Thicket for iPhone and iPad

Privacy Policy

Last updated: 14 September 2026

This policy explains what information the Thicket app uses, where it goes and what you can do about it. It’s written for people in the UK and the European Union.

In short

• Thicket identifies birds by sound. Sound is analysed on your iPhone. Recordings stay on it, and clips leave it only if you share one or upload a bird to iNaturalist.
• An account is optional. Without one, everything stays on your iPhone apart from the approximate location Recent News and rare bird alerts use, place names and place searches from Apple, any feedback you choose to send, and birds you choose to upload to iNaturalist.
• If you sign in, your history and settings are saved to your account so they survive a lost or replaced phone. You can delete your account, and everything saved to it, from Settings.
• There are no ads, no analytics and no tracking, and your information is never sold.

Who is responsible

Thicket is made by Thomas Fearn, who is responsible for your information (the “controller”) under UK and EU data protection law. Contact: [email protected].

What stays on your iPhone

These are kept only on your iPhone, whether or not you have an account:

• Sound. Thicket listens through the microphone while you’re listening and analyses the sound on your iPhone. The last 10 minutes are kept in memory so you can replay a detection, and are gone when you stop.
• Clips and recordings. Clips of detected birds are saved only if you turn on Save clips of birds. Recordings you add or share to Thicket are copied into its folder, which you can see in the Files app. Recordings are never uploaded; a clip only goes to iNaturalist with a bird you choose to upload there.
• History. Each finished session: when and where it was, the place name, and the birds identified. Live sessions of 10 seconds or more are kept even when no birds were identified, so your listening time counts.
• Life list, badges and listening stats, worked out on your iPhone from your history each time they’re shown.
• Settings and mutes.
• Places. The place Thicket last used, from your iPhone’s location or chosen by you, and up to eight recent places to choose from, including names you’ve typed for a place, so listening can start without waiting for a location.
• Your approximate location, rounded to about a kilometre, if you turn on rare bird alerts, so background checks know where to look.

What leaves your iPhone, and why

Your account (optional)

If you sign in, Thicket stores the following with Supabase, which hosts the account service in London (UK):

• Your email address, or the private relay address Apple gives Thicket if you use Sign in with Apple and choose to hide your email.
• An account ID and the time you last signed in.
• Sign-in sessions: for each device you’re signed in on, the IP address and device type recorded when it signed in, kept until you sign out or the session expires.
• Your history: each session’s start and end times, where it was (the place name, and the precise coordinates from your iPhone’s location or of a place you chose), the birds identified with their times and confidence, which you confirmed, rejected or marked as seen, and the file name of a recording it came from.
• Your settings: sensitivity, alert settings, mutes, the confidence percentage, the classifier, whether to save clips and start listening when the app opens, whether rare bird alerts are on, whether badges and first-time tags are shown, and the Recent News distance, period and rarity filter. Places and recent places aren’t saved to your account.

This is used only to keep your history and settings in step between your devices and to restore them. Sign-in emails are sent by an email delivery service on the account service’s behalf.

Recent News and rare bird alerts

To show birds reported near you, Thicket sends your location rounded to about a kilometre (or a place you’ve searched for) with the distance and period you’ve chosen:

• eBird (Cornell Lab of Ornithology, United States): the request goes through Thicket’s server at Supabase, so eBird sees the server rather than your iPhone.
• iNaturalist (United States): the request goes directly from your iPhone, so iNaturalist also receives your IP address, as with any website. See iNaturalist’s privacy policy.

Rare bird alerts make the same eBird request in the background, using your last approximate location. Notifications are created on your iPhone; no notification service is involved.

Apple

• Place names: the name of where you are, and of the place a session was in, is looked up from its location with Apple’s maps service. On the Listen screen, the name of a recent place nearby is used instead when there is one.
• Place search: what you type when choosing a place on the Listen screen or in Recent News is sent to Apple Maps to suggest matching places, as you type. A place named in a recording’s file name, such as “Petersfield England”, is sent to Apple to find it, unless it’s one of your recent places.
• Sign in with Apple, if you use it.

Apple handles this under Apple’s privacy policy.

Feedback you send

If you send feedback from Settings > Send Feedback, Thicket stores it with Supabase in London (UK):

• What you write, and whether it’s an idea, a problem or other feedback.
• Your email address, only if you leave it in the form. When you’re signed in, the form fills in your account’s email, and you can remove it.
• Your account ID, if you’re signed in when you send it.
• The app version, iOS version and device model (for example “iPhone17,1”), to help track down problems.

It’s used only to read your feedback, reply if you asked, and improve Thicket.

iNaturalist uploads (optional)

If you sign in to iNaturalist from Export and upload birds, Thicket sends each bird you choose straight from your iPhone to iNaturalist (United States), under your own iNaturalist account:

• The observation: the species, when its call was heard, the session’s precise coordinates and how accurate they are, the location privacy you chose (open, obscured or private), and a note that it was identified by sound with Thicket and whether you saw it or checked its call.
• A clip of its call, as a sound file.

iNaturalist also receives your IP address, as with any website. Your iNaturalist sign-in is kept in your iPhone’s keychain, on this iPhone only; it isn’t sent to Thicket’s server or saved to your Thicket account, and Sign Out removes it. What you upload is then iNaturalist’s to handle, under iNaturalist’s terms and privacy policy; you can edit or delete your observations on iNaturalist.

Things you choose to share

Share cards, captions and exports are created on your iPhone and go wherever you send them, for example to Messages or a social network. Thicket doesn’t receive a copy.

Server logs

Thicket’s server (Supabase) keeps a record of requests, including IP addresses, for a short time (currently one day) to keep the service running and secure.

Legal bases

• Providing the service you asked for (contract): your account, syncing, Recent News reports, and uploads to iNaturalist.
• Legitimate interests: keeping the service secure and working, such as server logs, and reading and replying to feedback you send.
• Your permission (consent): the microphone, location and notifications, which iOS asks you for. You can turn each off at any time in the iPhone’s Settings app, and Thicket keeps working with less.

How long information is kept

• Account information is kept until you delete your account. Deleting it removes your account, history and settings from the account service straight away; copies in the service’s backups, if any, are removed as those expire.
• Sign-in sessions last until you sign out or they expire.
• Feedback is kept while it’s useful for improving Thicket. Feedback sent while signed in is deleted with your account, and you can ask for any feedback you’ve sent to be deleted.
• Server logs are kept for about a day.
• Information on your iPhone is kept until you delete it or the app.

Who else is involved

• Supabase hosts the account service, feedback and Thicket’s server in London, under a data processing agreement. Supabase is a US company, so its staff may access information from outside the UK to run the service, under legal safeguards such as standard contractual clauses.
• eBird receives approximate locations from Thicket’s server; iNaturalist receives them from your iPhone, and the birds you upload to it. Both are in the United States.
• Apple provides place names, place search and Sign in with Apple.

Your information isn’t sold or used for advertising.

Your rights

Under UK and EU data protection law you can ask to:

• see the information held about you,
• correct it,
• delete it (you can also delete your account in Settings > Account),
• restrict or object to its use,
• receive it in a portable format.

Email [email protected] to use any of these. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EU, the authority in your country.

Children

Thicket isn’t aimed at children. If you’re under 13, or under the age your country sets for agreeing to online services yourself, please ask a parent or guardian before creating an account.

Security

Information travels over encrypted connections. Each account can only read and change its own history and settings, and there are no passwords to leak: sign-in uses Apple or a one-time email code.

This website

Separately from the app: if you give your email address on thicketbirds.com to be told when Thicket is released, that address is stored in a database run by Cloudflare on Thomas Fearn’s behalf, and may be passed to an email delivery provider solely to send that announcement. The lawful basis is your consent. It’s used for that message and nothing else: it isn’t added to any other mailing list and it isn’t shared. Ask at the address below to have it removed at any time.

These pages set no cookies, run no analytics and load nothing from other websites. Cloudflare, which serves the site, keeps standard server logs, including IP addresses, for security.

Changes to this policy

If this policy changes, the date at the top will change too. Significant changes will be pointed out in the app.

Contact

Thomas Fearn, [email protected]