TODO — have a qualified lawyer (ideally a GDPR specialist) review and finalise this document before launch. The text below is a placeholder scaffold only.
Last updated: 2026-09-06
CalmBird (“we”, “us”) is operated by Derpico, the registered sole trade of Alireza Sarinavaie, at calmbird.app. Registered address: Ladenburgstraße 3, 86150 Augsburg, Germany.
We are the data controller for personal data processed through CalmBird. We have not appointed a separate Data Protection Officer — the contact below reaches the controller directly. Questions: privacy@calmbird.app
We collect the minimum necessary to provide the service:
After account deletion we retain a salted one-way hash of your email address (SHA-256; plaintext is never stored) along with a boolean flag recording whether you used a free trial. This record cannot be used to identify you and is kept solely to prevent trial abuse on re-registration.
We do not sell your data. We do not use your data for advertising.
We use your data to:
Legal basis (GDPR): performance of contract (account, delivery, billing); legitimate interest (service improvement, security); consent (marketing emails, if any — you can withdraw at any time).
We share data with the following third parties as necessary to provide the service. All are bound by data processing agreements.
| Subprocessor | Purpose | Location |
|---|---|---|
| twitterapi.io | Fetching public X (Twitter) posts | US |
| Paddle | Merchant of record: payment processing, subscriptions, invoicing, sales tax | UK / EU |
| Telegram | Bot delivery channel — sends digests to your Telegram chat | UAE / distributed |
| ZeptoMail (Zoho) | Transactional email: verification, sign-in links and digest delivery | EU |
| DeepL | Auto-translate post text (opt-in, paid accounts) | DE (EU) |
| Anthropic / OpenAI | Topical classification of posts (paid-tracked accounts only) | US (EU transfer covered by SCCs) |
| Neon | PostgreSQL database hosting | EU region |
| Vercel | Web application hosting, edge functions, and cookieless web analytics and page-speed measurement (only once you accept analytics) | US / EU (configurable) |
| PostHog | Product analytics for signed-in accounts (only once you accept analytics) | EU (eu.i.posthog.com) |
| Sentry | Error monitoring and performance | US (EU transfer covered by SCCs) |
We retain your personal data for as long as your account is active. Delivered-post records are retained for 7 days then automatically purged (this window is admin-configurable and may change). Billing records are retained for 10 years to comply with German tax law (§147 AO).
When you delete your account via Settings → Profile, all personal data is deleted immediately. The one exception is a salted one-way hash of your email address (SHA-256) and a boolean flag indicating whether you used a free trial. This minimal record is retained indefinitely to prevent a single email address from claiming multiple free trials. It does not contain your email in any recoverable form and cannot be used to identify or contact you.
If you are in the European Economic Area (EEA) or UK, you have the following rights:
Account deletion is available directly in the app under Settings → Profile → Delete my account. All personal data is removed immediately upon confirmation.
To exercise other rights, or to request a data export, email privacy@calmbird.app with subject line “Data request — [your email]”. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
CalmBird is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
We will notify you of material changes by email or by a notice in the app at least 30 days before the change takes effect.
Data protection enquiries: privacy@calmbird.app
Derpico, the registered sole trade of Alireza Sarinavaie
Ladenburgstraße 3, 86150 Augsburg, Germany