Privacy Policy

Birdpath ("we", "us") respects and protects user privacy. This policy explains what data we collect, how we use it, and your rights. It applies to all services provided through https://www.birdpath.info.

1. Data We Collect

1.1 Account information

• Email address (used for sign-in, email verification, and important notices)
• Display name (shown on the leaderboard and your profile)
• Password (stored as a salted hash — we never see the plaintext)
• Avatar (optional, only if you upload one)

1.2 Third-party sign-in (optional)

When you sign in with GitHub or Google, we receive your public profile (name, email, avatar URL) from that provider to create your account. We don't get your password and don't act on your behalf.

1.3 Identification records

• Bird photos you choose to upload
• AI identification results (species name, scientific name, confidence, habitat, etc.)
• Identification timestamp

1.4 Technical data (collected automatically)

• IP address, User-Agent (anti-abuse + debugging only)
• Vercel Analytics anonymous traffic data (cookieless, not tied to individuals)

1.5 We do NOT collect

• We don't access your photo library unless you upload
• We don't collect location unless you upload photos with EXIF GPS
• We don't track you on other websites
• We don't sell or share data with ad networks

2. How We Use Data

• To provide AI bird identification
• To personalize your experience (Pokédex unlocks, leaderboard, history)
• To improve the product (aggregate stats only, never per-user)
• For critical communications (account security, major policy changes)

3. Third-Party Services

We use the following processors to deliver the service:

4. Data Retention

• Account info: retained for the lifetime of your account
• Identification records: retained for the lifetime of your account (last 50 shown in History)
• Deleted accounts: all related data is removed immediately (cascade delete across session, account, identifications). No backups retained.
• Vercel Analytics anonymous traffic: retained by Vercel per their policy (typically 30 days)

5. Your Rights

Under GDPR, China's PIPL, and similar regulations you have the following rights, all self-serve while signed in:

• Access: view your profile at /profile
• Rectify: edit name and avatar at /profile
• Export: at /profile, click "Export my data" to download a JSON copy of everything we have on you
• Erasure: at /profile, click "Delete account" to immediately and permanently delete your account and all related data
• Object: simply stop using the service

6. Cookies

• We only use essential cookies (Better-Auth session cookie) to keep you signed in
• No tracking cookies, no advertising cookies, no third-party cookies
• Vercel Analytics is fully cookieless

7. Children's Privacy

Birdpath is not directed at children under 14. If you are under 14, please use this service with a parent or guardian; the guardian should register the account on your behalf. We will promptly delete any information we discover was collected from a child under 14 without parental consent.

8. International Data Transfers

Account and identification data is primarily stored in Singapore (Neon, Supabase). AI inference runs in Mainland China (DashScope). Email delivery runs from Tokyo (Resend). Hosting is provided by Vercel's global edge network. By using the service you consent to these cross-border transfers.

9. Contact

For any privacy questions, requests, or complaints, email fankevin26@gmail.com. We aim to respond within 30 days.

10. Changes to This Policy

This policy may be revised as the service evolves. Substantive changes will be announced to all registered users by email. The current version is always available at /privacy, with the effective date shown at the top.