Birdex Privacy Policy

Privacy Policy for BirdexLast Updated: June 1, 2026Effective Date: June 1, 20261. IntroductionBirdex ("we," "our," "us," or "the App") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Birdex mobile application on iOS and Android.1.1 Who We Are (Data Controller)The data controller responsible for your personal data is LAPWING LABS LTD, a company registered in England and Wales (company number: 17011251), registered office: Cornsclose, Aish Lane, South Brent, Devon, TQ10 9JF. We trade as "Birdex".For any data-protection question, or to exercise your rights, you can contact us at [email protected] or by post at the registered office above. We have not appointed a statutory Data Protection Officer because we are not required to do so under UK/EU GDPR.This Policy describes how we process your personal data. Please read it alongside our Terms of Service. If you do not agree with this Privacy Policy, please do not use the App.2. Information We Collect2.1 Account InformationBirdex offers several ways to sign in:- Apple Sign-In (iOS): When you create an account using Apple Sign-In, we collect your Apple ID identifier, email address (if you choose to share it), and display name. We do not store your Apple ID password. Authentication is handled securely by Apple.
- Google Sign-In (Android): When you create an account using Google Sign-In, we collect your Google account identifier, email address, and display name. We do not store your Google account password. Authentication is handled securely by Google.
- Email and password (both platforms): You can instead create an account with your email address and a password. Your email address is stored to identify your account, and your password is securely handled and stored in hashed form by Supabase Auth — we never store or see your password in plain text. If you forget your password, we can send a reset link to your email.All sign-in methods flow through Supabase Auth, our unified backend authentication service.2.2 Bird Sighting DataWhen you log bird sightings, we collect and store:- Bird species information (which bird you identified)
- Sighting count (number of birds observed)
- Date and time of the sighting
- Location data (GPS coordinates — only when you actively log a sighting and grant permission)
- Location name (human-readable place name, if provided)
- Observation notes (optional text you add)
- Photos (optional images you upload)2.3 Location DataBirdex collects precise location data only when you actively create a bird sighting or save a location, and grant location permissions.- Location is NOT tracked in the background
- Location is only collected when you log a sighting or save a location
- Location data is stored with your sighting records to show where you spotted birds
- On Android, location coordinates are obtained on demand via Google Play Services (Fused Location Provider)
- You can control location permissions in your device settings:
- iOS: Settings > Birdex > Location
- Android: Settings > Apps > Birdex > Permissions > LocationLocation data is used to:- Record where you saw birds
- Display your sightings on a map within the app
- Power map-based features (such as the sightings map, nature-reserve markers, and species/county heatmaps available with Birdex Pro)
- Store your saved locations for quick selection when logging future sightingsWe do NOT:- Track your location continuously or in the background
- Share your location with third parties for advertising
- Use location for advertising2.4 Saved LocationsYou may choose to save frequently used birding locations for convenience. Saved locations include:- A user-defined name
- GPS coordinates (latitude/longitude)
- An optional description or addressSaved locations are stored on our servers and are only accessible to you.2.5 Photos and MediaWhen you upload photos of bird sightings:- Photos are compressed and resized before upload to reduce file size (maximum 1 MB)
- Photos are stored securely in cloud storage (Supabase Storage)
- Photos are associated with your sighting records
- Photos are only visible to you (not shared publicly or with other users)
- On Android, EXIF orientation data is used to correctly display your photos; on iOS, original photo metadata may be preservedWe do NOT:- Access photos outside of the app's sighting logging feature
- Share your photos with third parties
- Use your photos for any purpose other than displaying your bird sightings2.6 Social and Friends DataBirdex includes optional social features. If you choose to use them, we collect and display:- Friend code (a unique, shareable code such as "robin-123456" used to connect with other players)
- Friend relationships (who you have added as a friend and who has added you)
- Friend requests (sent and received, including sender display name, avatar, and level)
- Limited profile information visible to friends: display name, avatar, level, species count, badges count, sightings count, and photos count
- Leaderboard data: your rank, level, and species count compared to friends and globallySocial features are opt-in. You must actively add friends using friend codes. Your bird sightings, photos, location data, and detailed progress remain private and are never shared with other users.2.7 Usage and Diagnostic DataWe automatically collect certain technical information for diagnostic and improvement purposes:On both platforms:- Crash reports (via Sentry) — helps us identify and fix bugs
- Error logs — helps us improve app stability
- Device information — OS version and device model
- App performance metrics — loading times and feature usage patterns (about 20% of sessions are sampled for performance)
- Session data — when you use the app and for how long
- A user identifier used to correlate errors to your session, where one is attached. On Android, where a user identifier is attached it is in hashed (SHA-256) form; on iOS, crash and diagnostic reports are not linked to your Birdex account identifier. We strip authentication tokens before any report is sent.On iOS only:- Usage analytics events (via Mixpanel) — screen views, session duration, and feature interaction events. These events are linked to a pseudonymous identifier (your account UUID); we do not send Mixpanel your name, email, or other directly identifying details. The UUID lets us understand feature usage without exposing your identity, and you can object to this processing (see Section 7). Mixpanel data is stored on EU servers (EU data residency). We do not use Mixpanel for advertising, profiling, or tracking across other apps. These feature-usage events include in-app actions such as spending Golden Eggs (our in-game currency, which has no monetary value) on cosmetics or quiz-hint packs. Real-money purchase events — including Birdex Pro subscriptions — are NOT sent to Mixpanel; those are handled separately by RevenueCat and the app stores (see Section 5.8). Mixpanel is used on iOS only and is not present on Android.Because we rely on legitimate interests for analytics and crash diagnostics, you may object to this processing — see Section 7 ("Right to object / opt out of analytics and diagnostics").2.8 Game Progress DataWe store your game progress and achievements:- Player level and experience points (XP)
- Card collection progress (which birds you've seen and card levels, 1–100)
- Achievement badges (lifetime and yearly badges — bronze/silver/gold per species per calendar year)
- In-app currency (Golden Eggs balance)
- Login streaks (current and best streaks)
- Daily quest progress and completion
- Daily quiz attempts, hints used, and completion
- Avatar customization (selected avatar and unlock status)
- Card cosmetics (background and pattern customizations applied to bird cards)
- Cosmetic inventory (items purchased or unlocked with in-game currency)
- Advanced statistics data (per-bird monthly/yearly/lifetime stats and profile-wide stats, available with Birdex Pro)
- Favorite birds (stored locally on your device)
- Global rank and percentile among all players2.9 Push Notification DataTo deliver daily quests, badge progress, and social notifications, we collect a device push token:- iOS: via the Apple Push Notification service (APNs)
- Android: via Firebase Cloud Messaging (Google). A device push token is generated and stored on our servers and sent to Google to route notifications.The token is associated with your account and is deleted when you sign out. You can disable notifications at any time in your device settings.2.10 Giveaway and Promotional DataIf you view in-app giveaways or promotions, we record:- Whether you have seen a particular giveaway (to avoid repeat display)
- No entry forms, payment details, or additional personal data are collected through giveaways2.11 Offline DataIf you log a sighting while offline:- Sighting data (including any photo) is temporarily stored on your device in a local queue
- Data is automatically synced to our servers when your internet connection is restored
- The local queue is cleared after successful sync
- On iOS, the offline queue is stored as a local JSON file (maximum 50 queued sightings)
- On Android, a similar offline queue and sync mechanism is used2.12 Subscription and Purchase Data (Birdex Pro)If you subscribe to Birdex Pro, we and our subscription processor RevenueCat collect and store subscription-related data so that we can provide, verify, and manage your Pro access:- Subscription status (e.g. active, in free trial, in grace period, cancelled, or expired)
- The product you purchased (Birdex Pro Monthly or Birdex Pro Annual)
- The store you bought it from (Apple App Store on iOS, Google Play on Android)
- Store/original transaction identifiers
- Purchase, renewal, and expiration dates
- Free-trial status
- Whether the subscription is shared via Apple Family Sharing (on iOS)
- Your Birdex user identifier (a UUID, used as the subscription account ID)We use this data to grant and enforce your Pro entitlement on our servers (Pro features are gated server-side), to manage your subscription lifecycle, and to keep the accounting records the law requires.We do NOT receive or store your payment card number or any raw payment details. All payment processing is handled entirely by Apple (App Store) or Google (Google Play). This subscription data corresponds to the "Purchases" data type on the Apple App Store and the "Financial info > Purchase history" data type in the Google Play Data Safety section.2.13 Data We Do NOT CollectBirdex does NOT collect:- Contacts or address book
- Calendar data
- Health or fitness data
- Raw payment card numbers or bank details (card processing is handled entirely by Apple or Google; we never see your card number)
- Precise location in the background
- Data from other apps
- Advertising identifiers (IDFA on iOS or Android Advertising ID)
- Plain-text passwords (if you sign in with email, your password is stored only in hashed form by Supabase Auth and is never visible to us; Apple and Google Sign-In involve no password at all)3. How We Use Your Information3.1 Provide Core App Functionality- Authenticate your account via Apple Sign-In (iOS), Google Sign-In (Android), or email and password
- Store and display your bird sightings
- Calculate rewards, XP, and player progression
- Track your card collection and achievements
- Display your sightings on maps
- Manage your profile and settings
- Enable social features (friends, leaderboard)3.2 Improve the App- Fix bugs and crashes
- Analyze app performance and usage patterns
- Develop new features based on user behaviour
- Optimize user experience3.3 Ensure Security and Integrity- Prevent fraud and abuse
- Verify user authenticity via server-side validation
- Protect against unauthorized access
- Maintain data integrity and prevent manipulation3.4 Legal Compliance- Comply with applicable laws and regulations
- Respond to legal requests and prevent harm
- Enforce our Terms of Service
- Maintain billing and accounting records we are legally required to keep3.5 Provide and Manage Birdex Pro- Process and validate your subscription purchases, renewals, cancellations, and free trial
- Verify your Pro entitlement on our servers before unlocking Pro features (advanced statistics, species/county heatmaps, nature-reserve and sightings maps)
- Manage Apple Family Sharing eligibility (iOS)
- Maintain the subscription, billing, and accounting records we are legally required to keep4. Lawful Basis for Processing & Data Retention (UK/EU GDPR)4.1 Lawful Basis for ProcessingWhere UK or EU data-protection law applies, we process your personal data on the following lawful bases:Purpose — Lawful basis
Creating and authenticating your account; storing and displaying your sightings; gameplay and progression; social features; providing and delivering the Birdex Pro subscription and producing your transaction records — Contract (Art. 6(1)(b)) — necessary to perform our agreement with you
Retaining subscription, billing, and transaction records for statutory periods — Legal obligation (Art. 6(1)(c)) — UK tax and accounting law
Security, fraud and abuse prevention, server-side validation, crash and error diagnostics (Sentry), and product/usage analytics (Mixpanel, iOS) — Legitimate interests (Art. 6(1)(f)) — to keep Birdex secure, stable, and improving
Any optional, non-essential analytics that require prior consent in your jurisdiction, and any future marketing — Consent (Art. 6(1)(a))Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests do not override your rights and freedoms; you may object to this processing (see Section 7). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.Using the App is not, by itself, treated as your consent to processing that is actually necessary to perform our contract with you or that relies on our legitimate interests.4.2 Data RetentionWe keep your account and gameplay data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep certain records longer:- Subscription and billing/transaction records (including data held by RevenueCat and the relevant app store) are retained for up to 6 years to meet UK tax and accounting obligations
- Crash and diagnostic logs are retained for up to 90 days
- Records needed to resolve disputes or enforce our Terms are retained until the matter is concludedAfter these periods, data is securely deleted or irreversibly anonymised.5. Third-Party ServicesBirdex integrates with the following third-party services:5.1 Supabase (Database and Storage)- Purpose: Backend database, authentication, and file storage
- Data shared: All user data, sightings, photos, and game progress
- Privacy Policy: https://supabase.com/privacy5.2 Sentry (Crash Reporting)- Purpose: Error tracking, crash reporting, and performance monitoring
- Data shared: Crash logs, error messages, device information, performance samples (about 20% of sessions), and, where attached, a user identifier used to correlate errors to your session. On Android, where a user identifier is attached it is in hashed (SHA-256) form; on iOS, reports are not linked to your Birdex account identifier. We strip authentication tokens before any report is sent.
- Data NOT shared: Network connectivity errors, HTTP 404 errors, and rate limit errors are filtered out before sending
- Privacy Policy: https://sentry.io/privacy/5.3 Apple Sign-In (iOS Authentication)- Purpose: User authentication on iOS
- Data shared: Apple ID token, email (if you choose to share)
- Privacy Policy: https://www.apple.com/legal/privacy/5.4 Google Sign-In (Android Authentication)- Purpose: User authentication on Android
- Data shared: Google account token, email, display name
- Privacy Policy: https://policies.google.com/privacy5.5 Google Play Services (Android)- Purpose: Location services (Fused Location Provider), in-app review prompts, and app version management