Privacy policy
Pidgeon needs very little about you: an email address to sign you in and send your briefs to, and the pidgeons you create. We do not sell any of it, and there is no advertising.
The rest of this document is the detail, and the awkward parts are in the same size type as the rest. §6 names every company involved, and §7 says what goes to a language model.
1. Who is responsible
The controller for the purposes of the GDPR is:
PCN Ventures UG (haftungsbeschränkt), Eislebener Str. 5, 10789 Berlin, registered at Amtsgericht Berlin (Charlottenburg) under HRB 225664 B.
Full details, and the supervisory authorities, are in the legal notice. We have not appointed a data protection officer, because at our size the GDPR does not require one; requests go to privacy@pidgeon.fyi and reach a person.
2. What we store
Your account. The email address you sign in with, when the account was created, and your sign-in history, held by our authentication provider. Like any website, our hosting and authentication providers see your IP address and your browser’s user-agent string when you use the service, and these appear in their logs.
Your WhatsApp number, if you add one. The number, when you verified it and agreed to receive briefs there, and when you asked to stop. Your reactions to briefs on WhatsApp are kept as your answer to “Was this worth reading?”. If you reply to a brief, on WhatsApp or by email, a language model reads what you wrote to work out what you want changed. We keep the change it leads to, or your comment on that brief, and the message itself stays in the record of that model call, held by Langfuse (§6), so we can check and improve how replies are read.
Your pidgeons. Each pidgeon’s name, the name it signs its letters with, its prompt, when it reports, your time zone (from your browser) and whether it is active, and the plan a language model writes from the prompt: where to look, the searches to run, what counts as relevant, and which search found each finding. If you made it from someone else’s shared link, we record which pidgeon it was copied from.
What your pidgeons find. For each finding: its source, link, title, a short excerpt, author and date as the source published them, the model’s relevance score and one-line reason, and whether it was sent to you. These are public web pages, but a finding can mention people, because the news does.
Your feedback. Whether you marked a finding relevant or not relevant, or a brief worth reading or not, and when, and anything you write about why a brief missed.
Invitations you send. If you invite a friend or share a pidgeon by email, we use the address you enter once, to send that email from you. We do not keep the address; a one-way hash of it stays for 30 days so that the same person isn’t emailed twice.
Opens and clicks. Each brief carries a tiny image that tells us when the email was opened, and its links pass through our site so we know which findings you clicked. We use this to learn what your pidgeon gets right and what you skip. Some email apps load images for every message, so an open is only a hint. Blocking images in your email app stops open tracking; clicks are still counted.
Briefs and runs. Each brief’s subject, text, which findings it covered and when it was emailed. For each run: when it ran, how many findings it fetched and kept, which sources answered, any error, and for each model call the model, tokens, cost and time taken.
Judgement records. For each run, a file of every article the pidgeon judged: its link, title and excerpt, the score and reason, and the pidgeon’s id. We use these to test changes to the models and prompts.
Model traces. A record of each language-model call — the prompt sent, the output, and your user id and the pidgeon’s id — so that we can find out why a pidgeon kept or missed something (§6).
Logs. Application logs of each run and each failure, which carry ids and counts rather than what you wrote, but can include your user id or email address where an error involves them.
Page analytics. Plausible counts visits to our pages without cookies and without any personal data. Nothing it collects identifies you.
3. Why, and on what legal basis
| What we do | Legal basis |
|---|---|
| Sign you in and keep your session | Article 6(1)(b) — performance of the contract |
| Run your pidgeons: plan, search, judge and write briefs | Article 6(1)(b) |
| Email you sign-in codes and briefs, and send briefs to WhatsApp if you turn it on | Article 6(1)(b) |
| Use your feedback, and which briefs you open and findings you click, to steer that pidgeon | Article 6(1)(b) |
| Show a shared pidgeon’s name, summary and prompt to whoever has the link | Article 6(1)(b) — you chose to share it |
| Use feedback, aggregated across everyone, to improve sources, judging and defaults | Article 6(1)(f) — making the service better for everybody |
| Trace model calls, keep logs, and fix what breaks | Article 6(1)(f) — keeping the service working |
| Prevent abuse and enforce the terms, including the check that a person is signing in | Article 6(1)(f) |
| Send an invitation or a shared pidgeon to the address you enter | Article 6(1)(f) — you asked us to, and it goes once |
| Count page visits without cookies | Article 6(1)(f) |
| Answer a lawful request from an authority | Article 6(1)(c) |
| Establish, exercise or defend a legal claim | Article 6(1)(f) |
Where we rely on legitimate interests you can object under Article 21, and §10 says how. Nothing here relies on consent.
What “aggregated” means. We look at feedback in bulk — which sources and which ways of judging produce findings people keep — to choose better defaults and to test changes to the models and prompts against real verdicts before we make them. We do not sell it, and we do not give it to anyone to train their models.
4. How long we keep it
| Data | Kept for |
|---|---|
| Your account and email address | Until your account is deleted |
| A pidgeon, its plan, findings, feedback, briefs and runs | Until you delete the pidgeon or your account |
| Findings a pidgeon judged and passed over | In full for 14 days, then only a fingerprint of the link, until you delete the pidgeon |
| Judgement records | Up to 90 days |
| Model traces | Up to 90 days |
| Application logs | Up to 90 days |
| Cached copies of public source pages | Minutes; they hold no data about you |
Deleting a pidgeon deletes everything it found: its findings, your feedback on them, its briefs and its runs, at once. You can do that in the app.
Deleting your account deletes all your pidgeons and everything above with them. Today you do that by writing to privacy@pidgeon.fyi from the address you sign in with; we do it and confirm within one month, and usually much sooner. Judgement records, traces and logs already written expire on the schedule above rather than at once.
Briefs we have already emailed you stay in your own inbox; deleting here cannot reach them. Our providers also keep backups, and data deleted from the service survives in a backup until that backup expires. We do not restore a backup to recover something you deleted.
6. Who else handles it
These companies run parts of the service for us, under contracts that restrict them to doing so. We name each rather than calling them “trusted partners”.
| Company | What it does | What it handles |
|---|---|---|
| Vercel | Hosts the site and runs the code. Its AI Gateway sends model calls on to the model provider. | Everything the app handles while it runs; prompts, plans and findings sent to the model |
| OpenAI, directly or through Microsoft Azure, by way of Vercel’s AI Gateway | The language models that plan, judge, write and look for sources | See §7 |
| Supabase | Database and sign-in, in the EU (Ireland) | Your account, pidgeons, findings, feedback, briefs, runs and judgement records |
| Resend | Sends email | Your email address, sign-in codes and briefs, and the addresses you send invitations to |
| Cloudflare (Turnstile) | Checks that a person is signing in, not a bot | Your IP address and technical signals from your browser, when you request a sign-in code |
| Meta (WhatsApp Business Platform) | Sends briefs and codes on WhatsApp, if you turn it on | Your WhatsApp number, briefs, codes and your reactions |
| Upstash | A short-lived cache of fetched public pages, the queue that starts runs, and short-lived counters | Public source pages, pidgeon ids, your user id with a daily count of what your pidgeons cost, and the hashes in §2 |
| Langfuse (Langfuse Cloud, EU) | Traces of model calls | Prompts and outputs of model calls, with your user id and the pidgeon’s id |
| Better Stack (EU) | Application logs | Run and error logs (§2) |
| Plausible | Cookieless page analytics | No personal data |
Transfers outside the EU. Your account and pidgeons are stored in the EU. Some of the companies above, including Vercel and OpenAI, may process data outside the EU and the EEA, in particular in the United States. Where they do, the transfer is covered by an adequacy decision such as the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses. Write to privacy@pidgeon.fyi for a copy of the safeguard that applies.
Beyond these, we disclose data to nobody: not to advertisers and not to data brokers. If we are compelled by a valid legal order we will tell you, unless telling you is itself unlawful.
7. What goes to a language model
A pidgeon uses language models at these steps, and each call carries only what that step needs:
- Planning sends your prompt, and gets back the searches to run and what counts as relevant.
- Judging sends the plan, the titles and excerpts of new findings, and the titles of up to 20 findings you recently marked relevant or not, so the model learns your taste, and the titles of what it told you in the last five days, so it doesn’t repeat itself.
- Writing sends the plan and the kept findings, and gets back the brief.
- Re-planning sends your prompt, the plan, the titles of findings you reacted to, and anything you wrote about why a brief missed, and gets back a better plan.
- Reading a reply sends what you wrote in answer to a brief, without the quoted brief below it, and that pidgeon’s prompt, name and schedule, and gets back which change you want.
- Scouting sends your prompt and what counts as relevant, and gets back sites worth reading.
Your email address is not sent to the model. The calls go through Vercel’s AI Gateway to OpenAI; we do not claim they keep nothing, and their own terms govern how long they hold a request. Do not put anything in a prompt that you would not want processed this way.
These are automated judgements about which public pages to show you. None makes a decision with a legal or similarly significant effect on you within the meaning of Article 22, and you can always see and correct a verdict by marking a finding.
9. Emails we send you
We email you sign-in codes and the briefs you asked for. Every brief has a one-click unsubscribe that stops the email for that pidgeon, and links to mark a finding relevant or not. Those links work without signing in, so each one is signed and acts only on the one finding or pidgeon it was made for. Forwarding a brief forwards those links too.
10. What you can ask for
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it over in a portable form, or stop processing it where we rely on legitimate interests.
Write to privacy@pidgeon.fyi from the address you sign in with, so we know the account is yours. We answer within one month, and if a request is genuinely complex we will tell you inside that month rather than at the end of it. We will not charge you and we will not make you justify yourself.
If you think we have got something wrong, you can complain to the Berliner Beauftragte für Datenschutz und Informationsfreiheit or to the supervisory authority where you live. We would rather you told us first, but it is your right and not conditional on that.
11. Children
Pidgeon is not for children. You need to be 18 to hold an account, which the terms say too. If we learn that an account belongs to a child we will close it and delete the data.
12. Security
There is no password to phish or leak: you sign in with a one-time code. Each person’s pidgeons are kept apart by rules in the database itself, not only by the application. Links in emails are signed so they cannot be forged. Data is encrypted in transit.
Report anything you find to hi@pidgeon.fyi. We will not threaten you for it.
If a breach affects your personal data and is likely to result in a risk to you, we will notify the supervisory authority within 72 hours and tell you directly where the GDPR requires it, and we will say what happened rather than that “an incident occurred”.
13. Changes
When this policy changes, the date at the top changes with it. For a change that materially affects you we will email you before it takes effect, not after.