Privacy Policy

Last updated 2026-10-08

This policy explains what personal information BirdStory collects, why we collect it, who we share it with, and the choices you have. In this policy, “BirdStory”, “we”, “us” and “our” mean Nigel McHardy, trading as BirdStory.

BirdStory is a trading name, not a separate company. It is operated from New Zealand by the individual named above, who is responsible for the personal information described here (in privacy law, the “controller”).

BirdStory is a practical, non-clinical way to recognise lived experiences and communicate what helps. It is not a diagnostic service. What you save can still be personal, so we treat it as sensitive. A BirdStory profile can be about you or about someone else, so some of the information we hold may be personal information about a person who is not the account holder; see section 2.

BirdStory accounts and personalised services are not currently offered in the United Kingdom or the European Economic Area (EEA). Public informational pages remain accessible. We do not use visitor analytics there either (see section 8).

This policy has two layers: sections 1 to 11 and 13 apply to everyone, and section 12 gives additional information for people in the United Kingdom and the EEA. Section 12 describes protections we have built for if and when BirdStory is offered in those regions; it does not mean the service is available there now.

1. What we collect

Your account

• Your email address, used to sign you in with a one-time sign-in link and to contact you about your account.
• A record that you agreed to our Terms and this policy, and when.
• A record that you confirmed you are 18 or older (not your date of birth or age).
• The country where you live, which you confirm (see “Where you live” below).

Profiles

A profile is a space for one person’s patterns: the account holder, or someone else the account holder is supporting or managing a profile for. For each profile we store a name or nickname you choose, whether it is for you or someone else, for a profile about someone else a broad life-stage category (adult, young person or teenager, or child — not a date of birth or exact age), and the view (“lens”) you pick, such as Explorer, ADHD, autism, AuDHD or HSP. Up to four profiles can be held on an account. For a profile about another adult in the UK or EEA we also hold that adult’s email address and the status of their approval (see sections 2 and 12).

What you save and answer

• Saved Experiences and Saved Wild Words, kept separately for each profile. The Experiences, Wild Words and Birds in BirdStory’s library are our own content; they become personal to you only through what you choose to save, answer or confirm.
• Guided Discovery responses (including “not sure” and skipped items), kept per profile.
• Your Tune choices and the qualities you confirm, which shape how a guide is written.
• Pattern results BirdStory works out from what you save, such as trait scores, which Birds show up most, and the themes and findings built from them.
• Free text you type, for example the optional “Add your voice” answers, edits you make to a guide, and text in a Quick Read.

Guides and Quick Reads

• Generated Personal and Supporter Guides, and any edits you make to them.
• Quick Reads you build, and the PDF file made from each saved Quick Read.
• Share links you create, including a copy of the guide or Quick Read as it was when you created or updated the link.

Consent and approval records

Where we ask for your consent, or for a represented adult’s approval and consent, we keep a record of when it was given, the wording and version shown, how it was given, and and when it was withdrawn. These records do not contain the content of a profile. If consent is withdrawn and the profile is deleted (see section 9), we keep only a minimal record of that: the consent wording and version, when it was given and withdrawn, and that the profile was deleted — not the name, email address or any profile content.

Payments

If you buy the Guide Pack, our store (WooCommerce) records the order: your name and email, billing country, order number and amount. Card details are entered into our payment provider Stripe’s payment fields and are handled by Stripe; BirdStory does not receive or store your full card details.

Technical information

Our servers and security tools may log technical details such as IP address, browser type and the pages or files requested, to keep the service running and secure.

Privacy requests

If you contact us about your information, we keep a record of the request, how we verified it and how we responded.

Where you live

When you set up your account we ask where you live. You confirm the country, and you can change it later in your account settings. We use it to apply the right privacy and availability rules for you (for example, which profile types are available and whether we ask for the explicit consent described in section 12). We may use your approximate location to suggest a country to choose, but that is only a suggestion: once you have confirmed your country, your confirmed country decides, not where you happen to be connecting from, so travelling or using a VPN does not silently change the rules that apply to your profiles.

2. Information about someone else

A BirdStory profile may be created and managed on behalf of another person, including someone you support. The account holder, who manages the account, may therefore not be the same person the profile describes. In this policy, “the account holder” means the person who manages the BirdStory account, and “the person a profile is about” means whoever the profile describes (which may be the same person).

• The account holder controls the BirdStory account and its profiles and guides technically, but some of the information in a profile may be personal information about someone else. The account holder is not the person the information is about, and their consent does not stand in for that person’s.
• If you manage a profile about someone else, you are responsible for deciding whether it is appropriate to enter and share information about them and, where appropriate, for obtaining their permission. Please only enter information you are entitled to provide, consider that person’s privacy (a nickname is fine), and take care if you later share their guide.
• A person may build and buy a Guide Pack for themselves and later share their Supporter Guide with people who support them, or may build one on behalf of another person and later give that person their guide (for example by a share link or download). Each guide is generated from, and about, the profile it belongs to, not the account holder.
• Another adult, in the UK or EEA. If the account’s confirmed country is in the UK or EEA and you create a profile about another adult, we create only a minimal pending profile, and we email that adult to ask them directly to approve it and to give their own explicit consent. No substantive information about them is added or used until they have done so. They do not need a BirdStory account, they can decline, and they can withdraw their consent later, which deletes the profile about them. The account holder cannot give, withdraw or manage that consent for them. See section 12.
• Where the information comes from. After an adult has approved a profile, information about them comes from the account holder (the selections and information they add) and from BirdStory, which derives patterns, Birds, themes, findings and personalised guide content from what has been added. The represented adult does not currently have a login to browse the profile; they can exercise their privacy rights through the route in section 10.
• Children and young people. For accounts whose confirmed country is in the UK or EEA, profiles about a child or about a young person or teenager are not available at launch. We do not create child or teen accounts, collect dates of birth, or verify age with documents. For accounts elsewhere, a profile about a child or young person may still be created under our existing flow, in which the adult account holder confirms they have appropriate authority; we do not claim that flow is valid in every country.
• Creating a profile about someone does not remove that person’s own privacy rights; see section 10 for how they can contact us.

BirdStory account holders must be 18 or older at launch. We store only your confirmation that you are 18 or older; we do not ask for or store your date of birth, exact age, or proof of age. Under-18s can be represented by a profile that an adult account holder creates, where that profile type is available.

3. Sensitive information

Some information you add, select or confirm, and some information we derive from it, may reveal or allow inferences about things such as neurodivergence, health, cognitive functioning, sensory experiences or support needs. For example, a combination of Saved Experiences, a chosen lens, free text, and the patterns and findings built from them can do that. This does not mean that every single Experience or Wild Word is health information, and our library content is not personal information until it is personal to you. We treat the information in a profile as sensitive as a whole.

BirdStory does not diagnose anything. Birds, themes and findings are possibilities drawn from your own selections, written to be tentative; they can be wrong, and they are for you to confirm, tune or ignore.

Where the UK and EEA sensitive-data rules apply, we ask for your explicit consent before we use this kind of information: from the account holder for their own profile, and from the represented adult themselves for a profile about another adult. See section 12.

4. How we use information

• To run your account and sign you in, and to apply the right regional privacy and availability rules.
• To create and manage profiles, and to remember what you save, confirm and answer.
• To suggest Experiences to look at in Guided Discovery.
• To work out and present patterns, Birds, themes and findings for each profile.
• To generate Personal and Supporter Guides, and to create Quick Reads, and to let you download or share them when you ask.
• To process payments and orders and give access to what you bought.
• To send sign-in links, receipts and account messages, to send approval and consent-management emails to represented adults, and to answer support requests.
• To keep BirdStory secure, prevent misuse and fix problems.
• To record consent and approval, and to handle privacy requests.
• To meet legal obligations that apply to us, such as keeping certain business records, where the law requires it.

We do not sell your personal information, and we do not use it for advertising.

5. AI and automated analysis

Automated analysis

BirdStory does analyse what you save and answer by automated means. It works out patterns, identifies Birds, themes and findings, and personalises what you see, and it uses an AI service to help write guides. That is profiling in the ordinary sense. BirdStory does not currently use these systems to make decisions that have legal or similarly significant effects on you, such as decisions about employment, credit or financial eligibility, access to healthcare or treatment, education admission or legal eligibility.

The AI service

Guide text is written with the help of Google’s Gemini Developer API. When you generate a guide, BirdStory sends selected profile information that is needed for that guide: material derived from the Experiences saved on that profile, the patterns and findings worked out from them, the chosen lens, qualities you confirmed and Tune choices, and whether the guide is about an adult, young person or child. Google processes this to return the guide text, and may process it in other countries where it operates.

We do not send your name or profile name, your email address, account number, payment details or the free-text answers you type (such as “Add your voice” answers and edits you make to a guide) to the AI service. Free text stays with your profile and can appear in guides you choose to generate or share, so take care what you type there. Generated guides are suggestions, not facts, and they can be wrong. Quick Reads are built from your own selections and do not use the AI service.

6. Who we share information with

We use a small number of service providers who handle information for us:

• Google — Gemini Developer API for AI guide generation, as described above.
• Stripe and WooCommerce — WooCommerce handles our checkout and order records on our own systems; Stripe processes payment information under its applicable privacy and data-processing terms.
• Cloudflare — protects BirdStory from automated abuse and helps pages load faster. Requests to the site, including your IP address, pass through its network, and its Turnstile check tells people from bots on the sign-in form.
• Namecheap — the hosting provider we have selected to host the site and its data.
• Email delivery and backup providers — send sign-in links, receipts and account emails, and hold backup copies of the site and database.

Some of these providers process information outside New Zealand, the UK or the EEA; see section 12. We may also disclose information if the law requires it, or to protect people’s safety or our rights.

Authorised BirdStory administrators and support staff can access stored account data when needed to run, secure and support the service. We limit this to what is necessary.

7. Sharing a guide and downloads

Nothing is shared unless you choose to share it. A share link opens a read-only copy of a guide or Quick Read for anyone who has the link. The link is a long random address and is not listed in search engines, but it is not a password: anyone who has it can open it, and they can forward it to someone else, and we cannot stop a recipient doing that. Choosing “Revoke link” stops future access through that link. It cannot recall copies someone has already saved, printed or passed on.

A downloaded guide is your own copy and sits outside BirdStory. Full guide PDFs are generated when you ask to download them and are not kept on our servers. Quick Read PDFs are saved in private storage and are private downloads for your account; they are not a sharing link. You decide who receives any guide, and what name is shown (full name, first name only, or none). For profiles about someone else, first name only is the default.

If the permission a profile depends on is missing — for example, a represented adult’s approval is not in place — we do not provide that profile’s personalised downloads and its shared links stop working. Withdrawing consent revokes the profile’s personalised share links and deletes the profile, including its guides, Quick Reads and the PDF files made from them (see section 9). Old links do not come back.

If you manage a profile about someone else, you are responsible for deciding whether it is appropriate to share information about them and, where appropriate, obtaining their permission before doing so.

8. Cookies and similar technology

We do not use advertising cookies, and browsing our public pages does not set any cookie. What we store on your device, and why:

• Staying signed in. When you sign in with an email link, WordPress sets sign-in cookies that keep you signed in on that browser for about two weeks. They are needed for the sign-in you asked for.
• Sign-in protection. On the sign-in page, Cloudflare Turnstile may run a silent check and set or read a cookie or similar browser storage to protect the form from bots. It is used only for that purpose.
• Basket and checkout. If you add the Guide Pack to your basket or go to checkout, WooCommerce sets cookies (up to a week; some end when you close the browser) and your browser keeps a copy of your basket, including the email address and country you entered, until you clear it. We do not set these when you only browse.
• Payments. When you open checkout, Stripe’s scripts load and Stripe sets cookies to help prevent fraud and process the payment (one can last up to about 13 months). They are not loaded on other pages.
• Choices you make. Only after you click, we remember a few display choices — for example the Story or Guide view on a page (30 days), a tab you picked, or a tip you dismissed (kept in your browser until you clear it). If you read as a supporter, a layout cookie lasts up to a year. We do not use these to track you, and the site works without them. We also keep a short note in your browser tab, for the length of your visit, of the current page and one-off confirmation messages.
• Currency. For visitors who are not signed in, our store may use your approximate location, worked out from your IP address on our own server, to choose the currency and price shown. Nothing is stored for this, and it is separate from the country you confirm on your account.

You can clear or block cookies and site data in your browser settings at any time. If you do, you will be signed out and your basket will be emptied, and any display choices above will be forgotten.

Website analytics

We do not use visitor analytics for people in the United Kingdom or the European Economic Area, or when we cannot tell where a visitor is, and we never use it when you are signed in or on pages about your account, profile, guides, shares or privacy. For other visitors to our public pages (for example the home page, the Experiences library and pricing), we may use first-party website analytics, kept on our own website, to understand which pages are used: the page, the time, the referring site, a rough location (country and city) and the type of device. It uses no cookies, and a visitor identifier made from your IP address and browser details that changes daily — we do not store your IP address — and we keep this information for up to 90 days. Where you are is worked out on our own server from your connection, without sending your IP address to another service.

9. How long we keep information

• We keep your account information and saved data while your account exists.
• Deleting a profile removes its saved Experiences and Wild Words, Guided Discovery responses, pattern results, generated guides (and their share links), Quick Reads and their PDF files, and, for a profile about another adult, the record that holds their email address.
• Deleting your account does the same for every profile, and removes your account.
• Withdrawing consent (where we rely on your explicit consent, see section 12) permanently deletes that profile and the personalised material created from it: its Saved Experiences and Wild Words, Guided Discovery responses, pattern results, themes and findings, guides, Quick Reads, PDF files and share links. Your BirdStory account and unrelated order records are not deleted. A deleted profile cannot be restored; to use BirdStory again you would create a new profile and give consent again. For a profile about another adult, that adult’s own withdrawal deletes the profile, and the record holding their email address is deleted too once we have sent them a confirmation.
• Records of consent keep the history of when consent was given and withdrawn, and contain no profile content. After a withdrawal only the minimal record described in section 1 remains. These records are kept with your account and removed when the account is deleted.
• The link we email to a represented adult to approve a profile works once and expires after 7 days. The link we email so they can manage their consent works once and expires after 1 hour.
• A share link stays active until you revoke it or delete the content; it does not expire on its own.
• Order and payment records are kept for as long as we need them for tax, accounting and legal purposes. Deleting a profile or your account does not delete them; after account deletion they are no longer linked to a BirdStory account.
• Deleted information may remain temporarily in routine backups until those backups are replaced or expire. Copies you have downloaded or shared are outside our control.
• A record of how many guide creations or updates an account has used is kept with the account so the allowance in the Terms can be applied.

10. Your choices and rights

You can edit or delete saved items, delete a profile, delete a guide, revoke a share link, withdraw consent (which deletes the profile, where it applies), or delete your account from within BirdStory. As the account holder, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing [email protected]. BirdStory does not currently offer a self-service export of all the information stored in your account. Downloading a guide or Quick Read gives you that generated output; it is not a full export of your account data, so we handle requests for a copy manually. We may need to confirm it is you. If you are not happy with how we handle your information, you can contact the Office of the Privacy Commissioner in New Zealand; people in the UK and EEA have additional rights and complaint routes described in section 12.

If you are the person a profile is about. The account holder controls their BirdStory account, but that does not necessarily give them unlimited rights over another person’s personal information. You are a person whose information we hold even though you do not have a BirdStory account. If you are an adult in the UK or EEA we ask you directly to approve a profile and to give your own explicit consent, and you can decline or withdraw consent yourself, without an account (withdrawing deletes the profile about you). For any other request, such as access, correction or deletion, contact the BirdStory Privacy Officer using the privacy contact details below. You cannot currently log in to the account holder’s account or browse the profile yourself, so we handle those requests manually. We may need enough information to verify the request and identify the relevant data before we can act on it, and we may not be able to share account information with you until we can do so appropriately. We will consider each request on its merits: a request does not by itself remove a profile, and we will not disclose or delete information on an unverified request.

11. Security

We take reasonable steps to protect your information, including sign-in links instead of passwords, server-side permission checks on who can see or change a profile, one-time and expiring links for approvals and consent management, private storage for generated PDF files, long random share links that you can revoke, and deletion controls. No online service can be completely secure, so we cannot guarantee absolute security. If something affects your information in a way that could cause you serious harm, we will tell you and the relevant authority as the law requires.

12. Additional information for people in the UK and EEA

This section applies if your confirmed country is in the United Kingdom or the European Economic Area (the EU countries plus Iceland, Liechtenstein and Norway). It adds to the rest of this policy.

Why we may use your information

Different parts of BirdStory rely on different legal grounds, not one for everything:

• Providing the service you asked for — your account, profiles, saved items, guides, Quick Reads, sharing and payments — where we need the information to do that (performance of our contract with you).
• Our legitimate interests in specific, limited things such as keeping BirdStory secure, preventing misuse, recording agreements, consent and approvals, applying the right regional rules, and limiting accounts to adults.
• Consent, where we ask for it: explicitly, for the sensitive information described in section 3; and, for a profile about another adult, that adult’s own consent.
• Legal obligations, where the law requires us to keep or provide certain records.

Explicit consent for sensitive information

For the information described in section 3, our approach is to ask for your explicit consent as the special condition that allows us to use it. For your own profile, the account holder gives it: it is a separate, unticked box (not part of accepting the Terms), we record when you gave it and the wording and version shown, and we do not start using the sensitive information in your profile until you have. You can withdraw it at any time in your account settings, with one confirmation and no need to give a reason. When you withdraw, we stop using the profile information, revoke the profile’s personalised share links, and permanently delete the profile and the personalised material created from it. The withdrawal screen tells you this before you confirm. Your BirdStory account and unrelated order records are not deleted. A deleted profile cannot be restored: if you want to use BirdStory again you can create a new profile and give consent again. Withdrawing consent does not make our earlier use of your information, while your consent was in place, unlawful.

Profiles about another adult

The represented adult is the person whose rights are affected, so they decide. We email them a neutral message that does not mention health or neurodivergence, they approve (or decline) and give their own explicit consent on a page that needs no account, and only then can substantive information about them be added or used. They can later withdraw their consent themselves through a link we email them, without involving the account holder. Withdrawing deletes the profile about them and its personalised material, and the account holder cannot prevent or reverse that or give consent on their behalf. The account holder’s own account and other profiles are unaffected, and they are shown only that a supported profile is no longer available. A new profile about the same person would need a new approval and consent.

Children and young people

Profiles about children and about young people or teenagers are not available for UK and EEA accounts at launch. If your account’s confirmed country is not yet set, or an older profile has no life stage recorded, we pause that profile until you confirm the missing detail; we do not delete it or guess.

International transfers

Some of the providers we use process information outside New Zealand, the UK and the EEA — for example Google and Stripe, which operate internationally. They publish arrangements that may apply to transfers, such as adequacy decisions, standard contractual clauses, the EU-US Data Privacy Framework and its UK Extension, and the UK transfer addendum. We have not completed our own review of every arrangement, so we do not describe any single mechanism as covering all of your information.

Your rights

Where they apply, you may have the right to access your information, have it corrected, have it deleted, restrict or object to how it is used, receive it in a portable form, and withdraw consent you have given. Whether a right applies can depend on the legal ground for the processing. We handle these requests through the privacy contact in section 13 rather than a self-service portal, and we respond without undue delay and within one month of receiving a request. If a request is complex or we have several from you, we may take up to two further months, but we will tell you within the first month and explain why. If we cannot do what you ask, we will tell you why and that you can complain to a data protection authority. For data you gave us, we provide a copy as a file in a commonly used format; the withdrawal, deletion and sharing controls described above are available directly in BirdStory. We may need to confirm who you are before we act.

Complaints

You can complain to a data protection authority. If you are in the UK, that is the Information Commissioner’s Office (ico.org.uk). If you are in the EEA, you can complain to the supervisory authority in the country where you live, work or where you think a problem happened. You do not have to contact us first.

13. Changes and contact

We may update this policy as BirdStory changes. The date at the top shows when it was last revised, and we will tell you about significant changes. Questions, requests or concerns for the BirdStory Privacy Officer: [email protected]. Purchases are also covered by our Refund Policy.