Privacy policy

Lilbird is run by [company name], [registered address], Lithuania.

We are the controller of your personal data. Questions or requests: privacy@lilbird.app.

What we collect

• Your account: the identifier Apple or Google gives us, your email if you share it, your name, your Lilbird link (handle) and time zone.
• Your age: we check your birthday (or Apple's age range) to confirm you're 18 or older. We keep only the result, never the birthday.
• Notes: notes you write and who wrote them (until that link is erased, see below), notes on your wall, guesses, pins and reveals.
• Safety: reports, blocks, and our decisions.
• Devices: in the app, a push notification token, an install identifier and an Apple DeviceCheck token (used to keep banned devices out).
• Connection data: your IP address, used to limit abuse. Our server logs keep it for 14 days.

Why we use it

• To run Lilbird for you (our contract with you).
• To keep people safe and stop abuse (our legitimate interest, and our duties under the EU Digital Services Act).
• To meet legal obligations.

Anonymity, and how long we keep things

• The link between a note and its writer is erased 30 days after the wall opens. After that, nobody can connect the note to its writer, including us and the writer.
• A reported note keeps that link until the report is closed.
• Notes that never open are deleted 60 days after they were written.
• When you delete your account, it's hidden at once and erased after 30 days. Your unopened notes are deleted; opened notes stay on their walls with nothing linking them to you.

Requests to identify a writer

We don't tell anyone who wrote a note. Under GDPR Art. 15(4), a request for your own data doesn't extend to someone else's identity. We disclose a writer only under a binding order from a court or authority, and after the 30-day erase, we can't.

Who processes data for us

• DigitalOcean: servers and database (United States).
• Vercel: this website.
• Anthropic: checks note text for safety. Under its commercial terms, it doesn't use that text to train its models.
• Apple and Google: sign-in. Apple also delivers notifications.
• Resend: email to our safety team and to writers about decisions.

Data sent outside the EU is protected by the European Commission's standard contractual clauses or an adequacy decision. We don't sell personal data or show ads.

Cookies

This website sets only the cookies it needs: one that keeps you signed in, and a short-lived one that protects sign-in. There are no advertising or tracking cookies.

Your rights

You can ask to access, correct, delete or export your data, or object to how we use it, by writing to privacy@lilbird.app. You can delete your account yourself at any time. You can also complain to a data protection authority, such as Lithuania's State Data Protection Inspectorate.

Age

Lilbird is for people 18 and over. If we learn an account belongs to someone younger, we delete it.

Changes

We'll post changes here and tell you in the app before they take effect.