Legal
Privacy
Free use of TrickyBird needs no account and no sign‑up, and without an account there is no profile for any log to attach to. An account exists only if you buy Premium. The purchase creates it from the email address you give at checkout, and it holds that address, your plan’s status and dates, Stripe’s reference numbers for you and your subscription, or for a crypto payment our order number and NOWPayments’ invoice and payment numbers, and a one‑way digest of each sign‑in link and each signed‑in browser instead of the link or session itself. If you pay with crypto and are not signed in, you type the address on our plans page instead. We keep it with your order until the payment goes through, then only on your account. If the payment does not go through, we delete the order after 30 days. For each signed‑in browser it also notes the kind of browser and system, such as Chrome on macOS, and the device type (desktop, phone or tablet), so you can tell them apart on your account page. This record never holds the browser’s full User‑Agent string, its IP address or its location. There is no password: you sign in with a one‑time link sent to that address. We delete an account 12 months after its last plan ends, and you can delete it sooner on your account page. To run the service and defend it from abuse, our edge servers keep a short access log. It writes one line for every request the proxy handles on your behalf, including the ones it turns away, so it holds the hostname of each site or service a page loads from, not only the address you typed, along with a shortened form of your IP address, the time, and basic response details. The access log does not record the specific pages or search terms you open on those hosts, the content you load, your messages, your full IP address, or any cookie or session token. These lines are deleted within 48 hours. We do not sell the access log and we do not share it with advertisers.
Who we are
TrickyBird is operated by the team behind trickybird.com (“we”). For privacy questions or data requests, contact support@trickybird.com, or send it through the contact form.
Site data in your browser
Each site you open through TrickyBird gets its own namespace for the data it saves in your browser, such as its local storage, IndexedDB, and cache. This keeps one site’s saved data from colliding with or casually reading another’s. It is a separation for tidiness, not a security wall: because every site is served through the one TrickyBird address, your browser still treats them as a single site underneath, so a deliberately malicious page could reach what another site stored during the same session. Treat a shared browser session as shared. Open sensitive sites in their own session or a fresh private window, and clear your browsing data when you are done.
Sessions
Each time you open a site through TrickyBird, we issue a short‑lived signed token and place it in a cookie in your own browser. That token routes your traffic; it is not an account and carries no name, email, or other identifier. We keep no matching record of it on our servers, the signature alone is what we check, and there is nothing in a database for it to point to. Cookies from the sites you open are held in a server‑side store keyed to your session. A site’s cookies sit under that site’s hostname, and the ones set for a whole domain rather than one hostname sit with the session itself, whichever site set them. The store is cleared about an hour after it was last used. Many sites need their own scripts to read those cookies back, so a copy of those values goes into your browser’s cookie store under TrickyBird’s own address. Your browser never files it under the site’s own domain. Clearing your browsing data removes that copy, and TrickyBird does not remove it for you when a session ends.
Suggestions while you type
When you type in the launch box on the home page, your browser can send the text to our servers, which answer with up to 5 matching sites from a fixed list of popular ones. Your browser leaves out spaces at either end and any http://, https:// or www. at the start, and sends the rest only when it is at least 2 characters long and made only of letters a to z, digits, dots and hyphens. A path, a query string or anything after the first word stays in the box. Our servers do not write what you typed to their logs. Your browser may keep an answer in its own cache and reuse it for up to 10 minutes. Picking a suggestion is the same as typing that address and pressing Go.
Server logs
Running a public proxy means our servers receive network connections, and like any internet service we keep a minimal record of them to defend against abuse, fraud, and attacks. Here is exactly what that record does and does not contain.
What our edge access log contains:
- a shortened form of your IP address, not your full address
- the date and time of the connection
- the hostname of each site or service a page loads from, for example
example.com, not only the address you typed, and never the specific page or query - the HTTP method, response status, size, and timing
What it does not contain:
- the specific page, path, search query, or content you loaded
- your full IP address
- your session token or any cookie
- your browser’s User‑Agent string
- any account, name, or email
We keep this log for 48 hours and then delete it. We never sell it or share it with advertisers. Anything else we hold for your session is short‑lived too, and goes away on its own within about an hour of the last time it was used.
When you write to us or use the contact form
When you email us at any address on this domain, we receive the address you write from, your message, and anything you attach. Through the contact form on the Support page we receive your message, the site, the error code and other technical details of the problem when those are filled in, plus an address if you give one for a reply. So that a report can be acted on, it also carries the country your connection comes from and the browser and system you are using, both read from the connection itself rather than from anything you type. If you send the form from a browser signed in to a Premium account, we also receive that account’s details: its email address and ID; whether that browser signed in with an email link or from the purchase; the plan’s status and dates, its term (monthly or yearly), and whether it is set to cancel; and Stripe’s reference numbers for the customer and the subscription. The form does not show you these details; they go to our mailbox with your message. If you leave the email field blank, or type an address we cannot use, any reply goes to that account’s email address. The form takes no attachments. Through the “Suggest a feature” form on your account page we receive your message and your account’s email address, so that we can reply. We keep what you send while we deal with it, and you can ask us to delete it. Reports about copyright or abuse are kept longer so we can act on them. Nothing in this mailbox is used for advertising.
Cancel requests, payment mail and plan‑change notes
If you cancel on our cancel page, we keep a copy of your request: your email address, your name and your plan details. If you write to account@trickybird.com about your plan or a payment, we keep your mail and our reply. We keep these copies for 12 months to defend against claims, then delete them. Deleting your Premium account does not delete them.
When a Premium plan changes (a purchase, a renewal, a cancel, a failed payment, an end, a refund or a dispute), or a crypto payment needs a manual step, we send a note about it to our own support mailbox: the change and its time, the account’s email address and id, and the Stripe customer and subscription ids or, for a crypto payment, our order number and the NOWPayments invoice and payment numbers. If a crypto order has no account yet, the note holds the email address typed on the plans page. We use it to run billing and answer support, and we delete it after 12 months. Deleting your Premium account does not delete these notes.
Legal requests
We respond only to valid legal process from an authority with jurisdiction over us. Send it to support@trickybird.com and mark it as legal process in the subject line. For free use, we keep so little for so short a time that there is very little we can produce: at most 48 hours of access‑log lines, each holding a shortened form of an IP address, a hostname, and basic response details. The log holds one line for every request the proxy handled, including the ones it turned away, so the hostnames of the other sites and services a page loaded from are in there too. No page‑level browsing history is attached, because we do not keep one. We can also produce the other records this page describes, while we still hold them: a Premium account, a crypto order, our copy of a cancel request, and mail you have sent us. If we are legally required to preserve specific records, we may hold those records beyond their normal retention period for that purpose only.
Your rights
Depending on where you live, in the EU, UK, or California for example, you can ask what we hold about you. You can also ask us to delete it, or object to our processing of it. To make a request, write to support@trickybird.com or use the contact form, and include the approximate time you used the service. If you have no account and have not written to us or used the cancel page, we hold no name or email to search on, so after 48 hours there is normally nothing left to find. If you have written to us, we keep your mail while we deal with what you wrote about. You can delete a Premium account yourself on your account page, and deleting it while a plan is running ends that plan, and cancels it with Stripe if you pay by card. If you ask us to delete a copy of a cancel request, or mail about your plan or a payment, before the 12 months end, we may keep it until then to defend against claims.
Why we are allowed to process this
For the short edge access log, our lawful basis is our legitimate interest in running the service and defending it from abuse and attack. For a Premium account, it is our contract with you: to give you the plan you bought, we need your email address, your plan, Stripe’s reference numbers for you and your subscription, and the payment notices Stripe sends us, or for a crypto payment our order number, NOWPayments’ invoice and payment numbers and the payment notices it sends us. The sign‑in links we email you and the record of each browser you sign in on rest on that contract too. The record we make when you start a checkout, including the email address you type for a crypto payment, rests on your request to buy. After your last plan ends, we keep the account for 12 months on our legitimate interest in answering questions about past payments and refunds, unless you delete it sooner. For mail you send us, it is our legitimate interest in answering you, and, where a copyright or abuse notice requires us to act, our legal obligation. For a cancel request, we send you a receipt because the law requires it. We keep our copy of a cancel request, and mail about your plan or a payment, on our legitimate interest in defending against claims. For suggestions while you type, it is our legitimate interest in making the launch box quicker to use.
Cookies
The proxy sets a functional session cookie so your traffic routes correctly. If you sign in to a Premium account, another cookie keeps that browser signed in for up to 30 days. If you start a Premium checkout, a cookie holds a random code for it until you close the browser. We store a one‑way digest of that code, not the code itself, in a record with Stripe’s numbers for the checkout and the subscription, or for a crypto payment NOWPayments’ invoice number and our order number, and we stop using that record after 24 hours. If you choose a language, the site remembers that choice in a cookie so your next visit opens in the same one.
Who processes data for us
Providers acting on our behalf process the traffic and the mail needed to run the service. For a card payment, Stripe processes the payment data. Your card details stay with Stripe, and it keeps its own record of your payments. If you pay with crypto, NOWPayments processes the payment. We send it the price, the plan length and our order number, but not your email address. We do not keep the wallet or the coin you pay with, and NOWPayments keeps its own record of the payment.
Third‑party sites
When you open a site through TrickyBird, that site’s own privacy practices apply to the content it provides. TrickyBird acts as a conduit; we do not control or review the content of sites you choose to visit.
The browser extension
The TrickyBird browser extension routes one tab at a time and asks for access to no site. It handles one kind of data, the address you asked it to open: that address stays in memory rather than on disk, and it is dropped within minutes if the tab is never opened. TrickyBird’s use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Questions
If you have questions about this policy, visit our Support page.