Privacy

Who we are

TrickyBird is operated by the team behind trickybird.com (“we”). For privacy questions or data requests, contact support@trickybird.com, or send it through the contact form.

Site data in your browser

Each site you open through TrickyBird gets its own namespace for the data it saves in your browser, such as its local storage, IndexedDB, and cache. This keeps one site’s saved data from colliding with or casually reading another’s. It is a separation for tidiness, not a security wall: because every site is served through the one TrickyBird address, your browser still treats them as a single site underneath, so a deliberately malicious page could reach what another site stored during the same session. Treat a shared browser session as shared. Open sensitive sites in their own session or a fresh private window, and clear your browsing data when you are done.

Sessions

Each time you open a site through TrickyBird, we issue a short‑lived signed token and place it in a cookie in your own browser. That token routes your traffic; it is not an account and carries no name, email, or other identifier. We keep no matching record of it on our servers, the signature alone is what we check, and there is nothing in a database for it to point to. Cookies from the sites you open are held in a server‑side store keyed to your session. A site’s cookies sit under that site’s hostname, and the ones set for a whole domain rather than one hostname sit with the session itself, whichever site set them. The store is cleared about an hour after it was last used. Many sites need their own scripts to read those cookies back, so a copy of those values goes into your browser’s cookie store under TrickyBird’s own address. Your browser never files it under the site’s own domain. Clearing your browsing data removes that copy, and TrickyBird does not remove it for you when a session ends.

Suggestions while you type

When you type in the launch box on the home page, your browser can send the text to our servers, which answer with up to 5 matching sites from a fixed list of popular ones. Your browser leaves out spaces at either end and any http://, https:// or www. at the start, and sends the rest only when it is at least 2 characters long and made only of letters a to z, digits, dots and hyphens. A path, a query string or anything after the first word stays in the box. Our servers do not write what you typed to their logs. Your browser may keep an answer in its own cache and reuse it for up to 10 minutes. Picking a suggestion is the same as typing that address and pressing Go.

Server logs

Running a public proxy means our servers receive network connections, and like any internet service we keep a minimal record of them to defend against abuse, fraud, and attacks. Here is exactly what that record does and does not contain.

What our edge access log contains:

• a shortened form of your IP address, not your full address
• the date and time of the connection
• the hostname of each site or service a page loads from, for example example.com, not only the address you typed, and never the specific page or query
• the HTTP method, response status, size, and timing

What it does not contain:

• the specific page, path, search query, or content you loaded
• your full IP address
• your session token or any cookie
• your browser’s User‑Agent string
• any account, name, or email

We keep this log for 48 hours and then delete it. We never sell it or share it with advertisers. Anything else we hold for your session is short‑lived too, and goes away on its own within about an hour of the last time it was used.

When you write to us or use the contact form

When you email us at any address on this domain, we receive the address you write from, your message, and anything you attach. Through the contact form on the Support page we receive your message, the site, the error code and other technical details of the problem when those are filled in, plus an address if you give one for a reply. So that a report can be acted on, it also carries the country your connection comes from and the browser and system you are using, both read from the connection itself rather than from anything you type. If you send the form from a browser signed in to a Premium account, we also receive that account’s details: its email address and ID; whether that browser signed in with an email link or from the purchase; the plan’s status and dates, its term (monthly or yearly), and whether it is set to cancel; and Stripe’s reference numbers for the customer and the subscription. The form does not show you these details; they go to our mailbox with your message. If you leave the email field blank, or type an address we cannot use, any reply goes to that account’s email address. The form takes no attachments. Through the “Suggest a feature” form on your account page we receive your message and your account’s email address, so that we can reply. We keep what you send while we deal with it, and you can ask us to delete it. Reports about copyright or abuse are kept longer so we can act on them. Nothing in this mailbox is used for advertising.

Legal requests

We respond only to valid legal process from an authority with jurisdiction over us. Send it to support@trickybird.com and mark it as legal process in the subject line. For free use, we keep so little for so short a time that there is very little we can produce: at most 48 hours of access‑log lines, each holding a shortened form of an IP address, a hostname, and basic response details. The log holds one line for every request the proxy handled, including the ones it turned away, so the hostnames of the other sites and services a page loaded from are in there too. No page‑level browsing history is attached, because we do not keep one. We can also produce the other records this page describes, while we still hold them: a Premium account, our copy of a cancel or withdraw request, and mail you have sent us. If we are legally required to preserve specific records, we may hold those records beyond their normal retention period for that purpose only.

Your rights

Depending on where you live, in the EU, UK, or California for example, you can ask what we hold about you. You can also ask us to delete it, or object to how we process it. To make a request, write to support@trickybird.com or use the contact form, and include the approximate time you used the service. If you have no account and have not written to us or used the cancel or withdraw pages, we hold no name or email to search on, so after 48 hours there is normally nothing left to find. If you have written to us, we keep your mail while we deal with what you wrote about. You can delete a Premium account yourself on your account page, and deleting it while a plan is running cancels that plan with Stripe. If you ask us to delete a cancel or withdraw copy early, we may keep it until the 12 months end, to defend against claims.

Why we are allowed to process this

For the short edge access log, our lawful basis is our legitimate interest in running the service and defending it from abuse and attack. For a Premium account, it is our contract with you: to give you the plan you bought, we need your email address, your plan, Stripe’s reference numbers for you and your subscription, and the payment notices Stripe sends us. The sign‑in links we email you and the record of each browser you sign in on rest on that contract too. The record we make when you start a checkout rests on your request to buy. After your last plan ends, we keep the account for 12 months on our legitimate interest in answering questions about past payments and refunds, unless you delete it sooner. For mail you send us, it is our legitimate interest in answering you, and, where a copyright or abuse notice requires us to act, our legal obligation. For a cancel or withdraw request, we send you a receipt because the law requires it, and we keep our copy to defend against claims. For suggestions while you type, it is our legitimate interest in making the launch box quicker to use.

Cookies

The proxy sets a functional session cookie so your traffic routes correctly. If you sign in to a Premium account, another cookie keeps that browser signed in for up to 30 days. If you start a Premium checkout, a cookie holds a random code for it until you close the browser. We store a one‑way digest of that code, not the code itself, in a record with Stripe’s numbers for the checkout and the subscription, and we stop using that record after 24 hours. If you choose a language, the site remembers that choice in a cookie so your next visit opens in the same one.

Who processes data for us

Providers acting on our behalf process the traffic and the mail needed to run the service. For Premium, Stripe processes the payment data. Your card details stay with Stripe, and it keeps its own record of your payments.

Third‑party sites

When you open a site through TrickyBird, that site’s own privacy practices apply to the content it provides. TrickyBird acts as a conduit; we do not control or review the content of sites you choose to visit.

The browser extension

The TrickyBird browser extension routes one tab at a time and asks for access to no site. It handles one kind of data, the address you asked it to open: that address stays in memory rather than on disk, and it is dropped within minutes if the tab is never opened. TrickyBird’s use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Questions

If you have questions about this policy, visit our Support page.