.

15. Cookies and browser storage

Floc does not use advertising or tracking cookies. It stores a small amount of data in your browser that is strictly necessary: your sign-in session and your preferences, such as Light or Dark appearance.

16. How long we keep data

Account and profile data: while your account is active.
Deleted Ideas: hidden immediately, kept for 30 days so they can be restored, then permanently removed.
Progress history, the Audit record and moderation snapshots follow their existing attribution and safety policies. Confidential evidence is not retained indefinitely by default: current evidence-only review copies expire on 26 November 2026 and are removed by scheduled cleanup. Ordinary deleted Idea content still follows the 30-day restoration period above.
Messages: until the conversation's participants delete them or the account is deleted.
Technical logs: for a short period needed for security and fault-finding.

17. Deleting your account

You can delete your account yourself under Account. Floc first checks for anything that must be handled — for example an Idea where you are Creator and others depend on it. Your profile and private data are then removed. Content that forms part of other people's work, such as Contributions and Comments on shared Ideas, is kept so their history stays intact, and is shown with "This account is no longer active on Floc". You can ask us to anonymise remaining credit.

18. Your rights

You have the right to access, correct, delete, restrict or object to the use of your personal data, to receive it in a portable format and to withdraw consent. Some rights are limited for records that protect other people's attribution or confidentiality (see section 16). To use your rights, write to hello@floc.world. You can also complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk, or to the authority where you live.

19. Age

You must be old enough to enter a binding agreement in your country to use Floc.

20. Changes

We will update this policy as Floc develops and change the date above. Significant changes will be announced in Floc before they take effect.