BirdBoy
Privacy notice
Last updated: 25 October 2026. This notice describes the BirdBoy website, newsletter, REV A buyer area and checkout.
1. Who is responsible?
The controller responsible for processing your personal data is Tim Härle, Robert-Schumann-Str. 31, 88339 Bad Waldsee, Germany. You can contact him at hi@playbirdboy.com.
2. Website delivery and hosting
This website is hosted on servers in Germany using Hetzner. Technical data is processed to make the website available and maintain its security. See Hetzner’s privacy information for information about the provider.
When you visit, your browser sends technical information needed to deliver the website, including your IP address, requested URL, request time and browser information. Hosting systems may record this information in access or security logs.
The purpose is to deliver the website, diagnose errors and protect it against misuse. The legal basis for this website-delivery processing is our legitimate interest in secure website operation under Article 6(1)(f) GDPR.
3. Contact by email
If you contact us, we process your email address, message and any information you provide to respond to your request. The legal basis is Article 6(1)(b) GDPR for requests concerning a contract or steps before a contract; otherwise it is our legitimate interest in responding to enquiries under Article 6(1)(f) GDPR.
We retain correspondence for as long as needed to handle the request and meet applicable retention obligations.
4. Newsletter and Brevo
You can subscribe to BirdBoy development updates, build notes and launch offers. The newsletter uses Brevo. Registration requires your email address. We use double opt-in: after signing up, you receive an email with a confirmation link. Your subscription begins after you confirm it.
Newsletter delivery is voluntary and based on consent under Article 6(1)(a) GDPR. You can withdraw consent at any time through the unsubscribe link in a newsletter. Withdrawal does not affect the lawfulness of earlier processing.
Brevo processes subscriber information and technical delivery data on our behalf. Confirmation and consent records may be retained to document your subscription. A minimal suppression record may be needed to respect an unsubscribe request.
The signup form is embedded from Brevo. Loading it establishes a connection to Brevo before you submit an email address and can transmit your IP address and browser information.
5. Spam protection: Google reCAPTCHA
The Brevo signup form uses Google reCAPTCHA to distinguish human submissions from automated abuse. This can involve Google receiving technical information such as IP address, browser information and interactions with the challenge. Data processing can begin when the form or challenge loads.
6. Website analytics: Umami Cloud
This website currently loads an analytics script from Umami Cloud to measure website use. Umami’s documentation states that its standard tracker does not use cookies. This does not mean that no connection to an external service occurs: your browser requests the script and sends analytics requests to that service.
7. REV A buyer account and downloads
Sign-in to the buyer area uses an email link sent through Supabase Auth with the configured IONOS SMTP account. We process your email address, account identifier, sign-in session and access status to authenticate you and deliver purchased digital files. The browser receives the session data needed to keep you signed in. The legal basis is Article 6(1)(b) GDPR for providing the requested account and digital product, and Article 6(1)(f) GDPR for preventing unauthorized access.
Files are kept in private Supabase Storage. Before a download, the server checks your purchase entitlement and creates a short-lived link. Supabase privacy information
8. Paddle checkout and purchase records
Paddle acts as merchant of record and processes the payment. Paddle collects payment information under its own privacy notice; BirdBoy does not receive card details. To grant and manage access, BirdBoy receives or retrieves your purchase email, Paddle customer and transaction identifiers, product and payment status, and refund status. We store these with your account entitlement in Supabase. The legal basis for providing access is Article 6(1)(b) GDPR; records needed for legal obligations are processed under Article 6(1)(c) GDPR.
9. Recipients and international transfers
Service providers involved in hosting, authentication, transactional email, payments, newsletters, spam protection and analytics may receive the data described above. Where a provider processes data on our behalf, an appropriate processing agreement is required. Transfers outside the EEA require an applicable GDPR transfer mechanism.
10. Your rights
Contact hi@playbirdboy.com to exercise your rights. Subject to the legal conditions, you can request access, correction, deletion, restriction of processing and data portability. You can withdraw consent at any time.
You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to processing for direct marketing at any time.
You can exercise your rights by contacting the controller named above. You may also complain to a data-protection supervisory authority, particularly in the EU country of your habitual residence, place of work or the alleged infringement.
You do not have to subscribe to use the website. Without an email address, we cannot send you the newsletter or a REV A sign-in link. No automated decision-making with legal or similarly significant effects is intended for this website.
11. Retention and changes
We retain personal data only for as long as required for the stated purpose, applicable statutory retention obligations or the establishment, exercise or defence of legal claims. Newsletter subscription data is used until you unsubscribe; records needed to demonstrate consent or respect your unsubscribe request may be kept beyond that point for those limited purposes. Buyer account and purchase records are retained while needed to provide access and meet applicable record-keeping obligations.
This notice will be updated if website services or processing practices change.