Skip to content

Privacy Policy

Last updated: October 13, 2026

1. Who We Are

Fledge is a product of Madera Studios LLC, an Arizona limited liability company (“we”, “us”, or “our”). We are the controller of the personal information described in this policy. This policy covers the Fledge iOS app and fledgebird.com.

2. Information We Collect and Use

  • Account information: Email address, name provided through your sign-in provider, and account identifiers. Fledge authenticates you through Clerk. An eBird username is never a password or a way to sign in. We use account information to provide access and support.
  • Birding content: Observations you import from your own eBird export include species, dates, places, and coordinates. The CSV is parsed in the iOS app, which posts the parsed observations to our import API, a Supabase Edge Function (earlier app versions post to fledgebird.com/api/import, hosted on Vercel). The API authenticates with Clerk and writes the observations to Supabase for account-scoped storage, life-list analysis, and personalized birding features. Birds marked as seen also sync species names to your account. Importing does not submit sightings to eBird.
  • Precise location: With device permission, your location while using the app can be sent to Supabase to find nearby birds and locations. Imported observation coordinates and places you choose also support maps and personalized results. Location permission can be changed in iOS Settings; disabling it does not delete locations already imported. Location is not a structured analytics field.
  • Purchases: Account-linked product, purchase, trial, and subscription information lets us provide paid access and understand subscription activity. Apple handles payment details; we do not collect payment card numbers or billing addresses in Fledge.
  • Usage and diagnostics: Feature interactions, screens, import counts, family progress, permission results, app version, device and operating-system information help us improve Fledge. Crash and error reports and diagnostic breadcrumbs help us find errors.
  • Feedback and correspondence: We receive information you send us for support. In-app feedback sends your verbatim free-text response to PostHog, linked to your account, for product improvement. It may contain personal information; please avoid passwords, payment details, and private location information.

3. Service Providers and Data Sources

These third-party service providers and subprocessors handle information to operate Fledge. Data sources are identified separately where they supply reference data or your own export.

  • Clerk: authentication and session management using email, name, account identifiers, and sign-in/session information. Clerk also processes website requests and may set strictly necessary session and security cookies.
  • Supabase: database and backend hosting for account records, imported observations and coordinates, synced species, and subscription records; location requests support personalized results. The import API, the Clerk and RevenueCat webhooks, and scheduled jobs run as Supabase Edge Functions.
  • RevenueCat: purchase and entitlement management using your Fledge account ID, App Store purchase records, products, trial status, and entitlements. Apple bills purchases; there is no web checkout.
  • PostHog: product analytics using usage events, purchase and subscription activity, account or anonymous identifiers, device/app metadata, and feedback text. Account email and name are not automatically copied into PostHog. PostHog also receives crash and error reports, linked to your account or anonymous identifier and used for app functionality and analytics, as described below.
  • Vercel: website hosting processes web requests. While we move the remaining server routes to Supabase, Vercel also processes account-linked data for the import API used by earlier app versions and for the RevenueCat webhook, including imported observations, account details, and subscription events. Vercel Analytics and Speed Insights measure page views and web performance without linking them to a Fledge account.
  • Apple: App Store billing processes purchases under your Apple Account. WeatherKit receives coordinates for weather requests made directly on-device. MapKit provides maps and place search using map areas and search requests. Apple operates these services under its own terms and privacy policy.
  • eBird / Cornell Lab of Ornithology: you supply your own eBird export for import. Cornell is the source of that data, not our account or analytics processor. We also use the GBIF-hosted eBird Observation Dataset for reference information.
  • Other reference sources: AviList supplies taxonomy and IUCN supplies conservation status. Reference data does not establish that land is open to visitors.
  • Location-based lookups: OpenStreetMap's Overpass API and the U.S. Fish & Wildlife Service refuge service (Esri-hosted) receive device coordinates for nearby places. The GBIF API receives a bounding box around your location for nearby bird records. NOAA Tides & Currents receives the selected station ID and dates for tide requests, not your device coordinates or observation history. These lookups are sent in real time on your behalf when fresh data is needed. Nearby lookups may cache results server-side, keyed by an approximate area. Stored coordinates are rounded to about 1 km; exact device coordinates are never stored in these caches. The caches are accessible only to Fledge's servers, not to other users. Cached entries are deleted automatically within about three days, by a daily cleanup of entries older than 48 hours.

Providers the app connects to, including Clerk, Supabase, RevenueCat, and Vercel, necessarily receive the device's IP address when it connects; Fledge's analytics provider PostHog discards IP addresses.

We may also disclose information where necessary to comply with law, protect rights or security, obtain professional advice, or transfer the business, subject to applicable privacy protections. Content you choose to share outside Fledge can be retained by its recipients.

4. Analytics, Local Storage, and Privacy Choices

In the iOS app, PostHog uses an anonymous identifier before sign-in and your stable Fledge account ID after sign-in. Earlier anonymous activity history may be associated with your account. Subsequent analytics events are account-linked. Analyzing events in aggregate does not make the underlying events de-identified. The public website uses a persistent anonymous id in local storage instead of cookies for PostHog analytics, with page, referrer, campaign, and interaction metadata. Clerk may set strictly necessary cookies for website sessions and security. There is no signed-in account flow on the website in a browser; the iOS app uses the authenticated web API described above.

Coarse location is not collected by the iOS app. PostHog discards IP addresses with IP discarding enabled on September 27, 2026. Events and profiles created before September 27, 2026 may retain previously derived approximate location. This change does not remove precise locations used for app features or imported observations.

PostHog collects crash and error reports from the iOS app and the website, with device/app context. App and website reports are linked to your account or anonymous identifier and are used for app functionality and analytics. Errors in the website's server routes are reported with the error type, route, and request method, without request bodies or your identity. Error and crash reports contain the error type, its code (for handled errors in the iOS app, the error's domain, code, and the feature it came from), and the location in Fledge's own code where it happened, as module and function names. They do not contain error message text or file paths. PostHog session recording is disabled. Known coordinate parameters in URLs are redacted before sending. Fledge 1.0 for iOS sends crash and error reports to Sentry instead of PostHog, and those reports may include error message text and file paths.

The website honors Global Privacy Control (GPC) and Do Not Track (DNT). When either signal is enabled at page load, PostHog does not load, so website analytics and browser error reports are not sent; Vercel Analytics and Speed Insights are also disabled. Errors in the website's server routes are still reported as described above. Vercel analytics tools do not use cookies. Clerk may still set strictly necessary session and security cookies. You can clear website cookies and local storage using browser settings. These browser controls do not change native iOS analytics; contact us to exercise your privacy rights for app data.

We do not sell or share personal information for cross-context behavioral advertising, as those terms are defined by California law. We do not use advertising SDKs, advertising identifiers, or cross-company ad tracking, or provide personal information to data brokers. Disclosures to the providers above are for the service purposes described in this policy.

5. Data Retention and Account Deletion

We keep account records and imported birding data while your account is active to provide the service. In the app, Settings → Delete Account deletes your Fledge account and associated data from our application database and initiates removal of linked sign-in records. Contact us if deletion reports a problem. Deleting your account does not cancel an Apple subscription.

Account deletion does not automatically erase historical analytics or purchase records held by service providers. Retention of analytics, crash and error reports, and hosting logs depends on each provider's settings and service terms; we do not specify a fixed period where one has not been established. PostHog recording is disabled, so a recording-retention setting is not a retention limit for product analytics events.

We retain information as needed for the purposes above, including resolving support requests, maintaining purchase entitlements, security, legal obligations, and resolving disputes. Backup copies may remain until the provider's backup cycle expires. The appropriate period depends on the type and sensitivity of the information, its purpose, and applicable legal requirements. Email us for a deletion request covering provider-held records or information about retention for a particular category.

6. EU and UK Rights and Legal Bases (GDPR / UK GDPR)

  • Contract: account information, imported content, and purchase records are used to provide the features and paid access you request.
  • Legitimate interests: we use diagnostic and usage information to secure, maintain, and improve Fledge, and correspondence to respond to requests, where those interests are not overridden by your rights.
  • Consent: device location access requires your permission. Where applicable law requires consent for optional analytics or access to device storage, that consent is required; legitimate interests do not replace it.
  • Legal obligations: we process information as necessary to meet applicable legal requirements and respond to lawful requests.

Subject to applicable law, you may request access, correction, deletion, and portability of your information; restrict processing; object to processing based on legitimate interests; and withdraw consent without affecting processing that was lawful before withdrawal. You may complain to your local supervisory authority or the UK Information Commissioner's Office. Birding personalization does not make decisions with legal or similarly significant effects on you.

Send requests to support@fledgebird.com. We may ask for information needed to verify your identity and understand your request. We respond within applicable legal deadlines and explain any lawful exception. Access, export, and correction requests are handled by email; this policy does not imply a self-service export or account-editing tool.

7. US State Privacy Rights (California CCPA / CPRA)

Where applicable state law grants these rights, you may ask to know the categories, sources, purposes, and recipients of your personal information; access a copy; request correction or deletion; and obtain portable information. You may also have rights to opt out of sale, sharing, targeted advertising, or certain profiling, and to limit certain uses of sensitive personal information. We do not engage in those advertising or sale activities or profiling with legal or similarly significant effects. Precise location can be sensitive personal information; we use it for requested birding features, not to infer sensitive characteristics about you.

The information and provider sections above describe our collection and business-purpose disclosures: identifiers and contact information, commercial purchase information, location, user content, and internet/app activity and diagnostics. We receive these from you, your device, sign-in services, and purchase services. The retention section explains how long we keep them. We do not sell or share personal information within the meaning of CCPA/CPRA, including information about minors.

Email support@fledgebird.com to exercise rights or appeal a denied request where applicable. An authorized agent may submit a request; we may verify both your identity and the agent's authority. We will not discriminate against you for exercising privacy rights. We honor GPC as a valid opt-out signal, with the website controls described above, even though we do not sell or share information for advertising.

8. International Transfers

We operate in the United States. Our providers may process information in the United States and other countries with different privacy laws; PostHog uses its US service. Transfers subject to GDPR or UK GDPR require a lawful transfer mechanism, such as an applicable adequacy decision or approved standard contractual clauses with relevant UK provisions. Contact us for information about the locations and safeguards applicable to your data, or to request a copy of relevant safeguards. This policy does not treat use of Fledge as consent to a transfer.

9. Security

We use authenticated access, account-scoped database controls, and encrypted network connections to protect information. No online service can guarantee absolute security. Keep your sign-in credentials secure and contact us if you suspect unauthorized access.

10. Children's Privacy

Fledge is not directed to children under 13 and does not offer child accounts. We do not knowingly collect personal information from children under 13. The App Store's 4+ content rating is not permission for children to create an account. If you believe a child under 13 has supplied personal information, contact us so we can investigate and delete it as required.

11. Changes to This Policy

We will post updates here with a new last-updated date. For material changes, we will provide additional notice as required by law and obtain consent where required. An updated policy does not itself change your consent choices.

12. Contact

Contact Madera Studios LLC about privacy or your information at support@fledgebird.com.