Thicket

Privacy Policy

Last updated: 13 September 2026

This policy explains what information the Thicket app uses, where it goes and what you can do about it. It’s written for people in the UK and the European Union.

In short

Thicket identifies birds by sound. Sound is analysed on your iPhone, and recordings and clips never leave it.
An account is optional. Without one, everything stays on your iPhone apart from the approximate location Recent News and rare bird alerts use, place names looked up from Apple, and any feedback you choose to send.
If you sign in, your history and settings are saved to your account so they survive a lost or replaced phone. You can delete your account, and everything saved to it, from Settings.
There are no ads, no analytics and no tracking, and your information is never sold.

Who is responsible

Thicket is made by Thomas Fearn, who is responsible for your information (the “controller”) under UK and EU data protection law. Contact: [email protected].

What stays on your iPhone

These are kept only on your iPhone, whether or not you have an account:

Sound. Thicket listens through the microphone while you’re listening and analyses the sound on your iPhone. The last 10 minutes are kept in memory so you can replay a detection, and are gone when you stop.
Clips and recordings. Clips of detected birds are saved only if you turn on Save clips of birds. Recordings you add or share to Thicket are copied into its folder, which you can see in the Files app. Neither is ever uploaded.
History. Each finished session: when and where it was, the place name, and the birds identified.
Settings and mutes.
Your approximate location, rounded to about a kilometre, if you turn on rare bird alerts, so background checks know where to look.

What leaves your iPhone, and why

Your account (optional)

If you sign in, Thicket stores the following with Supabase, which hosts the account service in London (UK):

Your email address, or the private relay address Apple gives Thicket if you use Sign in with Apple and choose to hide your email.
An account ID and the time you last signed in.
Sign-in sessions: for each device you’re signed in on, the IP address and device type recorded when it signed in, kept until you sign out or the session expires.
Your history: each session’s start and end times, where it was (the place name and the precise coordinates from your iPhone), the birds identified with their times and confidence, which you confirmed, rejected or marked as seen, and the file name of a recording it came from.
Your settings: sensitivity, alert settings, mutes, the confidence percentage, the classifier, whether to save clips and start listening when the app opens, whether rare bird alerts are on, and the Recent News distance, period and rarity filter.

This is used only to keep your history and settings in step between your devices and to restore them. Sign-in emails are sent by an email delivery service on the account service’s behalf.

Apple

Place names: the name of the place a session was in is looked up from its location with Apple’s maps service.
Place search: what you type when choosing a place in Recent News is sent to Apple Maps to find it.
Sign in with Apple, if you use it.

Apple handles this under Apple’s privacy policy.

Feedback you send

If you send feedback from Settings > Send Feedback, Thicket stores it with Supabase in London (UK):

What you write, and whether it’s an idea, a problem or other feedback.
Your email address, only if you leave it in the form. When you’re signed in, the form fills in your account’s email, and you can remove it.
Your account ID, if you’re signed in when you send it.
The app version, iOS version and device model (for example “iPhone17,1”), to help track down problems.

It’s used only to read your feedback, reply if you asked, and improve Thicket.

Things you choose to share

Share cards, captions and exports are created on your iPhone and go wherever you send them, for example to Messages or a social network. Thicket doesn’t receive a copy.

Server logs

Thicket’s server (Supabase) keeps a record of requests, including IP addresses, for a short time (currently one day) to keep the service running and secure.

Legal bases

Providing the service you asked for (contract): your account, syncing, and Recent News reports.
Legitimate interests: keeping the service secure and working, such as server logs, and reading and replying to feedback you send.
Your permission (consent): the microphone, location and notifications, which iOS asks you for. You can turn each off at any time in the iPhone’s Settings app, and Thicket keeps working with less.

How long information is kept

Account information is kept until you delete your account. Deleting it removes your account, history and settings from the account service straight away; copies in the service’s backups, if any, are removed as those expire.
Sign-in sessions last until you sign out or they expire.
Feedback is kept while it’s useful for improving Thicket. Feedback sent while signed in is deleted with your account, and you can ask for any feedback you’ve sent to be deleted.
Server logs are kept for about a day.
Information on your iPhone is kept until you delete it or the app.

Who else is involved

Supabase hosts the account service, feedback and Thicket’s server in London, under a data processing agreement. Supabase is a US company, so its staff may access information from outside the UK to run the service, under legal safeguards such as standard contractual clauses.
eBird receives approximate locations from Thicket’s server; iNaturalist receives them from your iPhone. Both are in the United States.
Apple provides place names, place search and Sign in with Apple.

Your information isn’t sold or used for advertising.

Your rights

Under UK and EU data protection law you can ask to:

see the information held about you,
correct it,
delete it (you can also delete your account in Settings > Account),
restrict or object to its use,
receive it in a portable format.

Email [email protected] to use any of these. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EU, the authority in your country.

Children

Thicket isn’t aimed at children. If you’re under 13, or under the age your country sets for agreeing to online services yourself, please ask a parent or guardian before creating an account.

Security

Information travels over encrypted connections. Each account can only read and change its own history and settings, and there are no passwords to leak: sign-in uses Apple or a one-time email code.

This website

Separately from the app: if you give your email address on this site to be told when Thicket is released, that address is stored in a database run by Cloudflare on Thomas Fearn’s behalf, and may be passed to an email delivery provider solely to send that announcement. The lawful basis is your consent. It is used for that message and nothing else — it is not added to any other mailing list and it is not shared. Ask at the address above to have it removed at any time.

These pages set no cookies and run no analytics. Cloudflare, which serves the site, keeps standard server logs including IP addresses for security. Web fonts are loaded from Google Fonts, so your browser makes a request to Google, which sees your IP address.

Changes to this policy

If this policy changes, the date at the top will change too. Significant changes will be pointed out in the app.

Contact

Thomas Fearn, [email protected]