Privacy

Site data in your browser

Each site you open through TrickyBird gets its own namespace for the data it saves in your browser, such as its local storage, IndexedDB, and cache. This keeps one site’s saved data from colliding with or casually reading another’s. It is a separation for tidiness, not a security wall: because every site is served through the one TrickyBird address, your browser still treats them as a single site underneath, so a deliberately malicious page could reach what another site stored during the same session. Treat a shared browser session as shared. Open sensitive sites in their own session or a fresh private window, and clear your browsing data when you are done.

Sessions

Each time you open a site through TrickyBird, we issue a short-lived signed token and place it in a cookie in your own browser. That token routes your traffic; it is not an account and carries no name, email, or other identifier. We keep no matching record of it on our servers, the signature alone is what we check, and there is nothing in a database for it to point to. Cookies from the sites you open are held in a server-side store keyed to your session. A site’s cookies sit under that site’s hostname, and the ones set for a whole domain rather than one hostname sit with the session itself, whichever site set them. The store is cleared about an hour after the last cookie written into it. Many sites need their own scripts to read those cookies back, so a copy of those values goes into your browser’s cookie store under TrickyBird’s own address. Your browser never files it under the site’s own domain. Clearing your browsing data removes that copy, and TrickyBird does not remove it for you when a session ends.

Server logs

Running a public proxy means our servers receive network connections, and like any internet service we keep a minimal record of them to defend against abuse, fraud, and attacks. Here is exactly what that record does and does not contain.

What our edge access log contains:

• a shortened form of your IP address, not your full address
• the date and time of the connection
• the hostname of each site or service a page loads from, for example example.com, not only the address you typed, and never the specific page or query
• the HTTP method, response status, size, and timing

What it does not contain:

• the specific page, path, search query, or content you loaded
• your full IP address
• your session token or any cookie
• your browser’s User-Agent string
• any account, name, or email, because we never ask for one

We keep this log for 48 hours and then delete it. We never sell it or share it with advertisers. Anything else we hold for your session is short-lived too, and goes away on its own within about an hour of the last time it was used.

When you write to us or use the contact form

When you email us at any address on this domain, we receive the address you write from, your message, and anything you attach. Through the contact form on the Support page we receive your message, the site and error code when you fill those in, plus an address only if you give one for a reply. So that a report can be acted on, it also carries the country your connection comes from and the browser and system you are using, both read from the connection itself rather than from anything you type. The form takes no attachments. We keep what you send while we deal with it, and you can ask us to delete it. Reports about copyright or abuse are kept longer so we can act on them. Nothing in this mailbox is used for advertising.

Legal requests

We respond only to valid legal process from an authority with jurisdiction over us. Send it to support@trickybird.com and mark it as legal process in the subject line. Because we keep so little for so short a time, there is very little we can produce: at most 48 hours of access-log lines, each holding a shortened form of an IP address, a hostname, and basic response details. The log holds one line for every request the proxy handled, including the ones it turned away, so the hostnames of the other sites and services a page loaded from are in there too. No page-level browsing history is attached, because we do not keep one. If we are legally required to preserve specific records, we may hold those records beyond the normal 48-hour window for that purpose only.

Your rights

Depending on where you live, in the EU, UK, or California for example, you can ask what we hold about you. You can also ask us to delete it, or object to how we process it. To make a request, write to support@trickybird.com or use the contact form, and include the approximate time you used the service. We hold no account, name, or email to search on, so after 48 hours there is normally nothing left to find. Mail you have sent us is the exception: we keep it while we deal with what you wrote about.

Why we are allowed to process this

For the short edge access log, our lawful basis is our legitimate interest in running the service and defending it from abuse and attack. For mail you send us, it is our legitimate interest in answering you, and, where a copyright or abuse notice requires us to act, our legal obligation.

Cookies

The proxy sets a functional session cookie so your traffic routes correctly. If you choose a language, the site remembers that choice in a cookie so your next visit opens in the same one.

Who processes data for us

Providers acting on our behalf process the traffic and the mail needed to run the service.

Third-party sites

When you open a site through TrickyBird, that site’s own privacy practices apply to the content it provides. TrickyBird acts as a conduit; we do not control or review the content of sites you choose to visit.

The browser extension

The TrickyBird browser extension routes one tab at a time and asks for access to no site. It handles one kind of data, the address you asked it to open: that address stays in memory rather than on disk, and it is dropped within minutes if the tab is never opened. TrickyBird’s use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Questions

If you have questions about this policy, visit our Support page.