Privacy & security

A registry of valuable birds has to protect them, and their owners, as carefully as it helps find them. This page explains what we collect, why, who can see it, and your choices.

Finders never see your details unless you choose to share them in a message.
Verified professionals see only what you allow and every search is logged where you can see it.
We don’t sell or rent your information or use it for advertising.
You can download or delete your data at any time, from your account.

Last updated 26 October 2026.

Who we are

BIRD (BirdDB.au and portal.BirdDB.au) is operated by PAPACITO PTY LTD, ABN 44 669 345 500 (“we”, “us”). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

If you register birds

Your name, email address and password (stored only as a secure hash), and optionally your phone number and suburb.
Your birds’ details: species, colours, photos, bands, microchips, hatch dates, parentage, and lost, stolen or deceased reports, including where and when and any police event number.
Transfers you send or receive, including the recipient’s email address.
Messages you exchange with finders through BIRD.
If you ask to hear about lost birds near you: the postcode and distance you choose, and which alerts we’ve sent you.

If you report a found bird

Your first name and email address, and your phone number if you give it.
What you tell us about the bird: description, photos, bands, and the suburb where you found it.

If you apply as a professional or a Verified breeder

Your organisation’s or aviary’s name, ABN, address, phone, and registration or licence numbers, which we use to check your application.
For breeders: also the species you breed, your club or society memberships, and the band codes you use.
For professionals: each search you make, the reason you gave, and what it returned.

If you use our contact form

Your name, email address and message, plus anything else you choose to add, such as a phone number or organisation. We use them only to reply to you.
Cloudflare Turnstile checks that the form is being used by a person, not a bot. It looks at signals from your browser and doesn’t ask you to solve puzzles in most cases.

Automatically

Sign-in cookies on the portal, which keep you signed in. We don’t use advertising cookies.
On this website (not the portal), Google Analytics cookies, which count visits and show us which pages help people, for example how many finders reach the found-bird guide. They record pages viewed, roughly where you are (city or region), and your browser and device, never your name or anything you type into a form. You can block them with your browser’s settings or Google’s opt-out add-on, and the site works the same.
Your IP address and browser, briefly, to prevent abuse (for example, limiting repeated sign-in attempts) and to keep your account secure.

How we use it

To match found birds with registered birds, and to tell owners about possible matches.
To let owners, finders and professionals contact each other through BIRD.
If you ask us to when you report a bird missing, to email people nearby who’ve asked to hear about lost birds.
To check professional and breeder applications.
To send emails you need (email confirmation codes and links, password reset links, matches, messages, transfers) and reminders you can turn off. Two-step sign-in uses an authenticator app, not email.
To keep BIRD secure, investigate misuse, and meet our legal obligations.

Who can see what

The public can’t search BIRD. Someone who scans a lost-bird poster, or opens a lost bird’s page you’ve shared, sees only what the poster shows.
People nearby who’ve asked for lost-bird alerts, if you choose to tell them when you report a bird missing: its species, suburb and the date, with a link to its page (what the poster shows). Never your name, contact details or its numbers, and you never see who they are.
Finders never see an owner’s details or the list of possible matches. If an owner replies, the finder sees the bird’s name and the owner’s messages (signed “Owner”), plus any contact details the owner decides to write in them.
Owners whose bird may match see the finder’s report and messages, but not the finder’s email address. A finder’s phone number, if they give one, is seen only by BIRD staff.
Owners also see the organisation of any professional who looked their bird up, with the reason given (their data download also includes the name of the person who searched), and the organisation and suburb of a professional who reports their bird in their care.
Verified professionals see a bird’s record and status, and only what the owner has allowed: the owner’s name, phone, email and area, and the bird’s photos. Each search is logged and shown to the owner.
New owners receive a bird’s record, photos and history when they accept a transfer, and see the name of the person who passed it on. Later owners see the bird’s breeder’s name, or aviary name for a Verified breeder. A breeder keeps a view of the family lines they recorded.
BIRD staff can see records to review applications, handle stolen-bird alerts, and respond to reports of misuse. Staff access requires two-step sign-in.
Police, if we’re legally required to disclose information, or if we believe it’s necessary to prevent serious harm.

Where it’s stored

BIRD’s database and application run on servers in Australia (Amazon Web Services, Sydney), so personal information is stored in Australia except where stated below. We use these service providers, who handle information only to provide their service to us:

Amazon Web Services (an Australian region): hosting for the portal and its database.
Cloudflare: this website, the contact form’s spam check (Turnstile), and storage for bird and report photos. Turnstile sends your IP address and signals from your browser to Cloudflare. Cloudflare may serve, process and store data outside Australia, including in the United States.
Resend: email delivery, including contact form messages. Email addresses and message contents pass through its servers in the United States.
Google: Google Analytics, through Google Tag Manager, on this website only. Google processes visit data, including your IP address, in the United States and elsewhere. We’ve turned off advertising features and Google signals.

How long we keep it

Your account and birds: until you delete them.
Found-bird reports that are never confirmed by email: deleted after 7 days, with their photos.
Records of professional searches: kept for two years for audit, including after an account closes.
Found-bird reports and sightings: closed a month after we stop matching them (90 days after they’re made, unless the finder keeps a report open), as long as no one has messaged about them in that month.
Found-bird reports, once closed: a year later we remove the finder’s name and contact details, the photos and the messages, keeping only the bird’s description, area and dates.
Reports of messages and flagged matches: deleted two years after we’ve dealt with them.
Our record of what BIRD’s administrators did, and why: kept for seven years, in case it’s needed as evidence.
Invitations to help manage an organisation, including the email address invited: deleted 90 days after they’re accepted, declined, cancelled or expire.
Records of which reminders we’ve sent: deleted after two years. Records of which lost-bird alerts we’ve sent: deleted after 90 days.
Your lost-bird alert postcode: until you turn alerts off, or delete your account.
Expired sign-in sessions and email links: deleted once they run out.
Everything else (open found reports, transfers and applications): kept while the account it belongs to exists, or as described in “Deleting your account” below.
Backups: kept for a limited period, then overwritten.

Deleting your account

You can delete your account from your account settings. We delete your details, your birds and their photos. Some things stay because they belong to other people’s records too: a bird you transferred keeps its history, showing you as “a previous owner”; offspring keep a description of their parents; and found reports you made stay with the owner, without your name or contact details.

Your choices and rights

Choose what professionals can see, in your account’s sharing settings.
Turn reminder emails and lost-bird alerts off, from your account or from any of those emails.
Download a copy of everything BIRD holds about you, from your account.
Ask us to correct anything you can’t fix yourself, or ask about what we hold: contact us. Requests are free, and we answer within 30 days.
If you reported a found bird without an account, use the private link in your email to see or close your report, or contact us.

Security

Connections to BIRD are encrypted. Passwords are hashed, professionals and staff must use two-step sign-in, searches are rate-limited and logged, and photos are only ever served to people allowed to see them. No system is perfectly secure; if we become aware of a breach likely to cause serious harm, we’ll notify the people affected and the Office of the Australian Information Commissioner.

Complaints

If you’re concerned about how we’ve handled your information, contact us. We’ll respond within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner.

Changes

If we change this policy in a way that affects how your information is used, we’ll tell registered users by email before the change takes effect.