Skip to content
birdfact

Privacy policy

Updated 14 October 2026

Last updated: 14 October 2026

This policy explains what personal data Birdfact collects, why, who we share it with, how long we keep it and what rights you have. It covers the Birdfact website (birdfact.com), the Birdfact app for iPhone and Android, and the emails we send. Our terms of use and cookies policy sit alongside it.

The short version

  • We're NC Digital Limited, trading as Birdfact. We decide how your data is used, which makes us the "controller". You can reach us at support@birdfact.com.
  • To identify a bird, your photo, description or recording goes to Birdfact's identification service. The companies that run parts of it for us (listed under Who we share it with) process it only on our instructions, and may not use it to train their own models.
  • Recordings from Listen aren't stored. They're processed to find the birds and then discarded. We keep only the list of birds detected.
  • For "Likely in your garden", the app sends a grid square of roughly 9 × 6 km, worked out on your phone, never your exact position.
  • You can use the app without signing up. An email address or Apple ID is only needed to keep your list when you change phones.
  • The app has no ads and doesn't track you across other companies' apps or websites. Some pages on our website show ads through Mediavine. Birdfact Unlimited members see no ads.
  • We never sell your photos, recordings, location or account details.
  • You can delete your account at any time in the app or on the website, and download your list or ask us for a copy of your data.

Who we are

Birdfact is a trading name of NC Digital Limited, a company registered in England and Wales (company number 16413452). Our registered office is 5 Canon Court, Institute St, Bolton BL1 1PZ, United Kingdom. Our VAT number is GB 508193686.

NC Digital Limited is the controller of the personal data described in this policy. We haven't appointed a data protection officer; our director is responsible for data protection. For anything about your data, email support@birdfact.com or write to us at the address above.

What we collect and why

When you visit the website

  • Technical information. When your browser asks for a page, our hosting and delivery providers receive your IP address, browser and device type, the page requested and the site that sent you. We use this to deliver the website, keep it secure and find faults.
  • Our own analytics. When you view a page or use a feature, we record an event: the page, the time, your device type (mobile, tablet or desktop), the website that referred you, a random session ID stored in a cookie (bf_sid, which expires after 30 minutes of inactivity), a scrambled (hashed) version of your IP address that changes every day, and, for some events such as starting a checkout, your account ID if you're signed in. If you search the site, we record what you searched for. We use this to understand which pages and features are useful. We don't currently respond to "Do Not Track" or Global Privacy Control signals; you can block the analytics cookie instead (see our cookies policy).
  • Google Analytics. We also use Google Analytics to measure how the website is used: the pages you view, how you arrived, your device and browser, and your approximate location (Google doesn't store your IP address). In the UK, the European Economic Area and Switzerland, Google Analytics cookies are only used if you agree in our consent tool; until then it receives only anonymous, cookieless signals. We don't use Google Analytics for advertising, and we've turned off Google signals. Google keeps this data for 14 months.
  • Your approximate location. Our hosting provider tells us which country (and sometimes which region) your IP address is in. We use it to show the birds and content that suit where you are.
  • Cookies. See Cookies and advertising.

When you identify a bird

You can identify a bird from a photo, a written description or its sound. All three go to Birdfact's identification service. It works out which birds are likely where and when you saw yours, suggests the species, and checks the answer against the birds recorded in that country at that time of year and against the bird it's most often confused with. Parts of the service are run for us by Google, on its cloud and machine-learning services, under our instructions (see Who we share it with). Before your first identification, the app tells you where your photo, description or recording goes and links to this policy.

Photos

  • What we receive: the photo, with the date it was taken and its GPS location if the photo contains them (a photo picked from your library is usually sent as the original file, with this information inside it); any place name you type or have saved; your approximate location from your IP address; and your birding experience level, if you've told us.
  • What we do with it: we read the date and GPS location from the photo, then store a copy resized to at most 2,000 pixels, and a small thumbnail, with the photo's embedded information (such as camera details and GPS) removed. We don't keep the original file. If the photo has GPS coordinates, we turn them into a place name (usually a county, state or region) using OpenStreetMap's Nominatim service, and use them on our own servers to look up which birds are recorded nearby. If you typed a place name, we look it up with Nominatim to find the country.
  • What the identification service receives: the resized photo (without its embedded information), the place name, the month, your experience level and the list of birds likely there. It never receives your coordinates: if Nominatim can't name the place, it gets only the country (in the UK, the nation, such as Wales).
  • What we keep: the photo, the result, the date, the place name and, if the photo had one, its GPS location, together as an "identification". If no bird is found, we delete the photo and don't keep the identification.
  • Who sees it: we don't show your photos to other people unless you choose to share a sighting publicly (see Your lists and records). People who work on Birdfact may look at identifications to fix problems and to check accuracy (see Improving accuracy).
  • Please don't send photos of people. If a photo includes a person by accident, we use it only to identify the bird.

Descriptions

If you describe a bird in words ("small brown bird, grey face, under my feeder"), our identification service receives your description, your approximate location and the month, and may ask you a question or two. We keep the conversation and the result as an identification.

Sound: Listen (app and website)

  • The microphone is on only while you're on the Listen screen and listening. It's never used in the background.
  • Your phone or browser sends the sound in chunks of a few seconds to our bird-sound identifier, which runs on our own servers on Google Cloud. It finds the birds, then the audio is discarded. We don't store recordings from Listen, and they aren't kept in our logs, crash reports or analytics.
  • We keep only the result: which birds were detected, when in the session each was heard, how confident the identifier was, the date, and the country used to narrow the results. To help, the app also sends a grid square: the one you're in when you use "Here now", otherwise your garden's, if you've set it. We don't store it with the result.

Sound: uploading a recording

  • In the app, a recording you upload is handled like Listen: processed to find the birds, then discarded. We keep only the result.
  • On the website, if you upload a recording or a video, we keep the audio (not the video) with the identification so you can play it back. If no bird is heard, we delete it straight away. If you save a recording to your recordings, we keep it until you delete it.

Corrections

If you tell us a result was wrong (for example, "Was it the other one?"), we keep your answer with the identification. It helps us measure and improve accuracy.

Location

Location makes identifications much more accurate, because it tells us which birds are likely. This is everything we use:

  • Photo location. The GPS location stored in a photo, if there is one. It's precise, and we keep it with the identification.
  • Approximate location from your IP address. Usually your country, sometimes your region. We use it to narrow down results and choose UK or US content. We don't turn it into coordinates.
  • Your garden (app). If you set your garden location or tap "Use my location" on the Likely card, your phone works out which grid square you're in. The squares are 5 arc-minutes across, about 9 × 6 km in the UK. Your phone's place search (from Apple or Google) gives it a label such as "near Bolton". We store the square's code and the label with your account. For the Likely list and for Listen, the app sends only the square's code, never your coordinates.
  • Places (app). The app can show the birds of a county, state or province: your garden's, one you've saved, or the one you're in now. Your phone works out your garden's county from your garden's grid square. Places you save, and any visit dates you add, are kept only on your phone. "Here now" uses your phone's location once to find the county and grid square you're in, and keeps them in the phone's memory for that visit only. While you're there, Listen sends that square's code instead of your garden's, never your coordinates. If you save a bird while you're more than 50 km from your garden, the sighting is saved as somewhere else, with that county, state or province's name as its place; you see it before you save and can change it. The square is never saved, and the county is kept only if you save the place. If you've set your garden and already allowed location, Home also looks at the position your phone last recorded, when Home opens and whenever you come back to the app (at most every 10 minutes). If that's more than 50 km from your garden, your phone's place search (from Apple or Google) finds the county, state or province you're in, so Home can offer to show its birds or save it as one of your places. The position isn't sent to us and isn't saved; if you tap "Not now", your phone remembers the last place you dismissed, so the suggestion doesn't come back for it. To show a place, the app asks our database for that area's bird records by its code, and for the Likely list it sends the grid square's code, never your coordinates.
  • Your device's location (app). The app asks for permission only when you choose a feature that uses it, and only "while using the app". It never tracks your location in the background.
  • Your device's location (website). If you tap "Use my location" when identifying a bird, or open the quick sighting log, your browser asks your permission first. For identification, your browser sends the position to OpenStreetMap's Nominatim service to find the nearest town, and that place name is then used like one you typed; if the lookup fails, nothing is filled in and we never use your coordinates as the place name. The quick sighting log sends the position to our servers to suggest likely birds, saves it with the sighting if you log one, and keeps it in your browser until you close the tab.
  • Sighting locations. When you log a sighting, you can add where you saw the bird. We store what you give us, which can be a precise point.
  • Place search and maps on the website. When you search for a place or pick a point on a map, your browser sends the search text or the point to OpenStreetMap's Nominatim service, loads map images from OpenStreetMap's servers and loads the map software from unpkg.com. These services receive your IP address.
  • Garden Letter location. If you give a postcode or town for the Garden Letter, we look it up with postcodes.io (for UK postcodes) or OpenStreetMap's Nominatim, and store only the county, state, province or country it's in, never what you typed.
  • Birds near me (website). If you type a town or postcode, or tap "Use my location", to see the birds likely near you, your browser finds the place with OpenStreetMap's Nominatim service and works out a grid square about 9 km across itself. Only the square's code is sent to us, and we don't store it. Your browser remembers the place's name and square until you clear its data.
  • Your area on bird pages (website). If you choose your county, state or province on a bird's page, or find it from a postcode or town, your browser looks the place up with OpenStreetMap's Nominatim service and remembers which area you chose. Nothing is sent to us unless you set up an arrival alert.
  • Arrival alerts. If you set up an arrival alert, we store the county, state or province you chose and the birds you picked, with your account.

Your account

  • Website accounts. You sign in with your email address and a 6-digit code we email you, or with Apple or Google where offered. If you set a password, our sign-in provider stores it in a scrambled form we can't read. We store your email address, and your name, preferences (such as your birding experience and interests) and notification choices if you give them. When you sign up, we record which page you signed up from.
  • Using the app without an account. When you first go past the welcome screen (with "Identify a bird", "Put it on your table" or "Look around first"), the app creates an anonymous account for you: a random user ID with no name or email attached. The app keeps its sign-in key on your phone. If you remove the app before adding an email address or Apple ID, you can't get back into that anonymous account.
  • Keeping your list. You can add your email address or, on iPhone, Sign in with Apple to your account. With Sign in with Apple, Apple gives us a stable ID and, if you choose to share them, your name and email address (or a private relay address that forwards to you).

Your lists and records

We store what you save: your garden list, sightings (species, date, number seen, notes, location and photo, plus camera details read from the photo, such as the camera model and settings), birding sessions, recordings, your wishlist and your ratings. We use them to show you your records on all your devices. You can download your list as a spreadsheet (CSV) from Your birds on the website.

Public sightings and recordings (website). You can choose to make a sighting or a saved recording public. After we've checked a sighting, anyone can see its photo on that species' page, with your display name (or first name), the place name, the date and the camera details. A public recording has its own page with the place name you gave it. You can make either private again at any time.

Subscriptions and payments

  • In the app, Apple or Google takes your payment. They tell us which plan you bought, the transaction IDs, the dates of your purchase, trial, renewals, cancellation or refund, the price and currency, and your store country. We never see your card details.
  • On the website, Stripe takes your payment for Birdfact Unlimited or a "Support Birdfact" contribution. We receive your name, email address, billing country, the amount and the status of your subscription. Stripe holds your card details; we never see them.
  • We use this to give you Birdfact Unlimited on every device you sign in on, to help with billing questions and refunds, to count trials and subscriptions in our own analytics, and to keep the accounting records the law requires.

Emails

  • Account emails, such as sign-in codes and messages about your account, purchases or contributions, are part of running your account. The app reminds you about a free trial ending by a notification on your phone, not by email.
  • The Garden Letter and our other newsletters are sent only if you sign up. Every one has an unsubscribe link. If you give us your postcode or location for the Garden Letter, we store the area it's in so we can tell you what's arriving near you. If you have an account, we may use your interests and recent sightings to tailor it.
  • The app launch list. If you ask us to tell you when the Birdfact app is out, we keep your email address, which phone you chose (iPhone or Android) and your country, worked out from your connection. We send one email to confirm the address, then one email when the app is out, and delete your address after that. It isn't added to the Garden Letter unless you sign up for that separately.
  • Confirming your address. When you sign up for the Garden Letter or the app launch list, we email you a link to confirm it, and send nothing else until you click it. If you don't confirm within 30 days, we delete the sign-up.
  • Arrival alerts are sent only if you set them up in your account. On the 1st of a month when one of your birds usually starts arriving at the place you chose, we email you. We use your place, your birds and your email address for this, and keep a record of which alerts we've sent so we don't repeat them. Every alert has a link to stop them, and you can change or remove them in your account at any time.
  • We send emails through Resend. Our emails tell us whether they were delivered and opened, and which links were clicked. We use this to see which emails people find useful. You can stop open tracking by turning off images in your email app.

Notifications (app)

If you allow notifications, the app gets a push token (a device address from Apple or Google, delivered through Expo) and stores it with your account. We use it for the notifications you've turned on, such as the reminder before a free trial ends and seasonal tips. Most of these are scheduled on your phone. You can turn them off in the app or in your phone's settings.

Bird alerts (when a bird you watch usually arrives, its last regular month, and what to look for before a trip you've saved) are worked out and scheduled on your phone, from the same county records the app shows. The birds you watch are kept on your phone; your wishlist is kept with your account, as described under Your lists and records. No server sends bird alerts.

App analytics and crash reports

  • Analytics. The app records events such as "identification completed" (with the species and how confident the result was), "subscription screen shown" and "Likely card viewed", and what you search for in the field guide. Each event carries a random install ID created when you first open the app, your account ID, your platform (iPhone or Android), the app version, your store country when you first open the app, the time, and a scrambled (hashed) version of your IP address that changes every day. Events can include your country or nation, but never your photos, recordings, coordinates or garden square. They go to our own servers, not to an analytics company.
  • Crash reports and performance. If the app crashes or hits an error, it sends a report to Sentry: your device model, operating system and app version, what went wrong and the screens that led to it. For a sample of sessions it also sends performance measurements, such as how long screens and requests took. Before a report leaves your phone, the app removes email addresses, sign-in tokens, the details in web addresses and coordinates. Reports never include screenshots, photos or audio, and they aren't linked to your account.

Contact, feedback and support

If you email us, use the contact form or leave feedback on a page, we receive what you send: usually your name, email address and message, or a rating, a comment and the page it's about. We use it to reply and to improve Birdfact.

Birding assistant (website)

If you use the birding assistant, we send your messages, any photos you add, your first name and your saved place name to the service provider that writes the assistant's replies. We keep your conversations until you delete them or your account.

Improving accuracy

We regularly check how accurate Birdfact's identifications are, using identifications:

  • We re-run samples of stored photos, and of recordings uploaded on the website, through our identification service to compare versions.
  • A birder we contract may label a sample of stored photos, so we can measure accuracy against an expert. They work under a written confidentiality agreement and see only the photo, the country and the month, through links that expire. They never see your name, email address, account, exact location or the answer Birdfact gave. Their working copies are deleted when the evaluation ends.
  • Corrections you give us help us find mistakes.

We don't use your photos or recordings to train machine-learning models, and our providers aren't allowed to use them to train theirs. If you'd rather your photos weren't included in accuracy checks, email us and we'll exclude them.

Testing improvements

To find out what works best, we sometimes show different versions of a feature to different people. For example, we may give new app accounts one of two free allowances at random. We use your account ID to keep you in the same group, and analytics to compare the groups.

Statistics we publish

We may publish statistics about what people identify with Birdfact, such as the birds most often identified in Wales this month. They're always aggregated: each figure is based on at least 20 identifications and covers an area no smaller than a nation or a US state. They never include photos, and nobody can be identified from them.

Our lawful bases

Data protection law says we need a lawful basis for each use of your data. These are ours:

What we doLawful basis
Identifying birds, running your account, storing your lists, syncing your devices and providing Birdfact UnlimitedContract: it's needed to provide the service you asked for
Taking payments and keeping accounting recordsContract, and our legal obligation to keep tax records
Account emails, such as sign-in codes and receiptsContract
Arrival alerts you set upContract: it's the feature you asked for
The Garden Letter, newsletters and other marketing emailsYour consent, which you can withdraw at any time
The app launch listYour consent, which you can withdraw at any time by replying to the confirmation email or contacting us
Push notificationsYour consent, given through your phone's permission prompt
Advertising cookies on the websiteYour consent
Website and app analytics and crash reportsOur legitimate interests in understanding how Birdfact is used, fixing faults and improving it
Google Analytics cookies in the UK, EEA and SwitzerlandYour consent, which you can withdraw at any time in the consent tool
Checking and improving accuracy, and publishing aggregate statisticsOur legitimate interests in giving accurate, trustworthy identifications
Testing different versions of a feature, such as the free allowanceOur legitimate interests in improving Birdfact and keeping it viable
Security, preventing fraud and abuse, and enforcing free allowancesOur legitimate interests in keeping Birdfact safe and fair
Answering your messagesOur legitimate interests, or contract if it's about your account or subscription
Meeting legal requirements and handling legal claimsLegal obligation, or our legitimate interests

Where we rely on legitimate interests, we've weighed them against your rights and expectations, and you can object at any time (see Your rights).

We don't ask for special categories of personal data, such as health or religious beliefs. Please don't include them in descriptions, notes or messages.

What you have to give us

You don't have to give us any personal data, and the law doesn't require it. But some features can't work without it: we need a photo, description or recording to identify a bird, an email address to create a website account or send you emails, and payment details (which go to Apple, Google or Stripe) to buy a subscription. Location is always optional; without it, identifications are less accurate.

Where we get data from

Most of the data in this policy comes from you or your device. We also receive some from other sources:

  • Apple and Google: your purchases, trials, renewals and refunds; and, if you sign in with them, a stable ID and, if you share them, your name and email address.
  • Stripe: your name, email address, billing country and payment status when you pay on our website.
  • Our hosting provider: the country, and sometimes the region, your IP address is in.
  • OpenStreetMap: place names for coordinates or place names you give us.

Who we share it with

We never sell your photos, recordings, location or account details. We share personal data only as described here.

Service providers. These companies act on our instructions, under contracts that require them to protect your data and use it only to provide their service to us:

ProviderWhat they do for usWhere they process data
SupabaseOur database, sign-in and file storage (account details, lists, identifications, photos and uploaded recordings)United Kingdom (London). Support staff may access it from other countries
VercelHosts the website and the servers the app talks toUnited States, and a worldwide delivery network
GoogleRuns parts of Birdfact's identification service on Google Cloud and its machine-learning services, including our bird-sound identifier; helps write the Garden Letter; hosts our email inbox (Google Workspace); measures how the website is used (Google Analytics)United States and other Google locations
CloudflareOur domain, delivery of images (including photos you upload), and checks that stop automated sign-ups (Turnstile)Worldwide
ResendSends our emailsUnited States
StripeTakes payments on our websiteUnited Kingdom, European Union and United States
SentryCrash and error reports from the appUnited States
ExpoDelivers app updates and push notificationsUnited States
AnthropicWrites the birding assistant's replies on the website. Its tools also help us build and maintain Birdfact, and can see personal data when we investigate a problemUnited States

Other organisations that use data for their own purposes, under their own privacy policies:

  • Apple and Google, when you download the app, buy a subscription, sign in with them, receive notifications, or use maps and place search in the app (Apple on iPhone, Google on Android).
  • Stripe, which also uses payment data to prevent fraud and meet its own legal duties.
  • Mediavine and its advertising partners, on website pages that show ads (see Cookies and advertising).
  • The OpenStreetMap Foundation, for place search and maps on the website. When our servers turn a photo's GPS coordinates into a place name, OpenStreetMap receives the coordinates but not your IP address or anything else about you.
  • YouTube and Vimeo, which show the video on our home page and videos in some articles.
  • unpkg.com, which supplies the map software on some website pages and receives your IP address when it loads.

Others, when necessary: our professional advisers (such as accountants and lawyers); the police, courts or regulators when the law requires it; and, if we sell or transfer Birdfact or NC Digital Limited, the new owner, who would have to use your data in line with this policy. We'd tell you before that happened.

International transfers

Our main database and the files you upload are stored in the United Kingdom. Some of our providers, listed above, process data in the United States or elsewhere. When personal data leaves the UK, we make sure it's protected by one of the safeguards UK law allows:

  • UK "adequacy regulations", including the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") where the recipient is certified under it; or
  • the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms.

Email us if you'd like more detail about the safeguard for a particular provider.

Cookies and advertising

On the website, we use:

  • Necessary cookies, which keep you signed in, count free identifications if you don't have an account, and let you keep an identification you made before signing up.
  • Our own analytics cookie, bf_sid, a random session ID that expires after 30 minutes of inactivity.
  • Your browser's storage to remember small choices, such as a banner you've closed.
  • Advertising cookies from Mediavine and its partners, on pages that show ads.
  • YouTube's and Vimeo's cookies, when a video on our home page or in an article loads.

Our cookies policy lists them all, with how long each lasts and how to control them. You can change your cookie choices at any time from "Cookie choices" at the foot of every page.

Advertising on the website. Mediavine manages the ads on some website pages, such as articles. We don't show ads on the identification, account, checkout or subscription pages, and we don't show them to signed-in Birdfact Unlimited members. In the UK and the European Economic Area, Mediavine's consent tool asks for your choice before advertising cookies are used for personalised ads. If you say no, you may still see ads that aren't based on your browsing.

In the app, there are no cookies, no ads and no advertising identifiers. The app keeps your sign-in session, your settings and a random install ID on your phone. It doesn't track you across other companies' apps or websites.

Mediavine's disclosure

Mediavine asks the sites it works with to include the following information, which we reproduce as Mediavine wrote it.

Mediavine Programmatic Advertising (Ver 1.1). The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a "device") by the web server so that a website can remember some information about your browsing activity on the Website.

First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, "Tags") may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser's cache. The "help" feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser's cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

The Website collects the following data using a cookie when serving personalized ads: IP Address; Operating System type; Operating System version; Device Type; Language of the website; Web browser type; Email (in hashed form).

Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor's referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.

If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit the National Advertising Initiative opt out page. You may also visit the Digital Advertising Alliance website and the Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance's AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.

How long we keep your data

We keep personal data only for as long as we need it:

DataHow long we keep it
Your account and profile (email address, name, preferences, garden square and label, push token)Until you delete your account
Anonymous app accountsUntil you delete the account, or 12 months after it was last used, whichever comes first
Identifications linked to an account (photo, result, date, place and any GPS location)Until you delete your account
Identifications made on the website without an account12 months. After that we delete the photo and any GPS location, and keep only the species result and the date
Recordings from ListenNot stored. Discarded as soon as the birds have been identified
Recordings you upload on the websiteWith the identification, until you delete your account. Deleted straight away if no bird is heard
Your garden list, sightings, sessions, saved recordings, wishlist and ratingsUntil you delete them or your account
Birding assistant conversationsUntil you delete them or your account
Detailed analytics events (website and app)120 days. After that we keep only daily totals, which don't identify anyone. For app events, we keep a slimmed record (the event, its time, the app's random install ID and your account ID, with no IP hash or search text; the account ID is removed if you delete your account) so we can see how long people keep using the app
App crash reports90 days
Server and delivery logs, including IP addressesNo more than 30 days
Arrival alerts (your place and birds)Until you remove them, stop them from an email, or delete your account. Our record of which alerts we've sent is deleted with them
Garden Letter and newsletter subscriptionsUntil you unsubscribe. After that we keep only your email address, on a "do not email" list so we don't contact you again
App launch listUntil the launch email for your phone has been sent, then deleted. Unconfirmed sign-ups (Garden Letter or launch list): 30 days
Records of the emails we've sent you, and whether they were delivered, opened or clicked2 years
Messages, contact form submissions and feedback2 years. After that we delete messages, and keep only the rating from feedback (no email address or comment)
Purchase and payment records6 years after the end of the financial year they relate to, because UK tax law requires it
BackupsDeleted data can stay in encrypted backups for up to 30 days before it's overwritten

We review what we hold at least once a year and delete anything we no longer need.

Your rights

Under UK data protection law you have the right to:

  • access your personal data and get a copy of it;
  • correct data that's wrong or incomplete;
  • delete your data (the "right to be forgotten");
  • restrict how we use your data, for example while we check a complaint;
  • object to our use of your data where we rely on legitimate interests, including analytics, accuracy checks and statistics;
  • object to direct marketing at any time; we'll always stop;
  • move data you gave us to another service (data portability), in a common machine-readable format. You can download your bird list yourself from Your birds on the website;
  • withdraw your consent at any time, where we rely on it. This doesn't affect what we did before.

To use any of these rights, email support@birdfact.com from the email address on your account, or tell us enough to find your data if you don't have one (for example, the dates and species of your identifications). We'll reply within one month. If your request is complex we may need up to two more months, and we'll tell you if so. It's free. We may ask you to confirm your identity first.

Deleting your account

  • In the app: Profile → Delete account.
  • On the website: Your settings → Delete account.
  • By email: write to support@birdfact.com and we'll do it for you.

When you delete your account, we delete your profile (including your garden square and push token), garden list, sightings, sessions, identifications (including photos, uploaded recordings and Listen results), wishlist, assistant conversations, arrival alerts and notification settings. We also unsubscribe you from the Garden Letter and other emails linked to your account. If you used Sign in with Apple, we ask Apple to revoke Birdfact's access, so Birdfact no longer appears in your Apple ID settings (the app may ask you to confirm with Apple first).

A few things stay for a limited time: purchase and payment records (which the law requires us to keep), analytics events (no longer linked to you, and reduced to daily totals or a slimmed app record within 120 days), feedback and messages you sent us (feedback is no longer linked to your account), your email address on our "do not email" list if you were subscribed, and encrypted backups (overwritten within 30 days).

Subscriptions. Deleting your account doesn't cancel a subscription you bought in the app: cancel it in your App Store or Google Play subscription settings first, or you'll keep being charged. If you subscribed on our website, deleting your account cancels that subscription straight away, and any paid time left on it (or lifetime access) ends. If you're within 14 days of paying, or you'd like to talk about a refund, email us before you delete.

Children

Birdfact isn't designed for children. You must be 13 or over to create an account or use the identification features, and under-18s need a parent or guardian's permission to buy a subscription. Anyone can read our articles and species guides, which don't need any personal data beyond what's described under When you visit the website. We don't knowingly collect personal data from children. If you think a child has given us personal data, email support@birdfact.com and we'll delete it.

How we protect your data

  • Everything travels between your device and us over encrypted connections (HTTPS).
  • Our database and file storage are encrypted at rest.
  • Our database uses access rules so that each account can read only its own records. Only the people who run Birdfact, and our service providers where they need to, can access our systems.
  • Passwords are stored in a scrambled form that can't be reversed, and we never see your card details.

No system is perfectly secure. If a breach puts your data at risk, we'll tell the Information Commissioner's Office within 72 hours and, if the risk to you is high, we'll tell you without delay.

Automated decisions

Identifications are made automatically by Birdfact's identification service. Your free allowance is counted automatically, and new app accounts may be given one of two free allowances at random (see Testing improvements). None of these decisions has a legal or similarly significant effect on you, and we don't use your data for profiling that does.

If you live in the European Union, the United States or Canada

European Union (including Ireland). The EU General Data Protection Regulation applies to our use of your data, and you have the same rights described above. You can also complain to the data protection authority where you live, work or think a breach happened. In Ireland, that's the Data Protection Commission.

United States. We collect the categories of data described in this policy, for the purposes described. We don't sell personal data for money. Advertising cookies on some website pages may count as "selling" or "sharing" personal data for targeted advertising under some US state laws. You can opt out with "Do not sell or share my personal information" at the foot of every page, through Mediavine's consent tool, or by blocking third-party cookies. Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it and to delete it. Email support@birdfact.com to use them. We won't treat you differently for doing so.

Canada. We handle your personal data as this policy describes. It's stored and processed outside Canada, mainly in the United Kingdom and the United States, where courts and authorities may be able to access it under local law. You can ask to see and correct the personal data we hold about you, and withdraw your consent where we rely on it, by emailing support@birdfact.com. Our director is responsible for protecting personal data. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d'accès à l'information.

Changes to this policy

We'll update this policy when the way we use data changes. The "last updated" date at the top shows when. If a change is significant, we'll tell you in the app, on the website or by email before it takes effect.

Complaints

If you're unhappy with how we've handled your data, please tell us first at support@birdfact.com (or through the contact form on our website) and we'll try to put it right. We'll acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.

Contact us

Email support@birdfact.com, or write to NC Digital Limited, 5 Canon Court, Institute St, Bolton BL1 1PZ, United Kingdom.