Privacy Policy

Who we are

Birdy is a mobile app that identifies birds by their sound and keeps your sightings in a personal field journal. This policy explains what data we collect, why, and what rights you have over it. It covers both the Birdy app and this website.

Data controller

The data controller for Birdy is Mert Çuhadar, Seyrantepe Mah., Altınay Cad. No: 90/12, 34418 İstanbul, Türkiye, reachable at [email protected].

Data we collect

We keep data collection to the minimum needed to run the service:

• Account data — if you sign in, we receive your email address and, where the provider supplies them, your name and profile photo. Signing in with Apple, you may use Apple's Hide My Email so we only ever see a private relay address. Signing in with your email address uses a one-time code; we never store a password. You can use the app offline without an account.
• Sightings you create — the identified species, date and time, your notes, and (if you allow location access) the location of the observation as GPS coordinates.
• Audio you record — the sound snippet used to identify a bird. With online identification it is sent to our recognition service, analysed and not kept there. With offline identification (Birdy Pro) the analysis runs entirely on your phone and the audio never leaves it. If you save the sighting, the recording is kept on your device and, if cloud backup is on, in your account.
• Diagnostic data — when the app crashes we collect technical details (device model, OS version, app version and the error trace) to fix problems. This never includes your recordings.
• Purchase data — if you subscribe to Birdy Pro, we receive your subscription status and transaction identifiers. We never receive or store your card numbers.
• Feedback you send — if you use the in-app feedback form, we receive your message and, if you choose to enter them, your name and email address so we can reply.
• Sightings you share — if you create a share link, anyone with the link can see the species, date and time, your note, the recording, the location rounded to about 10 km and your profile name. The link stays active until you delete the sighting or your account.

We do not show ads, and we do not use advertising or cross-app tracking technologies.

How we use your data

• To identify birds from the sound you record.
• To save your sightings and, with Birdy Pro cloud backup, sync them across your devices and the web journal.
• To provide the Birdy Pro features you have purchased and to verify and restore your subscription.
• To keep the service reliable and to diagnose crashes.
• To respond to your feedback and support requests.

Where your data is stored and who processes it

We rely on a small number of processors, chosen to keep data within the EU where possible:

• Supabase (EU region) — stores your account and the sightings you sync.
• Sentry (EU region) — receives crash and diagnostic reports and messages sent through the in-app feedback form.
• Google and Apple — handle sign-in when you choose one of those options. If you sign in with your email address instead, our authentication provider sends you a one-time code by email.
• Hugging Face — hosts our recognition service and the downloadable offline model. For online identification the audio snippet is sent to this service, processed to return a result and not stored there. When you download the offline model, Hugging Face serves the file and sees your IP address.
• RevenueCat (subscription management) — when you purchase Birdy Pro, RevenueCat processes your subscription status, an app-specific user identifier linked to your account, and device identifiers to validate and restore your subscription.
• Apple / Google (payment processing) — payment for in-app purchases is handled by the relevant app store; we do not receive your full payment details.
• GBIF — when the regional filter is enabled, your approximate location may be sent to GBIF (Global Biodiversity Information Facility) to determine which species are expected near you.
• BigDataCloud — turns the coordinates of a sighting into a place name (such as a town or park) in the app and the web journal. Only the coordinates are sent, directly from your device or browser.
• Map providers (OpenStreetMap, CARTO, Esri) — when you view a map, map images are loaded from these providers, who see your IP address and the area being displayed.

Species reference content (photos, descriptions, sounds) is drawn from eBird, iNaturalist, Wikipedia and xeno-canto. These are outbound sources and do not receive your personal data.

This website

The website does not use analytics, advertising or tracking cookies. It remembers your light/dark theme choice in your browser and, if you sign in to the web journal, keeps your login session in your browser's local storage. Our hosting provider (Hostinger) and network provider (Cloudflare) process standard technical data such as IP addresses to deliver and protect the site.

Legal bases for processing

Where the GDPR applies, we process your data on these bases: performance of a contract (providing the app and syncing your journal), your consent (location access and optional sign-in), and our legitimate interests (keeping the service secure and reliable). You can withdraw consent at any time.

Your rights

Under the GDPR and Türkiye's KVKK, you have the right to access, correct, delete, export and restrict the processing of your data, and to object to processing. To exercise any of these, email us at [email protected].

You can delete your account and synced data yourself at any time — see Delete account.

Data retention

We keep your account and sightings for as long as your account is active. When you delete your account, your synced data is removed from our active systems promptly and from backups within 30 days. Diagnostic reports are retained for a limited period and then deleted. Feedback messages are kept only as long as needed to handle them. Purchase records are kept by Apple, Google and RevenueCat as required for tax and accounting purposes, even after you delete your account.

International transfers

Our primary storage (Supabase) and diagnostics (Sentry) are in the EU. Some processors, such as Hugging Face, RevenueCat, BigDataCloud and the app stores, may process data in other countries, including the United States. Where that happens, the transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Children

Birdy is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their data.

Changes to this policy

We may update this policy as the app evolves. We will post the new version here and update the date above; significant changes will be highlighted in the app.

Contact

Questions about your privacy? Email [email protected].