Privacy policy

As of October 2026. The German version is binding.

Controller

Leon Braun, Albert-Einstein-Str. 1, 49074 Osnabrück, Germany
Email: hello@getbirdy.app

What Birdy stores and why

Your account

Email address, username, language and, if you sign in with Apple or Google, your account ID there. To sign in, we email you a code that expires after 10 minutes. A session cookie keeps you signed in; with the session we store your browser's identifier (user agent). A session ends when you sign out or after 90 days without use. Legal basis: Art. 6(1)(b) GDPR (contract).

What you publish

Photos, captions, tagged species, comments, likes, people you follow, Spots, ratings and saved Spots. Posts, comments, your profile and your life list are public; saved Spots and blocks are only visible to you. Legal basis: Art. 6(1)(b) GDPR.

Photos and places

From each photo we read when it was taken, the camera and, if present, where it was taken (GPS). We never show the exact place: a post shows at most a place coarsened to about 10 km, none if you choose so, and never for threatened species. Public versions of photos contain no metadata; the original with its metadata stays in private storage. Spots, by contrast, are public places with an exact position.

Your location in the browser

To show Spots near you, Birdy asks for your location if you want that. It is only used for that search and not stored.

Reports and security

When you report something, we store the report with your account. To prevent abuse, we briefly count requests per IP address in memory without storing them; our hosting provider processes IP addresses to run the service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure service).

Cookies

Birdy only sets cookies the service needs (§ 25(2) TDDDG): birdy_session keeps you signed in, birdy_locale remembers your language for a year. There is no tracking, no analytics and no advertising.

Service providers

• Fly.io (Fly.io, Inc., USA): hosts the website, server and database in Frankfurt.
• Tigris (Tigris Data, Inc., USA): stores photos.
• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): sends emails through Amazon SES from Ireland.
• ImprovMX: forwards email sent to hello@getbirdy.app.
• Apple and Google: only if you sign in with them.
• OpenFreeMap: serves the map images. Your browser loads them from there directly, which sends your IP address.

Some providers are based in the USA. Transfers there rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission's standard contractual clauses (Art. 46 GDPR).

How long

Your data is kept as long as you have an account. When you delete your account in Settings, we delete your posts, photos, life list, comments and likes. Photos uploaded but never posted are deleted after a day. Database backups are overwritten after at most five days.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR). Write to hello@getbirdy.app. You can also complain to a data protection authority, for example the Landesbeauftragte für den Datenschutz Niedersachsen.