Privacy Policy

Chickadee Bandit is developed and operated by Firebird Systems LLC ("Firebird Systems", "we", "us"), the developer of record on Google Play and the Apple App Store. This policy applies to the website at chickadeebandit.com and to every mobile app we publish:

• Chickadee Bandit — net.firebirdsystems.chickadeebandit.app;
• Chickadee Locate — net.firebirdsystems.chickadeebandit.locate;
• Chickadee Quiet — net.firebirdsystems.chickadeebandit.quiettime;
• Chickadee Garden — net.firebirdsystems.chickadeebandit.garden.

Firebird Systems LLC is the data controller for the personal information described below. Contact: support@chickadeebandit.com.

Chickadee Bandit is a private space for your household. Your household's content belongs to your household: we encrypt it at rest, we don't sell it, we don't use it for advertising, and we don't use it to train AI models. We collect only what we need to run the service, and you can export or delete everything at any time.

Account information. Your name, email address, and password (stored as a salted hash — we never see your password). Optionally, two-factor and passkey credentials you enroll.

Household content. Whatever your household puts into its apps — lists, notes, events, photos, documents, messages. Some apps let you record sensitive information (for example health details, medications, or a child's growth) — that content gets the same encrypted-at-rest treatment as everything else, and it is only visible to the household members its sharing rules allow.

Location. We access and collect precise and approximate location from mobile devices, including in the background in the Chickadee Locate app. See Location data below for exactly what is collected, when, and why.

Device information. A per-device identifier we generate (not an advertising ID), the push notification token issued by Apple or Google, and battery level from devices that report location. We do not collect advertising identifiers and we do not use your data for advertising.

Billing. Payments are processed by Lemon Squeezy as merchant of record; we receive subscription status but never your full card details.

Technical data. Basic logs (IP address, browser type) for security and debugging, and aggregate performance analytics via Cloudflare Browser Insights.

Product analytics. We use PostHog to understand which pages and features are used and to run occasional in-app surveys. We send it page views, the feature-level events we define (for example "setup completed" or "feedback requested"), the app version, and, once you are signed in, your account id and whether you are a household admin. We never send your email, your household's content, page text, or the links you click, and we do not record your screen. PostHog stores nothing in your browser on our behalf — no cookies and no local storage — so an unsigned-in visitor is not tracked across visits. We do not use third-party advertising or cross-site tracking cookies.

What we collect. Precise location (latitude, longitude, and an accuracy radius) and approximate location (a coarse place name such as street, city, and region, derived on the device from the coordinates). Alongside a location report we also collect the device's battery level and charging state, and the safe-zone entry and exit events the device detects.

Which apps, and whether it runs in the background.

• Chickadee Locate collects location in the background, including when the app is closed or not in use. This is the app's core purpose: it keeps the family map current without anyone having to open the app, and it detects arrivals at and departures from the safe zones a household admin has drawn. On Android this uses the ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, and ACCESS_BACKGROUND_LOCATION permissions and a location foreground service; on iOS it uses "Always" location access. Location is reported roughly every 15 minutes while tracking is on, plus whenever a safe-zone boundary is crossed. A member who chooses places only sends no periodic position at all: only the safe-zone crossings are reported, and the position attached to a crossing is used to confirm it and then discarded, never stored.
• Chickadee Bandit (the main app) collects location only while the app is open and only when a member taps to share their current location. It does not request or use background location.
• Chickadee Quiet and Chickadee Garden do not collect location at all.

How we use it. Solely to provide features the household has turned on: showing members' current position on that household's private family map; sending arrival and departure alerts for safe zones; low-battery alerts and estimated time of arrival home; and, if a member raises an SOS, attaching their position to that alert so the household can find them. We do not use location for advertising or profiling, we do not sell or share it with data brokers, and we do not use it to train AI models.

Who it is shared with. Location is visible only to members of that member's own household, subject to the household's settings and, in a shared space, to that space's participation rules. It is transmitted over TLS to our servers, which run on Cloudflare (see Service providers below). No other third party receives it, with one exception: if an adult in the household connects an AI assistant to their own account, that assistant can read the locations that adult is able to see (see AI features below).

Retention. Stored location fixes are automatically deleted after 7 days — we keep current position as operational state, not a location history. A fix shared during a temporary share is deleted once the share ends, and switching to places only or off deletes your stored fix immediately. Safe-zone crossing events and SOS alerts are retained under the household's own retention settings.

Your control. Location sharing is off until someone turns it on. Each member chooses how they appear on the family map — live, places only (shown only while at a safe zone, pinned to the place), or off — and only that member can change it. You can stop tracking at any time from within Chickadee Locate, or revoke location permission in your device's system settings; either one stops collection. A household admin can also turn collection off for the whole household, which purges the stored fixes, the device registry, and safe-zone presence history. Deleting your account deletes your location data.

Children. A parent or guardian who administers the household sets up and controls tracking for a child's device. Children cannot enable it on their own.

Household app data is encrypted at rest with a per-household key, in addition to the provider's disk-level encryption, and all traffic uses TLS. Access within a household is governed by the sharing rules of each app — for example, a private journal entry is readable only by its author.

This is not end-to-end encryption. The service holds the keys, because it must decrypt your data to show it to the people your household shares it with, send reminders, and run the apps, so the few people who operate the service could technically access it. Our support tools show household members' names, email addresses and roles, billing status, and installed apps; they do not show messages, files, locations, or app content. We do not access your household's content except when you ask us to while we help you, to investigate abuse or a security problem, or when the law requires it.

Your content is visible to the household members, space participants, and guests that your household's admins invite, according to each app's sharing rules. If you create a share link, anyone with that link can see what the link exposes, subject to the password, expiry, and usage limits you set.

Children's accounts are created and managed by a parent or guardian in the household. Admins control what children can access.

Bringing your calendars in. A member can connect an Apple, Google, or Outlook calendar, or a private calendar link, so its events appear alongside the household's own. To do that we store what the connection needs to sign in — an app-specific password, an access token, or the link itself — encrypted, and we use it only to read that calendar, unless you also turn on sending as described below. The events we read are stored with your household like the rest of its content and are visible to its members; guests do not see them. Disconnecting a calendar deletes the stored sign-in details and the events we imported from it.

Sending household events out. A member can also choose to have the household events they are able to see copied into a calendar in their own Apple, Google or Microsoft (Outlook) account. This is off until that member turns it on, and only the member who connected the calendar can turn it on — not an admin on their behalf. We create one calendar there, named "Chickadee Bandit", and write only to it; we never change or delete anything in your other calendars. A copy reflects what that member can see: an event that is private to someone else is not sent, and an event that is later deleted or made private is removed from the copy, normally within the hour.

Once an event has been copied into your calendar account it is also held by that account's provider — Apple for an iCloud calendar, Google for a Google one, Microsoft for an Outlook one — under the terms you have with them, and it is visible wherever that account is, including any device or person you share that calendar with. We do not control what happens to it there.

Taking the copies back. We remove the "Chickadee Bandit" calendar, and the copies in it, when you turn this off, disconnect the calendar, leave or are removed from the household, or ask for the household or your account to be deleted. If a subscription lapses, sending stops at once and the calendar is removed 7 days later unless the subscription is renewed. Removing it needs your calendar account to still accept the sign-in details we hold; if it does not — for example after you change an app-specific password — we cannot reach it, we tell you so where we can, and you can delete the calendar yourself in your calendar app.

This section describes how Chickadee Bandit accesses, uses, stores, protects and shares Google user data when a member connects a Google account. It adds detail to Connected calendars above and does not replace it.

Google user data we access. Connecting a Google account asks for one permission: to read your Google calendars and the events in them. If you later turn on sending household events out, we ask for a second: to create calendars in your account and to change only the calendars we created. We do not ask for, and cannot reach, Gmail, contacts, Drive, or any other Google data, and we cannot change or delete events in calendars we did not create.

Google user data we collect and store. We read the list of calendars in the connected account and the events in them, from about two weeks back to about two months ahead. For each event we keep its title, start and end time, whether it lasts all day, its location, its description, and the name of the calendar it came from. We do not keep its guest list or attachments. We also keep the access and refresh tokens Google issues, which are what let us keep the calendar up to date. All of this is stored with your household's other content, on Cloudflare.

How we use Google user data. Only to provide the calendar features you can see: showing those events to your household alongside its own, in the calendar, agenda and search, and to the apps your household has installed; counting them in the weekly summary notification; and, if you turned sending on, writing your household's events into the "Chickadee Bandit" calendar we created in your Google account. Events we read from Google are never copied into anyone else's calendar account or into the calendar links we publish.

How we protect Google user data. The tokens, and each event's title, location, description and calendar name, are encrypted with a key that belongs to your household alone before they are stored, in addition to the provider's disk-level encryption. Everything travels over TLS, both between you and us and between us and Google. The tokens are never shown to anyone, including other members and admins of your household; they are used only by our servers to reach your calendar.

How we share, transfer or disclose Google user data. Members of your household can see the events; guests cannot. We do not sell Google user data, and we do not provide it to data brokers or information resellers. We do not use it for advertising, including targeted or personalized advertising, to determine credit-worthiness, or for lending purposes. We do not use it to develop, improve or train AI or machine-learning models. We do not transfer or disclose it to anyone else, with two exceptions: the service providers listed below, only as needed to run this feature, and an AI assistant that a member of your household has chosen to connect to their own account, which can read the household calendar that member is able to see (see AI features below).

Retention and deletion of Google user data. We keep it only while the calendar stays connected, and each refresh replaces what we hold: an event you delete in Google, or one that has passed out of the period we read, is removed from our copy. Disconnecting the calendar deletes the stored tokens and every event we read from it, and so does leaving or being removed from the household. Deleting your account or your household removes it as described under Retention and deletion below. You can also withdraw our access at any time from the third-party access page of your Google Account, after which we can read nothing further; the events already read stay until you disconnect the calendar here. You can also ask us to delete it by writing to support@chickadeebandit.com.

Changes. If we change how we access, use, store or share Google user data, we will update this policy and notify you by email or an in-app notice before the change takes effect.

Chickadee Bandit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use your household's content to train AI models. AI touches it in only the three ways described here.

AI assistants you connect. An adult member can connect an AI assistant, such as Claude or ChatGPT, to their own account. This is off until that person sets it up, either by creating a token or by signing in and approving the assistant. Children and guests cannot connect one, and an admin can limit it to admins.

A connected assistant acts as the member who connected it and can read what that member can see: the household's members and groups, calendar (including events from connected calendars), tasks, locations and who is home, conversations, recent activity, and the data in the household's apps. It cannot see passwords or billing details. The member chooses an access level: read only; read and write, which also lets the assistant post messages, send notifications and change app data; or, for admins, one that also lets it install, update and remove apps.

Whatever the assistant reads is sent to the company that runs it and is then held under that company's terms and privacy policy, including its own rules on keeping data and on training AI models. Our commitments in this policy do not extend to what that company does with it, so choose an assistant you trust with your household's information.

You can end a connection at any time on the web under Settings → AI Access, by revoking or replacing your token or disconnecting the application; it stops working immediately. An admin can do the same for any member. Changing your password or signing out does not disconnect an assistant.

Suggestions from text, email and photos. When you type into quick add, scan a photo of something like a flyer or a schedule, or forward an email to your household's inbox, we use an AI model to suggest calendar events, tasks or grocery items from it. By default the model runs on Cloudflare, our hosting provider, and what it reads is not sent to any other company. For email, it reads the message text and never the attachments. Nothing is added to your household until someone confirms the suggestion. An admin can turn off suggestions from email in the inbox's settings.

An admin can choose higher-quality parsing in the inbox's settings. With it on, the text of a forwarded email and the photos members scan are sent to Anthropic, which runs the Claude models, to read them; attachments are still never sent, and quick add still runs on Cloudflare. Each email or photo read this way uses one of the household's AI credits, and an admin can turn that spending off for photos, for email, or both; with it off, or with no credits left, reading runs on Cloudflare as before. Anthropic processes what it receives under its commercial terms, which do not permit it to train models on that data, and we do not send it anything else about your household.

Building an app with AI. A household admin can describe an app in plain language and have the hub build it. What the admin types, and the household's list of installed apps, are sent to Anthropic to produce the app. The model works through the same tools a connected assistant would have at the Admin level, limited to building: it can read who is in the household (each member's name and role, whether they have their own sign-in, and the household's groups), and it can create or change only that household's own apps. It does not read the calendar, tasks, locations, messages or the data inside your apps, and whatever it reads is sent to Anthropic under the same terms as above. We keep the description only while the build runs and for a day afterwards, then delete it; the household's record of the build keeps its length, its outcome and the credits it used, never the text. The app it produces is checked and installed exactly like any other app, including any approval an admin must give.

Chat with Chickadee, the assistant on our website, answers questions about the product from our public pages. When none of our canned answers fits, your question, up to your last three earlier questions in the same chat, and the matching passages from our pages are sent to Anthropic to write the reply, through Cloudflare with request logging turned off. It never reads your household's data, and children and guests cannot use it.

We don't keep your chat. The one exception is a question the assistant couldn't answer: we keep its wording so we can write the answer. We remove email addresses, links and long numbers first, and we store nothing alongside it about who asked: no account, email address, IP address or page. Anything else you typed stays as you wrote it, including a name or street address, so please leave personal details out of your questions. Repeats are counted. A question asked only once is deleted after 14 days, and any question 90 days after it was last asked.

If you choose to ask the team, we keep your email address, your name if you give it, your account if you're signed in, the page you were on, and the conversation so far, and we email you our replies. A conversation is deleted 180 days after its last message, when you delete your account, or sooner if you ask us to delete it.

We use a small number of providers to run the service, each only for what's listed:

• Cloudflare — hosting, storage, content delivery, and running the AI model described under AI features;
• Anthropic — the Claude models behind higher-quality parsing and the app builder, described under AI features, and the support chat, under commercial terms that do not allow training on your data;
• Lemon Squeezy — payment processing and tax handling (merchant of record);
• Resend — transactional email (invites, receipts, reminders);
• PostHog — product analytics and in-app surveys, limited to the events described under Technical data;
• Expo — push notification delivery to mobile devices, via Apple Push Notification service and Firebase Cloud Messaging.

We do not sell or rent personal data to anyone.

Some features can email people outside the service (for example event invitations to external contacts). External contacts must confirm before receiving ongoing email (double opt-in) and every message includes an unsubscribe link.

Your content is kept as long as your household keeps it. Households can set automatic retention windows for many apps, and admins can enable a write-audit trail with its own retention setting. If your subscription lapses, data is retained for a grace period so you can renew or export before deletion.

You can export your household's complete data from settings at any time. You can also delete your account: deletion has a 7-day grace period (with a cancel link) and then removes your login, private settings, location fixes, private files, and memberships from the live service. Content you contributed to a shared household or conversation may remain for its other members under that household's retention settings, with your access revoked. Encrypted infrastructure backups expire on the provider's backup schedule and are not used to restore an individually deleted account; legal preservation requirements may require us to retain limited records for longer.

When a member takes a verified copy of a record, we keep a fingerprint of that file and a few facts about it (when it was issued, which app and document, how many entries) for seven years, so anyone holding the file can check it. We don't keep the file or its contents. The household is stored only as a keyed hash, and the fingerprint stays for the seven years even if the household is deleted. Checking a file sends us only its fingerprint and size, never the file.

Depending on where you live (including under GDPR and CCPA), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. The export and deletion tools in settings cover most of these directly; for anything else, email us and we'll help. We don't discriminate against you for exercising your rights.

If we make material changes to this policy we'll notify you by email or an in-app notice before they take effect.

Firebird Systems LLC, developer of Chickadee Bandit, Chickadee Locate, Chickadee Quiet, and Chickadee Garden. Privacy questions or requests: support@chickadeebandit.com.