Privacy Policy
Last updated: 1 November 2026
Birdboard is a card collecting game for the birds you hear. This policy covers the Birdboard iPhone app, its website, and the station board at birdboard.co. It explains what information we collect, why, who else handles it, how long we keep it, and how you can delete it.
The short version
- You can play without telling us who you are: no name, email address, phone number or password.
- Bird identification happens on your phone. Your recordings never leave it unless you share one yourself.
- We keep the birds you collect and the town where you heard each one. If you choose a username, your username, avatar and collection are public, but never where you heard your birds.
- Precise locations are saved only if you turn them on, are never public, and are deleted when you turn them off.
- No ads, no tracking, no analytics, and we never sell your information.
- You can delete your account from the app at any time.
1. Who we are
Birdboard is made and run by Edward Shelley, based in Germany ("we", "us"), who is responsible for (the "controller" of) the information described here. For anything in this policy, email birdboard@edshelley.com. For help with the app, see the support page.
2. What we collect, and why
Your account
The first time you open the app, we create an account for you with a random ID. It doesn't contain your name or contact details, but it is linked to your collection, so it is pseudonymous rather than anonymous. Your phone keeps a sign-in token for it as a cookie. We record when the account was created and last used. If you save your account with a passkey, the private part of the passkey stays on your phone or in your iCloud Keychain; we store only the public information needed to sign you in, and when the passkey was created and last used.
Your profile
You can choose a username and a bird avatar. Choosing a username makes your profile public (see section 3). A username is permanent once chosen, so that it always refers to the same player. Please don't use your real name or anything else that identifies you; if you do by mistake, see section 8. Usernames that are offensive or pretend to be someone else are removed, and a removed username can't be used again.
Reports and blocks
If you report a player's username, we keep the report: who made it, which player and name it is about, the reason you chose and when. We use it to decide whether to remove the name, and delete the report once we have. If you block a player, we keep that so we can leave them off your leaderboard. The other player isn't told about either.
Notifications and following
If you allow notifications, your phone gives the app a push token: an address Apple's push service uses to deliver notifications to that phone. We store it with your account, with which notifications you've turned on in Profile › Notifications, so that we can tell you when someone passes you on the weekly leaderboard, how you finished when you're in the top five, and what the players you follow collected. We note which notifications we've sent, and when, so we don't send one twice or too often. If you follow a player, we keep that so we can send you their summaries. They aren't told who follows them, and a summary never says where they heard their birds.
Your collection
When you collect a bird, the app sends us the species, the date, details of the identification used to score it, and the town and country where you heard it (for example "Berlin, DE"). We use this to build your collection, work out levels and points, and rank the leaderboard.
Birds collected during the test period before 14 October 2026 also kept an approximate location, to about 1 km. It has never been public, and it is deleted with your account.
Precise locations (optional, off by default)
If you turn on Profile › Save precise locations, the app also sends the exact spot of each bird you collect while it is on, so that you can later see where you heard your birds. Precise locations are not public and aren't shared with other players. Turning the setting off in the app deletes the spots already saved.
Home stations (early test versions)
Early test versions of the app could link a BirdWeather station as your home station, and collect the birds it heard. If you linked one, we keep its ID and name, and which of your birds it heard, until you delete your account or ask us to remove them. The app no longer offers stations.
Location we use but don't keep
- A bird's year. The seasonality chart on a card asks for sightings around your area. Your location is rounded to about 50 km before it leaves your phone.
- Naming your town. The app uses Apple's location services to turn your location into a town name.
- Better identification. BirdNET runs on your phone and uses your location and the time of year to judge which birds are likely nearby. This stays on your phone.
Birdboard asks for location "While Using the App" and never in the background. Approximate location is enough to play.
Microphone and recordings
Listen uses the microphone to record birdsong while it is running, and BirdNET analyses the recording on your phone. We never receive your audio. Recordings are kept in the app's storage on your phone (you can see them in the Files app) and deleted automatically after 14 days. Each listening session also saves a small log on your phone: when it started, how long it ran, the town, the birds identified, the exact spot of each bird if precise locations are on, and the phone and app versions. Like other app files, recordings and logs can be included in your phone's iCloud or computer backups, which you and Apple control.
The website
The app's sign-in token is its only cookie. It is strictly necessary for the game to work, so it doesn't need your consent under German law (§ 25(2) TDDDG). Opening a card, a collection or a profile on the website sets no cookies and creates no account. We don't use advertising or analytics cookies.
The station board at birdboard.co
birdboard.co also shows the birds heard by any public BirdWeather station as a page of illustrations. It has no accounts and sets no cookies. The station you look up is remembered only in your browser's local storage, so the page opens on it next time, which is strictly necessary for that. If you ask for stations near you, your browser's location is sent to our server for that request alone, and not kept.
Technical information
Our servers receive your IP address and basic details of each request, such as the page asked for, the time and your browser or app version. Our hosting provider keeps these in logs that we use only to keep the service running and secure.
Emails
If you email us, we keep your email address and message to answer you and handle your request.
3. What is public
Once you choose a username, anyone can see your profile page at birdboard.co/u/your-username and in the app. It shows:
- your username and bird avatar
- your collection: each bird's level and points, and the dates you first and last collected it
- your place, points and number of species on the weekly leaderboard
Players can follow a profile. After you've been out collecting birds with Listen, they get a notification with your username and the birds you collected, but never where you heard them. Players you block don't get these notifications.
Your profile never shows where you heard your birds: not the towns, any station, or precise locations. Without a username, you appear on the leaderboard without a name, and your collection can only be seen by people you send its link to. When you share your collection or a card, anyone with the link can see it.
4. Who else handles your information
We use a few service providers to run Birdboard. Each handles information only to provide its service to us, under terms that require it to protect the information.
| Provider | What it does | What it handles | Where |
|---|---|---|---|
| Vercel | Hosts birdboard.co and its API | Every request, including your IP address | USA (AWS US East, Virginia), with copies of public pages cached near you |
| Neon | Hosts our database | Your account, profile, collection and saved precise locations | USA (AWS US East, Virginia) |
| Hosts our email | Emails you send us | USA and other countries | |
| Apple | Names your town, keeps passkeys in iCloud Keychain, delivers notifications, and distributes the app | Your location when naming the town; your passkeys, end-to-end encrypted; and each notification's text and your phone's push token | Apple's servers |
| jsDelivr | Delivers the bird illustrations | Your IP address, as for any image loaded from the web | Servers worldwide, near you |
Our server also asks BirdWeather for public station and bird data. These requests come from our server, not your phone, so BirdWeather doesn't receive your IP address or account. They can contain an area around your rounded location, or a station's ID.
We may also share information if the law requires it, or to protect the safety of our users or the service.
5. Transfers outside the EU
Our server and database are in the United States, so your information is transferred there. For providers certified under the EU–US Data Privacy Framework, we rely on the European Commission's adequacy decision for it. Otherwise, and as a fallback, the transfers are covered by the European Commission's Standard Contractual Clauses in each provider's data processing terms. You can ask us for a copy of these safeguards.
6. How long we keep it
- Account, profile and collection: until you delete your account. An account with no passkey that isn't used for 400 days is deleted automatically, as its sign-in has expired and no one can reach it any more.
- Precise locations: until you turn the setting off or delete your account.
- Sign-in tokens: until you sign out or delete your account, or after 400 days without use.
- Passkeys: until you remove one in the app or delete your account.
- Reports: until we've dealt with them, or either account is deleted.
- Blocks: until you unblock the player, or either account is deleted.
- Push tokens: until Apple tells us the token no longer works (for example when you delete the app), another account signs in on that phone, or you delete your account.
- Notification settings and follows: until you change them, unfollow the player, or either account is deleted.
- Record of notifications sent: 30 days.
- Deleted and removed usernames: when an account is deleted, or we remove a username, we keep a scrambled (hashed) copy of the username, with nothing else, for as long as Birdboard runs, so that no one can take the name again or pass as you.
- Server logs: about a day.
- Database backups: deleted data can stay in backups for up to 30 days.
- Emails: as long as needed to handle your request.
- On your phone: recordings for 14 days; session logs until you delete them, your account or the app.
7. Legal bases
Under the GDPR, we rely on:
- Performance of a contract, to provide the game you use: your account, passkeys, collection, the leaderboard, the players you block and the players you follow.
- Our legitimate interest in a game where players can see each other's collections, for your public profile once you choose a username; in keeping deleted usernames from being reused to pass as someone else; in keeping offensive and impersonating usernames out of the game, for reports; and in running a safe, working service, for server logs and security.
- Your consent, for precise locations, for notifications, and for access to your location and microphone. You can withdraw it at any time in Profile and in your iPhone's Settings.
8. Your choices
- Delete your account in the app under Profile › Delete account. This permanently deletes your collection, leaderboard place, profile, precise locations, passkeys and sign-ins, push tokens, notification settings and follows, and the recordings and session logs on that phone. Only the hashed username described in section 6 is kept, and backups take up to 30 days to clear. If you no longer have the app, email us and we'll delete your account for you.
- Precise locations: turn them on or off in Profile. Turning them off deletes the spots saved.
- Your username: if it identifies you or someone else, email us and we'll remove or change it.
- Location and microphone: allow or refuse them, and change your mind at any time, in your iPhone's Settings › Birdboard.
- Blocked players: unblock them in Profile.
- Notifications: choose which ones you get, and unfollow players, in Profile › Notifications, or turn them all off in your iPhone's Settings › Notifications › Birdboard.
- Recordings: delete them in the Files app, or delete the app.
9. Your rights
Because we're based in Germany, the GDPR applies to your information wherever you live. You have the right to ask for a copy of your information, to have it corrected or deleted, to receive it in a portable format, to restrict how we use it, to object to uses based on our legitimate interest, and to withdraw consent at any time. To use any of these rights, email us. Because accounts have no name or email address, we may ask you to show that an account is yours, for example by signing in with its passkey.
You can also complain to a data protection authority, such as the one where you live or the one responsible for us in Germany. We'd appreciate the chance to put things right first.
10. Age
Birdboard is for people aged 16 and over. We don't ask your age, but if we learn that an account belongs to someone under 16, we'll delete it. If you think your child has an account, email us and we'll delete it.
11. What we don't do
We don't show ads or use advertising, analytics or crash reporting tools. We don't track you across other companies' apps or websites, sell or rent your information, or use it for advertising or to profile your behaviour.
12. Security
Everything between the app or your browser and our servers is encrypted. Access to the database is restricted to us, and to our providers' staff only as their terms allow, for example to keep their service running.
13. Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how we use information we already hold, we'll tell you in the app before it applies.