Privacy Policy
Effective: 14 August 2026. This policy explains how FlockInn processes personal data under the EU General Data Protection Regulation (GDPR).
1. Controller
The controller responsible for data processing on this website is:
Ruwen Hollenbach, Metzstraße 5, 60487 Frankfurt am Main, Germany.
Email: contact@flockinn.com. See our Impressum for full details.
2. Summary
FlockInn is a free accommodation search tool. You do not create an account. We do not use cookies, analytics, advertising, or tracking of any kind. We process only what is technically necessary to deliver the site and run a search, and we keep it for as short a time as possible.
3. Data we process when you visit the site
When you load the site, our server (and its reverse proxy) automatically records standard access data in server logs:
- your IP address,
- date and time of the request,
- the page or resource requested and the HTTP status,
- the referring page and your browser/OS user-agent string.
Purpose: to deliver the website, ensure its security and stability, and prevent abuse. Legal basis: Art. 6 (1)(f) GDPR (our legitimate interest in a secure, functioning service). Retention: server logs are automatically rotated on an ongoing basis and older entries are overwritten once a small size limit is reached; we keep them only as long as necessary for security and stability, and not longer.
4. Data we process when you run a search
When you use the search, you provide and we process the search parameters you enter:
- the start locations you type (as text and/or map coordinates),
- your chosen drive times, travel dates, guest counts, and filters.
Purpose: to calculate each drive-time area, compute the overlapping region, and retrieve matching accommodation listings. Legal basis: Art. 6 (1)(b) GDPR (performing the service you requested) and Art. 6 (1)(f) GDPR (providing the requested functionality).
Storage & retention: a search — your locations, dates and the results — is held transiently in an in-memory store (Redis) on our server and is automatically deleted after 1 hour. We do not otherwise store, cache, or profile your searches. IP-based counters used for rate-limiting are short-lived (an hourly window).
5. Recipients and third-party services
We keep external services to the minimum required to operate the tool. We do not sell or share data for marketing. The following recipients are involved:
| Service | Purpose | Data & location |
|---|---|---|
| netcup GmbH (Germany) | Hosting / infrastructure (processor under Art. 28 GDPR) | All server-side data; processed in Germany. |
| OpenStreetMap Foundation | Map tiles shown in your browser | Your browser requests map images directly, transmitting your IP address and the map area viewed. Provider based in the UK (recognised as adequate by the EU). |
| OpenStreetMap Foundation (Nominatim) | Address lookup (geocoding) | Your typed address is sent by our server. UK (adequate). |
| komoot GmbH (Photon) | Address autocomplete (geocoding) | Your typed address is sent by our server. Germany. |
| FOSSGIS e.V. / Project OSRM | Drive-time routing | Coordinates are sent by our server to compute reachable areas. EU-based public routing services. |
| Airbnb (and other booking platforms) | Retrieving accommodation listings for your search | Your search parameters (area, dates, guests) are sent by our server to the platform to fetch results. This may involve a transfer outside the EEA (e.g. the United States). |
Except for the map tiles, these services are contacted by our server, so your IP address is not disclosed to them by us. Where a transfer outside the EEA occurs (e.g. searching Airbnb), it is based on the necessity of performing the search you requested (Art. 49 (1)(b) GDPR) and/or the recipient's own transfer safeguards.
6. Cookies and tracking
We do not set cookies and we do not use any analytics, advertising, or tracking technologies. No profiles are built and no automated decision-making within the meaning of Art. 22 GDPR takes place.
7. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15),
- rectification (Art. 16) and erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on Art. 6 (1)(f) (Art. 21).
To exercise any of these, contact us at privacy@flockinn.com. Because we store search data only briefly and without account identifiers, we may be unable to link retained data to you; where we cannot identify you, some rights may not apply (Art. 11 GDPR).
You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, HBDI). A list is available at bfdi.bund.de.
8. Data security
All traffic to this website is encrypted in transit using TLS (HTTPS). We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, or misuse.
9. Changes to this policy
We may update this policy to reflect changes to the service or the law. The current version is always available at this URL.