Your yard stays yours.

Information we handle

Data kept on a Birds Heard box

A box keeps local records for detection metadata, embeddings, candidate scores and decisions, and delivery state so it can operate and retry during outages. Current defaults prune detailed candidate records after 14 days. Forwarded or dropped metadata is count-capped rather than guaranteed a fixed time retention, so how long it remains depends on detection volume. Service logs and a quarantined copy of a corrupt database do not currently have a repository-defined automatic expiry. The local Wi-Fi profile remains on the box until it is removed at the operating-system level. These implementation defaults and limits may change as the appliance is hardened; current customer audio choices remain as described below.

Audio: handheld and box

Handheld identification

Handheld bird identification analyzes recordings on-device. Bird candidates, confidence, time, and location may be sent to Birds Heard to improve the match. Handheld recordings are uploaded only when you explicitly choose to save the sound. A temporary recording may remain on your device until the operating system or app storage is cleared.

Birds Heard box

The box analyzes short windows locally and normally sends detection metadata, not audio. Continuous audio is never uploaded. If an owner explicitly enables detection clips, a short clip around a detection may be screened on-device and uploaded for private playback. Blind research samples are a planned separate short-audio program and are currently disabled pending a versioned, explicit opt-in consent flow; enabling detection clips or Plus does not provide that consent. Audio screening is designed to keep clips containing speech, people, pets, vehicles, or music on the box, but no automated screen is perfect.

When a workspace owner enables detection clips, an authorized workspace member whom Birds Heard has granted correction access may play those clips in the correction workflow. Birds Heard staff and external labelers cannot review or listen to ordinary correction clips without a separate, explicit research opt-in consent.

Location and public yards

Your exact location is private and is not published on a public yard page. Publishing a yard is opt-in and may show bird names, activity, a handle, and the location detail you select—never saved audio or a street address. “City” uses a generalized approximate point for the city. “Region” uses an approximate state or province area. “Hidden” shows no map location. If you enable live public activity, recent bird activity may appear publicly; otherwise public activity is coarsened into daily summaries.

Authorized members of your account can see private account and yard data. Authorized administrators may access privacy-bounded operational summaries and, when necessary to secure, support, or operate the service, limited account records. Public-yard content can be seen by anyone; correction records are available only to users with correction access and authorized administrators.

How we use information

• Provide sign-in, bird identification, saved finds, private atlases, public yards, notifications, exports, box setup, and software updates.
• Enrich and evaluate bird matches, improve models and decision systems, maintain the authorized correction workflow, and—only if separately enabled in the future—operate the research workflow described above.
• Protect accounts, diagnose failures, prevent abuse, maintain audit records, and support users.
• Understand use of our marketing and product surfaces only when analytics consent permits it.
• Comply with law and enforce our Terms of Service.

Cookies and optional analytics

We use session and preference storage needed to sign you in, secure the service, and remember choices. The ordinary signed-in web session lasts up to 7 days. A mobile app access token lasts up to 60 days unless it is revoked or replaced. The active-station choice lasts up to 1 year, and administrator elevation lasts 30 minutes. If an analytics choice is stored, it lasts up to 1 year unless you change it or clear browser storage.

Optional analytics are currently disabled while we complete vendor diligence. If ClickClacks analytics is enabled later, it will remain opt-in and will honor enabled Do Not Track (DNT) and Global Privacy Control (GPC) browser signals. Birds Heard does not currently use its own service to track your activity across unaffiliated websites over time. Previously collected opt-in analytics events may remain with ClickClacks while we verify its retention and deletion process; contact us to request follow-up about those events.

Who can access information and why

We do not give everyone listed below unrestricted access. Access depends on the feature you use and is limited to the information reasonably needed for the stated purpose.

• K3 Technologies, LLC and Birds Heard administrators. Authorized personnel may access account details, subscription and correction-access status, boxes, detections, corrections, administrative audit records, and privacy-bounded operational information when needed to secure, support, or operate Birds Heard. This administrative access does not override the audio limits below.
• Authorized account members and correction reviewers. Members can access private information available within their workspace. Correction users can access correction records and only the detection clips made available within the authorized correction workflow. Birds Heard staff and external labelers cannot listen to ordinary correction clips without a separate, explicit research opt-in.
• The public. Anyone may see information you deliberately publish through a public yard, including the selected handle, bird activity, and the city-, region-, or hidden-level location you choose. Exact private coordinates, saved recordings, private yards, and account information are not included in a public yard.
• Cloudflare. Cloudflare processes web and API requests, IP address and browser or device request information, account and service data stored in our databases, and security and delivery information for hosting, infrastructure, databases, object storage, delivery, and security. A saved sound recording is uploaded to Birds Heard and stored in Cloudflare object storage only when you choose to save it or an owner has enabled eligible box detection clips. Transactional email can include the recipient address, subject, message body, and delivery metadata.
• Apple. Apple may process Sign in with Apple identifiers and authentication activity. When the app uses Apple device services, Apple may also process device, location, reverse-geocoding, and related service information under Apple’s policies.
• Expo, APNs, and FCM. For push notifications, Birds Heard sends the Expo push token, notification title and body, and custom data such as an in-app destination to Expo, which forwards it to Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) as applicable. Expo Application Services may also process device and operating-system details, app and update identifiers, and update-request metadata to build, deliver, or update the mobile app.
• Google. We use Google for maps and geocoding and for Gemini AI or machine-learning features such as regional plausibility checks, approximate place resolution, generated bird information, and generated bird art. Map requests from your browser or device can include coordinates or a place query plus IP address and ordinary request information. Gemini receives species, region, place-query, and requested-content context, but not detection audio or account identity. Web fonts are self-hosted by Birds Heard and served through Cloudflare without contacting Google. Google handles its requests under its Privacy Policy.
• GBIF. GBIF receives species and a geographic region or coordinate bounding box when we request taxonomy, biodiversity, occurrence, or seasonal reference information.
• Open-Meteo. Open-Meteo receives exact latitude and longitude when we request weather context for a station.
• ClickClacks. ClickClacks analytics is not currently active. If enabled after vendor diligence, it will remain opt-in and disclosed events may include a route or path and privacy-limited internal identifiers. Historical opt-in events, if any, may remain while we verify ClickClacks’ retention and deletion process.
• Legal, safety, and business recipients. We may disclose information to courts, regulators, law enforcement, advisers, insurers, or transaction participants when required by law, reasonably necessary to protect rights or safety, or involved in a merger, financing, reorganization, or sale. Where permitted, we will limit the disclosure and require appropriate confidentiality.

Audio boundary. Continuous microphone audio is not uploaded or disclosed to these recipients. A saved sound or eligible owner-enabled box clip reaches Birds Heard and Cloudflare only through the deliberate upload paths described in “Audio: handheld and box.” Google, GBIF, Open-Meteo, ClickClacks, and push providers do not receive detection audio through the current product flows.

Provider protections. We require service providers acting on our behalf and receiving app data to use it only for the contracted purpose and provide the same or equivalent privacy protection described in this policy and required for the app. If we learn that a provider cannot meet those requirements, we will take reasonable steps to stop and remediate the processing. Some features also connect you to independent third-party services that process information under their own terms and privacy notices.

Collection across websites and services. Birds Heard does not use its own service to collect information about your activities over time across unaffiliated websites. Third parties may collect or combine information about online activities over time and across websites or services as described in their own privacy policies. In particular, Google Maps may receive IP address, device or browser information, coordinates or place queries, and information about the page request. Web fonts are self-hosted by Birds Heard and served through Cloudflare without contacting Google. We do not authorize third parties or service providers to use Birds Heard data for cross-site behavioral advertising.

Storage, retention, deletion, and export

We keep account and service data while needed to provide the service, meet security and legal needs, and resolve disputes. A daily scheduled process applies the workspace owner's selected clip retention window. A failed deletion may be delayed and retried. Provider recovery copies, if any, are not returned to ordinary use and age out under the provider's recovery controls. Operational logs and privacy-minimized audit records may be retained after other content is deleted when needed for security, integrity, legal obligations, or proof of an administrative action.

The account data export, available in the signed-in web app, is a limited JSON export of profile, boxes, preferences, the newest 10,000 detections (box detections only), and the newest 1,000 heartbeats. It excludes audio clips and may not include handheld finds, derived model data, internal security records, or information we cannot disclose about others.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information, object to or restrict certain processing, or withdraw consent. You can manage many choices in settings. To make a privacy request, email [email protected]. We may need to verify that the request belongs to you. You may also have the right to appeal our response or contact your local privacy authority.

Children's privacy

Birds Heard is only available to people 18 years of age or older. People under 18 may not create an account or use Birds Heard, and we do not knowingly collect their personal information. If you believe a person under 18 provided personal information, contact us so we can investigate and delete it as appropriate.

Security and international processing

We use organizational and technical safeguards, including access controls, encrypted transport, and privacy-limited administrative tools, and rely on our infrastructure providers for physical data-center safeguards. No system is perfectly secure. Our providers may process information in the United States and other countries, which may have different data-protection rules.

Changes and contact

We may update this policy as Birds Heard changes. We will update the date above. For a material change, we will provide a prominent in-service notice and, when appropriate, notify account holders by email before the change takes effect. Questions, requests, or concerns can be sent to [email protected].