Bird-AR: Endangered Bird Radar Privacy Policy

1. Information We Collect

Account information

When you create an account, our authentication provider (Supabase Auth) stores your email address, a hashed password (only if you sign up with email & password), an internal user identifier, the authentication provider you used (email or Google), and the account creation and last-sign-in timestamps. If you sign in with Google, Google additionally provides us with your name, email address, and profile picture URL as chosen by Google. We do not store your Google password.

Profile information

In our profiles table we store your display name and, if you choose to add one, an avatar URL you provide. Your language preference and app preferences are stored in user_settings.

Learning and app activity

When you are signed in, Bird-AR stores learning activity linked to your user identifier in the following tables: favorites (birds you have favorited), learning_progress and mastered_birds (which birds you have studied and mastered), study_sessions and study_attempts (Learn and Test activity), and daily_test_results (daily matching test outcomes). Some interface preferences such as your chosen language and recent search input are stored only on your device in browser local storage and never sent to our servers.

Technical information

Our hosting and backend providers automatically process standard request metadata such as IP address, user-agent string, request timestamps, and error and security logs. This information is used to operate the service, prevent abuse, and diagnose problems.

Communications

If you email support, we receive the information you provide: your name, email address, message content, and any screenshots or device information you choose to attach.

Device permissions

Bird-AR does not currently request access to your camera, microphone, photos, location, or contacts. On the web, your browser may ask whether the site can show notifications; you can decline, and notifications are optional.

Information you should not submit

Please do not send us passwords, authentication codes, financial information, government identification numbers, medical or health information, or other highly sensitive personal information.

2. How We Use Information

• Create and maintain your account and authenticate you.
• Save your favorites, learning progress, mastered birds, and test results.
• Provide Learn (flashcards) and Test (daily matching) features.
• Personalize your language and interface preferences.
• Display your profile name and avatar to you inside the app.
• Respond to support requests you send us.
• Maintain security, detect abuse, and diagnose technical issues.
• Comply with applicable legal obligations.

We do not use your personal information for advertising, data brokerage, targeted marketing, or cross-app tracking.

3. Authentication

Bird-AR uses Supabase Auth as its authentication provider. Two sign-in methods are enabled in production: (1) email & password and (2) Sign in with Google. Supabase processes your credentials and issues session tokens; Google processes the OAuth exchange when you choose Google sign-in. These providers have their own privacy practices; we recommend reviewing them.

4. Third-Party Services

The following services process information as part of running Bird-AR in production:

• Supabase — authentication, database (PostgreSQL), storage, and server functions. Essential.
• Cloudflare Workers — application hosting and edge runtime. Essential.
• Google (OAuth) — used only if you choose Sign in with Google. Optional.
• OpenStreetMap — supplies map tiles when you use the Map screen. Your IP address is visible to their tile servers, as with any web map.
• Xeno-canto, Wikimedia Commons, iNaturalist, GBIF, EOL, Wikidata, Biodiversity Heritage Library, Internet Archive, Macaulay Library, ALA, Europeana, Freesound, eBird — sources of bird content (photos, audio, descriptions, range data). Content is fetched by our servers, not by your device, so these providers do not directly receive your personal information when you view content inside Bird-AR. Their attribution appears in bird profiles.

5. Bird Content and External Data

Bird-AR displays bird photographs, historical illustrations, bird-call recordings, conservation information, scientific classifications, habitat and distribution information, and maps. Content is sourced from scientific, conservation, museum, open-data, and licensed sources listed above and is displayed with attribution and license information in each bird profile. Media licensing (Public Domain, CC0, CC BY, CC BY-SA, CC BY-NC, CC BY-NC-SA) is verified per asset. Conservation information may change as new research becomes available.

6. Cookies and Device Storage

Bird-AR uses browser local storage and cookies to keep you signed in (Supabase Auth session), remember your chosen language and interface preferences, and cache small pieces of app state. No third-party advertising or cross-site tracking cookies are set. You can clear this storage at any time from your browser or iOS settings; doing so will sign you out and reset preferences.

7. How We Share Information

We disclose information only:

• To the service providers listed above, strictly to operate Bird-AR.
• At your direction (for example, when you send us an email).
• To protect users, Bird-AR, or others from fraud, abuse, or security incidents.
• When required by law or valid legal process.
• As part of a legitimate organizational transfer (for example, if the operator transfers the project), with continued protection of your information.

We do not sell your personal information. We do not use your personal information for third-party targeted advertising. We do not track you across apps or websites owned by other companies for advertising purposes.

8. Data Retention

• Account and profile information: retained until you delete your account.
• Favorites, learning progress, and test results: retained until you delete them individually or delete your account.
• Support emails: typically retained up to 24 months for reference.
• Server and security logs: retained for a limited period by our hosting and backend providers according to their standard operational practices.
• Backups: may temporarily retain deleted information for a short window before being overwritten.

9. Account Deletion

You can permanently delete your account inside Bird-AR: open the Profile tab, scroll to the “Danger Zone,” select Delete Account, and type DELETE to confirm. Our server function then removes rows in favorites, user_settings, learning_progress, profiles, study_sessions, study_attempts, mastered_birds, and daily_test_results that belong to you, and finally deletes your authentication record. Deletion is immediate and permanent; you will be signed out and cannot recover the account. Limited backup or legal records, if any, are retained only as described in the Retention section above. For deletion-related assistance, email matthewspersonalartstudio@gmail.com.

10. Security

We use reasonable administrative, technical, and organizational safeguards, including transport encryption (HTTPS), row-level security on user tables, hashed passwords via our authentication provider, and least-privilege access to production secrets. Although Bird-AR takes reasonable steps to protect information, no method of electronic storage or transmission is completely secure, and absolute security cannot be guaranteed.

11. Children’s Privacy

Bird-AR is a general-audience educational app and is not directed to children under 13. We do not knowingly collect personal information from children under 13 without appropriate authorization. If you believe a child has provided personal information to Bird-AR, contact us at matthewspersonalartstudio@gmail.com and we will take appropriate action.

12. International Users

Bird-AR is operated from the United States. Information may be processed in countries where our service providers operate. Regardless of where you are located, you may contact us about access, correction, deletion, or privacy questions at matthewspersonalartstudio@gmail.com.

13. Your Rights and Choices

• Review and edit your profile information in the Profile tab.
• Change your language and app preferences in the Profile tab.
• Remove favorites individually from any bird profile.
• Delete your account at any time under Profile → Danger Zone → Delete Account.
• Withdraw optional browser or iOS permissions through your device settings.
• Stop using the service.
• Contact us at matthewspersonalartstudio@gmail.com about your information.

See Privacy Choices for direct links to each option.

14. External Links

Bird-AR may link to external scientific, conservation, museum, media, and educational websites. We are not responsible for the privacy practices of independently operated external websites.

15. Changes to This Privacy Policy

We may update this Privacy Policy as Bird-AR evolves. Material changes will be communicated inside the app or on this page. The “Last Updated” date at the top of this policy shows when it was most recently revised.

16. Contact