Privacy Policy
Last updated: 17 October 2026
Birdboard is a card collecting game for the birds you hear. This policy covers the Birdboard iPhone app and the website at birdboard.co. It explains what information we collect, why, who else handles it, how long we keep it, and how you can delete it.
The short version
- You can play without telling us who you are: no name, email address, phone number or password.
- Bird identification happens on your phone. Your recordings never leave it unless you share one yourself.
- We keep the birds you collect and the town where you heard each one. If you choose a username, your username, avatar and collection are public, but never where you heard your birds.
- Precise locations are saved only if you turn them on, are never public, and are deleted when you turn them off.
- No ads, no tracking, no analytics, and we never sell your information.
- You can delete your account from the app at any time.
1. Who we are
Birdboard is made and run by Edward Shelley, based in Germany ("we", "us"), who is responsible for (the "controller" of) the information described here. For anything in this policy, email birdboard@edshelley.com. For help with the app, see the support page.
2. What we collect, and why
Your account
The first time you open the app, or the cards on birdboard.co, we create an account for you with a random ID. It doesn't contain your name or contact details, but it is linked to your collection, so it is pseudonymous rather than anonymous. Your phone or browser keeps a sign-in token for it as a cookie. We record when the account was created and last used. If you save your account with a passkey, the private part of the passkey stays on your phone or in your iCloud Keychain; we store only the public information needed to sign you in, and when the passkey was created and last used.
Your profile
You can choose a username and a bird avatar. Choosing a username makes your profile public (see section 3). A username is permanent once chosen, so that it always refers to the same player. Please don't use your real name or anything else that identifies you; if you do by mistake, see section 8. Usernames that are offensive or pretend to be someone else are removed, and a removed username can't be used again.
Reports and blocks
If you report a player's username, we keep the report: who made it, which player and name it is about, the reason you chose and when. We use it to decide whether to remove the name, and delete the report once we have. If you block a player, we keep that so we can leave them off your leaderboard. The other player isn't told about either.
Your collection
When you collect a bird, the app sends us the species, the date, details of the identification used to score it, and the town and country where you heard it (for example "Berlin, DE"). For birds from a BirdWeather station, we store which station heard it. We use this to build your collection, work out levels and points, and rank the leaderboard.
Birds collected during the test period before 14 October 2026 also kept an approximate location, to about 1 km. It has never been public, and it is deleted with your account.
Precise locations (optional, off by default)
If you turn on Profile › Save precise locations, the app also sends the exact spot of each bird you collect while it is on, so that you can later see where you heard your birds. Precise locations are not public and aren't shared with other players. Turning the setting off in the app deletes the spots already saved.
Home station (optional)
If you have a BirdWeather station, you can make it your home station. We store its ID and name. To check that it's yours, the app sends your precise location once, to confirm you are near the station. We don't store that location.
Location we use but don't keep
- Finding stations near you. Your location is sent to our server to list nearby BirdWeather stations, and used only for that request.
- A bird's year. The seasonality chart on a card asks for sightings around your area. Your location is rounded to about 50 km before it leaves your phone.
- Naming your town. The app uses Apple's location services to turn your location into a town name.
- Better identification. BirdNET runs on your phone and uses your location and the time of year to judge which birds are likely nearby. This stays on your phone.
Birdboard asks for location "While Using the App" and never in the background. Approximate location is enough to play.
Microphone and recordings
Listen uses the microphone to record birdsong while it is running, and BirdNET analyses the recording on your phone. We never receive your audio. Recordings are kept in the app's storage on your phone (you can see them in the Files app) and deleted automatically after 14 days. Each listening session also saves a small log on your phone: when it started, how long it ran, the town, the birds identified, the exact spot of each bird if precise locations are on, and the phone and app versions. Like other app files, recordings and logs can be included in your phone's iCloud or computer backups, which you and Apple control.
The website
birdboard.co stores one cookie, the sign-in token, and keeps your home station in your browser's local storage so the site opens on it. Both are strictly necessary for the cards to work, so they don't need your consent under German law (§ 25(2) TDDDG). We don't use advertising or analytics cookies.
Technical information
Our servers receive your IP address and basic details of each request, such as the page asked for, the time and your browser or app version. Our hosting provider keeps these in logs that we use only to keep the service running and secure.
Emails
If you email us, we keep your email address and message to answer you and handle your request.
3. What is public
Once you choose a username, anyone can see your profile page at birdboard.co/u/your-username and in the app. It shows:
- your username and bird avatar
- your collection: each bird's level and points, and the dates you first and last collected it
- your place, points and number of species on the weekly leaderboard
Your profile never shows where you heard your birds: not the towns, your home station, or precise locations. Without a username, you appear on the leaderboard without a name, and your collection can only be seen by people you send its link to. When you share your collection or a card, anyone with the link can see it.
4. Who else handles your information
We use a few service providers to run Birdboard. Each handles information only to provide its service to us, under terms that require it to protect the information.
| Provider | What it does | What it handles | Where |
|---|---|---|---|
| Vercel | Hosts birdboard.co and its API | Every request, including your IP address | USA (AWS US East, Virginia), with copies of public pages cached near you |
| Neon | Hosts our database | Your account, profile, collection and saved precise locations | USA (AWS US East, Virginia) |
| Hosts our email | Emails you send us | USA and other countries | |
| Apple | Names your town, keeps passkeys in iCloud Keychain, and distributes the app | Your location when naming the town, and your passkeys, end-to-end encrypted | Apple's servers |
| jsDelivr | Delivers the bird illustrations | Your IP address, as for any image loaded from the web | Servers worldwide, near you |
Our server also asks BirdWeather for public station and bird data. These requests come from our server, not your phone, so BirdWeather doesn't receive your IP address or account. They can contain an area around your rounded location, or a station's ID.
We may also share information if the law requires it, or to protect the safety of our users or the service.
5. Transfers outside the EU
Our server and database are in the United States, so your information is transferred there. For providers certified under the EU–US Data Privacy Framework, we rely on the European Commission's adequacy decision for it. Otherwise, and as a fallback, the transfers are covered by the European Commission's Standard Contractual Clauses in each provider's data processing terms. You can ask us for a copy of these safeguards.
6. How long we keep it
- Account, profile and collection: until you delete your account. An account with no passkey that isn't used for 400 days is deleted automatically, as its sign-in has expired and no one can reach it any more.
- Precise locations: until you turn the setting off or delete your account.
- Sign-in tokens: until you sign out or delete your account, or after 400 days without use.
- Passkeys: until you remove one in the app or delete your account.
- Reports: until we've dealt with them, or either account is deleted.
- Blocks: until you unblock the player, or either account is deleted.
- Deleted and removed usernames: when an account is deleted, or we remove a username, we keep a scrambled (hashed) copy of the username, with nothing else, for as long as Birdboard runs, so that no one can take the name again or pass as you.
- Server logs: about a day.
- Database backups: deleted data can stay in backups for up to 30 days.
- Emails: as long as needed to handle your request.
- On your phone: recordings for 14 days; session logs until you delete them, your account or the app.
7. Legal bases
Under the GDPR, we rely on:
- Performance of a contract, to provide the game you use: your account, passkeys, collection, home station, the leaderboard and the players you block.
- Our legitimate interest in a game where players can see each other's collections, for your public profile once you choose a username; in keeping deleted usernames from being reused to pass as someone else; in keeping offensive and impersonating usernames out of the game, for reports; and in running a safe, working service, for server logs and security.
- Your consent, for precise locations and for access to your location and microphone. You can withdraw it at any time in Profile and in your iPhone's Settings.
8. Your choices
- Delete your account in the app under Profile › Delete account. This permanently deletes your collection, leaderboard place, profile, precise locations, passkeys and sign-ins, and the recordings and session logs on that phone. Only the hashed username described in section 6 is kept, and backups take up to 30 days to clear. If you only use the website, email us and we'll delete your account for you.
- Precise locations: turn them on or off in Profile. Turning them off deletes the spots saved.
- Your username: if it identifies you or someone else, email us and we'll remove or change it.
- Location and microphone: allow or refuse them, and change your mind at any time, in your iPhone's Settings › Birdboard.
- Home station: remove it in Profile.
- Blocked players: unblock them in Profile.
- Recordings: delete them in the Files app, or delete the app.
9. Your rights
Because we're based in Germany, the GDPR applies to your information wherever you live. You have the right to ask for a copy of your information, to have it corrected or deleted, to receive it in a portable format, to restrict how we use it, to object to uses based on our legitimate interest, and to withdraw consent at any time. To use any of these rights, email us. Because accounts have no name or email address, we may ask you to show that an account is yours, for example by signing in with its passkey.
You can also complain to a data protection authority, such as the one where you live or the one responsible for us in Germany. We'd appreciate the chance to put things right first.
10. Age
Birdboard is for people aged 16 and over. We don't ask your age, but if we learn that an account belongs to someone under 16, we'll delete it. If you think your child has an account, email us and we'll delete it.
11. What we don't do
We don't show ads or use advertising, analytics or crash reporting tools. We don't track you across other companies' apps or websites, sell or rent your information, or use it for advertising or to profile your behaviour.
12. Security
Everything between the app or your browser and our servers is encrypted. Access to the database is restricted to us, and to our providers' staff only as their terms allow, for example to keep their service running.
13. Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how we use information we already hold, we'll tell you in the app before it applies.