Privacy policy

This is a translation; the Polish version is binding.

PigeonTree helps you keep your pigeon loft records. Data is saved on your phone first and, when there is a connection, the app syncs it to a private area of the cloud that belongs to your loft. We show no external network ads, do not track you across apps and do not sell data. An auction you deliberately approve is public. Optional paid highlighting is labelled; a paid move up changes the listing order.

1. Who is responsible for your data

The controller is Krystian Chęciński, trading as a non-registered business under Polish law (działalność nierejestrowana), Polish tax ID (NIP): 8281426366, Targowa 17C/10, 99-200 Poddębice, Poland. For privacy matters, write to pigeontreeapp@gmail.com.

2. What data we process

• Loft records: ring numbers, pigeon names and traits, where a bird came from or went to (including from whom and for how much) if you enter it, pedigrees, pairs, clutches, events, tasks, races and training tosses with the liberation site (coordinates), distance and arrivals, notes, lists read from photos together with the recognised text, and the photos and PDF documents you add, with their file names.
• Photos: before a photo is saved we shrink it (longer side up to 3200 px), store it as JPEG and remove its metadata, location included; a copy reduced to 2000 px travels to the reading (section 6). The app refuses a photo the phone cannot process this way. PDF documents are stored unchanged, metadata included.
• Breeder profile (loft name, your name, address, phone, achievements, loft position) stays on your phone. It goes into the .pigeontree backups you save, the device's system backup and the pedigree PDFs you create, but not into our cloud as a breeder profile. This is separate from the auction contact and business details you explicitly save below. The app uses the loft position to work out flight distances, and those distances are saved with the flights.
• Account: when the cloud is available, the app creates a technical guest account with an identifier (UID) on its own. When you link a Google or Apple account, the sign-in provider passes on a profile identifier, your name and email address (with Apple this may be a hidden relay address); these stay in Firebase Authentication, not in the loft database. For a passkey, the server stores its public key, credential identifier, usage counter, device type and dates.
• Running the service: dates of changes and syncs, write receipts, storage and attempt counters, the Firebase installation identifier (configuration is fetched at every start), and an integrity check of the app and device (Play Integrity on Android, App Attest or DeviceCheck on iOS).
• Purchases: at every start the app asks RevenueCat about PigeonTree Plus, even if you never bought anything. RevenueCat receives the account identifier (UID) and the store's purchase data: product, transactions, period and entitlement status. The server keeps a copy of active entitlements (product and expiry date). The store handles payment; we never receive your card number.
• Auction contact and business profile: the email address and optional phone number with calling code that you enter in the auction profile are stored in the cloud with your account identifier. You can use the rest of the app without providing a phone number. Phone validation checks its format, not ownership; we do not verify it by SMS. A business seller also provides a business name, postal address and registration details. These are separate from the local breeder profile.
• Auctions: a separate public copy of the pigeon’s ring, name and traits, description, selected photos and pedigree pages, seller name, country and region, declared private or business status, verification label, currency, prices, bid count, dates, state and move-up or highlighting status. The business name, postal address, registration details and email address are public in business listings. We do not automatically include the phone-number field in the public listing. If the seller enables contact before the auction ends, signed-in users who are not blocked can obtain the seller’s name, email and optional phone number through the app. After an auction ends with a winner, only the seller and winning buyer can obtain each other’s contact through that auction, until that access is removed by account deletion. We do not publish the entire loft or breeder profile, UIDs, other bidders’ details or private automatic limits.
• Running auctions: association with an account, submitted and rejected requests, bid order, private limits, watched auctions, results, reports and moderation decisions, contact details, and move-up and highlighting purchase/use receipts, and paid ranking history needed to process refunds. Hashed ring identities and links to the seller’s own record protect listing order against relisting. We do not collect IP addresses or device fingerprints for this purpose.
• Auction searches: the search term and selected filters are sent to Firebase to retrieve matching listings. The app does not create a separate search-history record.
• Seller ratings: a private 1–5 score, the association of a winning account with an ended auction, and the seller’s aggregate score and count. Only the average and count become public after at least 5 ratings, without buyer identities or comments. These records provide the requested rating feature and prevent repeat votes. They are included in account export. Account deletion retracts that account’s votes and recalculates aggregates; it also removes ratings received by that account and their associations. Auction results and prices do not change.
• Auction notifications: an account inbox, preferences and private registration linking the current account to its installation identifier for notification delivery. FCM and APNs deliver a neutral event signal; private amounts, limits and contact details are not posted to open topics. Detail views may be counted once per linked account, excluding the seller. A private marker prevents repeat counting; only the total is shown, never a list of viewers.
• Contacting us: your email address and message. A message started in the app includes the app version, system version and language. Do not send passwords or sign-in codes.

You can use the app without giving your name or email address. "No sign-up" means you do not have to create an account, not that there is no technical identifier or sync.

3. Why we use data

• Keeping your records, syncing, file backup, sign-in, PigeonTree Plus, requested auction publication, bids, authorised contact and purchased moves up or highlighting: performing the contract you ask for (Art. 6(1)(b) GDPR).
• Security, abuse prevention (including the integrity check and attempt limits) and investigating technical problems: our legitimate interest in protecting the service and your data. This includes records against ranking manipulation or transaction replay, and a limited auction-interest counter without device tracking (Art. 6(1)(f) GDPR).
• Optional usage statistics and crash reports: your consent (Art. 6(1)(a) GDPR).
• Handling requests, complaints and claims: the contract, legal obligations or legitimate interest, depending on the case (Art. 6(1)(b), (c) or (f) GDPR).

We do not build advertising profiles from loft records. The auction system accepts bids and determines price, order, soft close and result under disclosed rules and participants’ instructions, not an assessment of their character or trustworthiness. You can request an explanation, challenge an incorrect result or restriction, and seek human reconsideration through our contact address. Photo reading only helps transcription; you always review the result.

4. Crash reports and diagnostic statistics are optional

On the More tab you can switch "Crash reports and usage statistics" on or off. It is off by default, and saying no blocks nothing.

When it is on, Google Analytics for Firebase collects selected events (for example a saved record or a finished sync) with counts given as ranges, and Firebase Crashlytics collects crash information, error codes, screen and operation names, app and system versions, language and the installation identifier. Events and reports contain no ring numbers, notes, photos, file names or account details. We do not collect the advertising ID.

Switching it off stops further collection. Withdrawing consent does not affect processing that happened before.

This switch controls Analytics and Crashlytics diagnostics. It does not disable records needed to operate the account and auctions, notification preferences or the single-viewer marker described above. Their purposes and legal bases are separate; you can raise an objection through our contact address.

5. Location, map and time

We read the device's location only when you choose "Use my position" while setting the loft position or a liberation site: one reading, never in the background. We save only the coordinates you confirm.

Place search and place names for a chosen point come from the system's geocoding service (Google on Android, Apple on iOS), which receives the text you typed or the coordinates.

The map uses OpenStreetMap tiles from the OpenStreetMap Foundation's servers. Those servers see your IP address and the part of the map you view, including the area around the loft position the map opens on. If needed, we may switch the map to another tile provider; it will then be named under the map.

So that arrival and change times do not depend on the phone's clock, Android uses Google Play's TrustedTime service and iOS queries the public pool.ntp.org time servers, which see your IP address.

Optional auction-price estimates use a public international exchange-rate table from Frankfurter. The app fetches the same USD-based table; the request contains no UID, ring, amount, bid, limit, selected currency or contact details. The provider may see normal connection information, including the IP address. We cache the dated table and its source locally on the device, outside portable loft backups. The calculation is indicative and does not change the auction currency or bid amount.

6. Photos, passkeys and permissions

A photographed spis is read by a model on our server: when you start a reading, the app sends a reduced copy of the photo (long edge up to 2000 px) or the PDF you picked to our Cloud Function in the europe-west1 region, which passes it to a Gemini model on Google Vertex AI to transcribe the numbers. The photo serves that one reading only: our server does not store it, its logs keep only the reading time and the number of tokens processed, and Google does not use data sent through Vertex AI to train its models; it may keep it briefly for abuse monitoring under its own terms. The model behind this feature runs in Google's global location, so the photo may be processed outside the EEA (section 7). Without an internet connection the reading does not work; you can type the numbers instead. No other photos and no loft records go to the model — only the file you choose to read. Pedigrees and printouts you import from other programs are read the same way: the app renders each PDF page on the phone, reduces a photograph (long edge up to 2000 px, with the EXIF fields dropped, so without the coordinates of where you took it) and sends the pages one at a time to the same Cloud Function and the same model, which answers with the ring numbers, parents, sex, colour and names printed on that page. The pages are not stored by us, and without an internet connection importing a photo or a PDF does not work. Table files are read on the phone first, row by row. Files the phone can read itself also work without a connection. If local reading of a separately selected Excel file (XLS or XLSX) or CSV/TSV fails or finds no usable pigeons, the app may send the entire selected file, up to 2 MiB, to the same Cloud Function for recovery. The server extracts cell values with a spreadsheet reader without running macros or formulas. The model helps interpret the extracted cells or limited text portions. The app shows the recovered data for review and correction before you explicitly save it. A file exceeding the recovery limits may remain unreadable or yield an explicitly incomplete result. We do not store the uploaded file or its extracted contents. When there is a connection, the app sends the column names, what the file wrote above the table and six rows of the table to the same Cloud Function and the same model, which answers with what each column holds; that is how the app recognises columns in languages and layouts it does not know itself. Values in columns the app itself recognises as a breeder's name or a loft's coordinates are replaced with “…” before sending. A short text file that is not a table (a list of birds typed by hand, for example) is sent whole, because there is nothing in it the phone can read. We do not store this data either. Nothing is sent from files found inside an archive (a ZIP, a backup).

The camera, the photos and files you pick, notifications (local reminders and optional auction messages through FCM/APNs) and location are used only when you use the feature that needs them. You can refuse any permission in the system settings; everything else keeps working. We do not read your contacts or messages.

Passkeys are handled by your device or password manager. We never receive your fingerprint, face scan, screen lock code or private key. Signing in with Google or Apple never gives us the password to those accounts.

Auction materials have a separate public review. The server decodes and re-encodes public images to remove metadata; the original private PDF is not published as a hidden text layer. This does not remove information visible in the image itself. Check names, addresses, stamps and phone numbers on every page before publishing. Recipients may save or share public material.

7. Providers and where data is processed

• Cloudflare (processes data on our behalf): hosting and protection of pigeontree.net and its authentication routes. It processes requested URLs, IP addresses and connection/security information to deliver pages, cache content and protect the service. This does not add advertising trackers to the website.
• Google Firebase (processes data on our behalf): loft and auction databases, files and Cloud Functions in europe-west1 (Belgium), FCM notification delivery, plus sign-in, access protection, app configuration and, with consent, diagnostics. Firebase Authentication and some services run globally, including in the United States.
• Google Cloud Vertex AI (processes data on our behalf): reading a photographed spis, and reading the pedigrees and printouts you import, with a Gemini model; the model behind this feature runs in Google's global location, including the United States. It receives only what you choose to have read: the photo or PDF of the sheet, the pages of an imported document, and from an imported table the column names and six rows, a short text that is not a table, or extracted cells and text portions from a separately selected Excel/CSV/TSV file when local reading fails (section 6).
• RevenueCat (United States, processes data on our behalf): purchase and entitlement status. It never receives your loft records.
• Google Play and Apple: stores, payments, accounts and system services (geocoding, TrustedTime, integrity checks) under their own terms.
• OpenStreetMap Foundation (map tiles) and pool.ntp.org (time on iOS) receive your IP address and the data described in section 5.
• Apple APNs participates in delivering notifications to Apple devices.
• Frankfurter supplies the public blended table used for indicative currency estimates. The request scope is described in section 5. Its documentation and privacy information state that the public service uses Cloudflare for caching and traffic protection, while the API does not retain IP addresses or request URLs.
• Auction recipients and authorised parties: the public snapshot is available to other users and people opening a shared listing as supported by the app. Contact details are available to authorised parties or signed-in recipients after deliberate sharing. They communicate independently outside the platform. Each party can separately approve the public pigeon information for their own private loft without gaining access to anyone else’s records.
• Our email provider handles messages to us.

Transfers outside the European Economic Area rely on the mechanisms of the GDPR, such as an adequacy decision or standard contractual clauses. We will send details of the safeguards on request.

More: Firebase privacy, RevenueCat data processing agreement, OpenStreetMap Foundation privacy policy, Google privacy policy, Apple privacy policy.

8. How long we keep data

• Loft records stay in the cloud until you delete them. A deleted record leaves a deletion marker (identifier, kind and dates, no content) and write receipts, so a phone that was offline for a long time cannot bring an old record back. These stay until the account is deleted.
• Files in the cloud are erased 7 days after their record is deleted, and a race-list photo replaced by a newer one after 30 days. On the phone, files stay until the account is deleted.
• A guest account unused for 24 months and without active Plus is deleted together with its cloud data.
• After account deletion we erase the cloud records and files, passkeys, the RevenueCat customer and the sign-in account. What remains: a marker of the deleted account (UID and date), the deletion request record (UID, status and dates, no loft data) that lets the app check its progress, and, for up to 90 days, RevenueCat purchase notifications naming the account identifier.
• Auction activity: there is currently no configured automatic expiry for ended public listings, auction inbox messages or notification-delivery records. A private single-viewer marker linked to your account stays until account deletion; the aggregate counter does not identify viewers. Material already shared with others does not disappear from their own copies.
• Auctions after account deletion: unfinished auctions owned by the account, and active auctions where it is the leading bidder, are cancelled; its own listings are hidden. We delete the account’s private contact profile, viewing markers, notification registration and ratings, remove private email/phone contact copies and disable contact access through the auction. Selected direct account links in retained bid, report, audit and promotion records are replaced with technical hashes. Necessary identifiers can remain in restricted evidence records, including accounts referenced in moderation decisions. Ended results and prices are not rewritten. Originally published business name, postal address, registration details and email can remain in a restricted, non-public listing archive. Bid/moderation evidence, promotion transaction records and technical registers that prevent duplicate purchase grants or ranking resets also remain. No automatic expiry is currently set for these retained archives and registers. We review erasure requests and objections against the need to protect the service, meet legal obligations and handle claims; hashing alone does not remove personal-data protection. See the deletion page for the full scope.
• Data exports prepared on the server at your request is erased 14 days after it is ready.
• Crashlytics reports are kept by the provider for 90 days, Analytics statistics according to the Google Analytics retention setting, and sign-in data may remain in Google's backups for up to 180 days after deletion.
• Messages to us are kept until the matter is settled, and after that only as needed for legal obligations or defending claims. The stores keep the sales records.
• An Android system backup contains the loft database with the breeder profile, and an iOS backup contains the app's data; Google or Apple keep them according to your settings. Files you export from the app stay wherever you save them.

9. Your rights

You have the right to access, rectify and erase your data, to restrict its processing and to data portability, the right to object to processing based on legitimate interest, and the right to withdraw consent to statistics and crash reports. You can save a copy of your loft in the app (a .pigeontree or CSV file); for a copy of your cloud data, write to pigeontreeapp@gmail.com. We may ask for information needed to confirm the data is yours.

You may lodge a complaint with the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stanisława Moniuszki 1A, 00-014 Warszawa), or with the authority in your country.

Recording a pigeon as purchased or sold is a separate decision of each loft owner. It does not certify receipt of payment or the bird and does not require the other party’s approval in the app. Deleting your account does not delete the other party’s lawfully retained records, private notes or copies outside the platform.

10. Deleting your account

In the app, open More using the profile icon beside search (or the More tab in older versions), open the account card at the top, then choose Delete account and data. Details, and how to ask without the app: deleting your account and data. Deleting the account does not cancel a store subscription.

11. This website

The website uses its own scripts for menus, appearance and interface animations, with fonts served from the same site. Its appearance preference (system, light or dark) is stored locally in your browser and can be changed in the appearance menu; it is not an advertising identifier. Language is selected by the page address and language menu, not automatically by Firebase Hosting. We do not add advertising cookies, external advertising trackers or third-party analytics to these pages. Cloudflare processes connection data, including requested URLs and IP addresses, and technical security logs to deliver and protect the website.

12. Changes

When we change how we process data, we will update this page and its date, and tell you about significant changes in the app.