Privacy policy

1. Who we are

Porch Flock (porchflock.com) is operated by its founder. This policy covers the Porch Flock web application (“the Service”) — not the separate marketing site at the same domain, which does not create accounts.

2. What we collect, and why

This list matches the application's data model exactly — nothing here is aspirational.

• Account (Person). Your email address (required for every account, no matter how you signed in — see §3), and optionally your display name, a profile image, and a coarse region (e.g. a city or state, never a precise address). Used to identify you, send sign-in links, and send the seasonal reminders described in the product spec once that feature ships.
• Sign-in method (Account). If you use Google or Facebook to sign in, we store the linkage and the access token needed to keep you signed in — not your password, which we never see. If we ever stop supporting a provider, or that provider suspends us, this record is what we remove; your account and your data are unaffected, because your account is always anchored to your email, never only to a social login.
• Session. A random token identifying your signed-in browser session, with an expiry.
• Your geese (Goose). A name you give your goose, an optional photo, an optional acquisition story, and which make/model it is.
• Your wardrobe and diary (WardrobeItem, DiaryEntry). Outfits you record owning, what you paid and where you bought them, and dated photo entries of your goose wearing an outfit on a given occasion.
• Fit reports (FitReport). Whether an outfit fit a given goose model, where it bound if it didn't, and an optional photo. You can submit these without an account at all, from a one-tap link we email you — that link identifies the email it was sent to, but creating a report never requires signing in.

We do not collect data about goose makes, outfit models or vendors that identifies you personally — that catalogue (GooseModel, OutfitModel, Vendor) is reference data about products, not about people.

3. Sign-in: email is the identity

Every account on Porch Flock is anchored to a real, working email address, whether you signed up with email, Google or Facebook. If you sign in with Google or Facebook, we only accept an email that provider has itself verified, and we use it to find or create the same one account — so you can never end up with an account that only Google or Facebook can reach. This matters concretely: if a social provider ever suspends us or you, you can still sign in and reach your own data with a plain email link.

4. Photos and other content you post

You keep ownership of everything you post. We ask only for a non-exclusive, worldwide, royalty-free licence to store, display and back up what you upload, solely to operate, provide and improve the Service — sublicensed only to the infrastructure providers who host it for us (see §6), never sold, and never used to feature you in marketing without a separate, off-by-default opt-in.

Your photos are never used to train generative AI models — not ours, and we never license them to anyone else for that purpose. This is a permanent commitment, not a setting.

If someone else is identifiable in a photo you post — a face, not just a goose — we ask you to have their permission. Anyone can ask to be removed from a photo; we act on that request without requiring you to argue about it first.

5. Children

Porch Flock is not directed at children and you must be at least 13 to create an account. A grandchild appearing in the background of a photo is not, on its own, something we treat as data collected from a child. If we learn an account belongs to someone under 13, we delete it.

6. Who we share data with

We use a small number of infrastructure providers to run the Service. None of them may use your data for their own purposes.

• Neon — hosts our database (everything in §2).
• Vercel — hosts the application and, where you upload a photo, the file itself.
• Resend — delivers sign-in and reminder emails on our behalf; it sees your email address and the email's contents, not your account data.
• Google / Facebook — only if you choose to sign in with them; see §3.

We do not sell personal data, to anyone, ever.

7. Deleting your data

Sign in and visit Account → Delete my account, or use the account page directly. This immediately and permanently deletes your Person record, your sign-in methods, your geese, your wardrobe and your diary.

One category is handled differently, deliberately: fit reports you submitted stay in the registry, because they are measurement facts about a goose model and an outfit, useful to every other member trying to answer “will this fit,” not personal data about you once your name and email are removed from them — which deletion does automatically, in the same action.

If you signed in with Facebook and use Facebook's own “remove app” or data deletion flow, we process that request the same way, automatically, at /api/facebook/data-deletion.

A short backup retention window (currently up to 30 days) applies to database and object storage backups made before your deletion request, after which deleted data is not recoverable by us or anyone else.

8. Contact

Questions about this policy or a request we haven't automated yet: hello@porchflock.com.