TODO — have a qualified lawyer (ideally a GDPR specialist) review and finalise this document before launch. The text below is a placeholder scaffold only.
Last updated: 2026-06-18
CalmBird (“we”, “us”) operates the CalmBird service at calmbird.app. [TODO: add registered company name and address.]
We are the data controller for personal data processed through CalmBird. Questions: privacy@calmbird.app
We collect the minimum necessary to provide the service:
After account deletion we retain a salted one-way hash of your email address (SHA-256; plaintext is never stored) along with a boolean flag recording whether you used a free trial. This record cannot be used to identify you and is kept solely to prevent trial abuse on re-registration.
We do not sell your data. We do not use your data for advertising.
We use your data to:
Legal basis (GDPR): performance of contract (account, delivery, billing); legitimate interest (service improvement, security); consent (marketing emails, if any — you can withdraw at any time).
We share data with the following third parties as necessary to provide the service. All are bound by data processing agreements.
| Subprocessor | Purpose | Location |
|---|---|---|
| twitterapi.io | Fetching public X (Twitter) posts | US |
| Stripe | Payment processing, subscriptions, invoicing | US (EU transfer covered by SCCs) |
| Telegram | Bot delivery channel — sends digests to your Telegram chat | UAE / distributed |
| SendGrid (Twilio) | Transactional email — verification and digest delivery | US (EU transfer covered by SCCs) |
| DeepL | Auto-translate post text (opt-in, paid accounts) | DE (EU) |
| Anthropic / OpenAI | Topical classification of posts (paid-tracked accounts only) | US (EU transfer covered by SCCs) |
| Neon | PostgreSQL database hosting | AWS us-east-1 (TODO: confirm region) |
| Vercel | Web application hosting and edge functions | US / EU (configurable) |
| Sentry | Error monitoring and performance | US (EU transfer covered by SCCs) |
We retain your personal data for as long as your account is active. Delivered-post records are retained for [TODO: define period, e.g., 90 days] then automatically purged. Billing records are retained for [TODO: 7 years] to comply with tax law.
When you delete your account via Settings → Profile, all personal data is deleted immediately. The one exception is a salted one-way hash of your email address (SHA-256) and a boolean flag indicating whether you used a free trial. This minimal record is retained indefinitely to prevent a single email address from claiming multiple free trials. It does not contain your email in any recoverable form and cannot be used to identify or contact you.
If you are in the European Economic Area (EEA) or UK, you have the following rights:
Account deletion is available directly in the app under Settings → Profile → Delete my account. All personal data is removed immediately upon confirmation.
To exercise other rights, or to request a data export, email privacy@calmbird.app with subject line “Data request — [your email]”. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
CalmBird is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
We will notify you of material changes by email or by a notice in the app at least 30 days before the change takes effect.
Data protection enquiries: privacy@calmbird.app
[TODO: add DPO name and address if required.]