Thicket for Android

Privacy Policy

Last updated: 14 September 2026

This policy explains what information the Thicket app for Android uses, where it goes and what you can do about it. It’s written for people in the UK and the European Union.

In short

• Thicket identifies birds by sound. Sound, including recordings you add, is analysed on your phone. Recordings are never uploaded, and clips only leave your phone if you share one or upload a bird to iNaturalist.
• An account is optional. Without one, everything stays on your phone apart from the approximate location Recent News and rare bird alerts use, the map tiles for a place’s map in Recent News, place names and place searches looked up with your phone’s geocoding service, any feedback you choose to send, birds you choose to upload to iNaturalist, and Android’s backup of the app if you have backups turned on.
• If you sign in, your history and settings are saved to your account so they survive a lost or replaced phone. You can delete your account, and everything saved to it, from Settings.
• There are no ads, no analytics and no tracking, and your information is never sold.

Who is responsible

Thicket is made by Thomas Fearn, who is responsible for your information (the “controller”) under UK and EU data protection law. Contact: privacy@thomasfearn.co.uk.

What stays on your phone

These are kept on your phone, whether or not you have an account. Android’s backup can copy some of them to your Google account, as described under Device backups below.

• Sound. Thicket listens through the microphone while you’re listening and analyses the sound on your phone. The last 10 minutes are kept in memory so you can replay a detection, and are gone when you stop.
• Clips. Clips of detected birds are saved only if you turn on Save clips of birds, and are deleted with their session. They’re never included in device backups, and only leave your phone if you share one or upload its bird to iNaturalist.
• Recordings. Audio files you add from the upload page, or share to Thicket from another app, are copied into Thicket’s own storage, where other apps can’t see them, and analysed on your phone like listening. They’re kept until you delete them in Thicket or delete the app, and are never uploaded or included in device backups. Deleting a recording keeps the session saved from it in History.
• History. Each finished session: when and where it was, the place name, and the birds identified. Live sessions of 10 seconds or more are kept even when no birds were identified, so your listening time counts.
• Life list, badges and listening stats, worked out on your phone from your history.
• Settings and mutes.
• Places. The place Thicket last used, from your phone’s location or chosen by you, and up to eight recent places to choose from, including names you’ve typed for a place, so listening can start without waiting for a location.
• Your approximate location, rounded to about a kilometre, each time Thicket finds your location, so rare bird alerts’ background checks know where to look.

Your location

Thicket asks for your precise location, to know where each session is and which birds are likely there. On Android 12 and later you can allow only approximate location instead; Thicket then works with Android’s approximate location, and your sessions’ coordinates are only as accurate as that.

Thicket looks for your location only while you’re using it: when it opens or comes back to the screen, when you start listening or choose Current location, in Recent News, and when you open the Life List to see which birds are likely around here. Rare bird alerts’ background checks use the approximate location saved on your phone rather than looking again.

Your location leaves your phone only as described below: rounded to about a kilometre for Recent News and rare bird alerts, to your phone’s geocoding service to name a place, and with your history if you sign in. A place’s map in Recent News shows that place, not where you are, though it’s usually nearby.

What leaves your phone, and why

Your account (optional)

If you sign in, Thicket stores the following with Supabase, which hosts the account service in London (UK):

• Your email address.
• An account ID and the time you last signed in.
• Sign-in sessions: for each device you’re signed in on, the IP address and device type recorded when it signed in, kept until you sign out or the session expires.
• Your history: each session’s start and end times, where it was (the place name, and the coordinates of your phone’s location, precise unless you allowed only approximate location, or of a place you chose), the birds identified with their times, confidence and the model that identified them, which you confirmed, rejected or marked as seen, and the file name of a recording it came from.
• Your settings: sensitivity, auto-quiet, common birds, mutes, the confidence percentage, the classifier, saving clips, starting to listen when the app opens, rare bird alerts, Recent News’ distance, period and rarity filter, and whether badges and first-time tags are shown. Places, recent places and the other settings stay on your phone.

This is used only to keep your history and settings in step between your devices and to restore them. Sign-in emails are sent by Resend, an email delivery service, on the account service’s behalf.

Sign in with Google (optional)

• Sign in with Google uses a Google account on your phone. Google tells the account service an ID for your Google account, your email address, your name and your profile picture.
• The account service keeps what Google sends with your account. Thicket itself only uses your email address and account ID.
• If Google gives a verified email address that already belongs to a Thicket account, you’re signed in to that same account, with its history and settings.
• Deleting your Thicket account doesn’t remove Thicket from your Google account. To stop Thicket being able to use Google to sign you in, remove it in your Google Account’s settings.

Google handles sign-in under Google’s privacy policy.

Recent News and rare bird alerts

To show birds reported near you, Thicket sends your location rounded to about a kilometre (or a place you’ve searched for) with the distance and period you’ve chosen:

• eBird (Cornell Lab of Ornithology, United States): the request goes through Thicket’s server at Supabase, so eBird sees the server rather than your phone.
• iNaturalist (United States): the request goes directly from your phone, so iNaturalist also receives your IP address, as with any website. See iNaturalist’s privacy policy.

Recent News makes these requests when Thicket opens, each time it comes back to the screen, and every half hour while it’s open, as well as when you open the tab or pull down to refresh.

Rare bird alerts make the same eBird request in the background, about once an hour when Android lets them run, using your last approximate location. Notifications are created on your phone; no notification service is involved.

Maps

When you open one of Recent News’ top locations, its map is drawn from map images (tiles) downloaded directly from OpenStreetMap‘s tile servers, run by the OpenStreetMap Foundation (UK) through content delivery networks that may be outside the UK. They receive your IP address and which tiles are shown, which reveals the area around that place, usually near you. Tiles are kept in Thicket’s cache for a while, as the servers allow, so they aren’t fetched again each time. See the OpenStreetMap Foundation’s privacy policy.

Your phone’s geocoding service

• Place names: the name of where you are, and of the place a session was in, is looked up from its coordinates with the geocoding service built into your phone. On the Listen screen, the name of a recent place nearby is used instead when there is one.
• Place search: what you type when choosing a place on the Listen screen or in Recent News is sent to the same service to find matching places, once you pause typing.
• Places in recordings’ names: when a recording’s file name includes a place, such as “20260912 0848 Petersfield England”, and none of your recent places has that name, the place’s name is sent to the same service to find it.

On most Android phones this service is provided by Google, under Google’s privacy policy; on others, by the phone’s maker.

Perch, from Google Play

If you choose Perch as the classifier in Settings, Google Play downloads its model to your phone, as it downloads apps, under Google’s privacy policy. Perch then runs on your phone, like BirdNET: no sound or identifications are sent anywhere.

Feedback you send

If you send feedback from Settings > Send Feedback, Thicket stores it with Supabase in London (UK):

• What you write, and whether it’s an idea, a problem or other feedback.
• Your email address, only if you leave it in the form. When you’re signed in, the form fills in your account’s email, and you can remove it.
• Your account ID, if you’re signed in when you send it.
• The app version, Android version and device model (for example “Pixel 8”), to help track down problems.

It’s used only to read your feedback, reply if you asked, and improve Thicket.

iNaturalist uploads (optional)

If you sign in to iNaturalist from Export and upload birds, Thicket sends each bird you choose straight from your phone to iNaturalist (United States), under your own iNaturalist account:

• The observation: the species, when its call was heard, the session’s coordinates and how accurate they are, the location privacy you chose (open, obscured or private), and a note that it was identified by sound with Thicket and whether you saw it or checked its call.
• A clip of its call, as a sound file.

Signing in opens iNaturalist’s website in your browser. iNaturalist also receives your IP address, as with any website. Your iNaturalist sign-in is kept in Thicket’s private storage on your phone and left out of device backups; it isn’t sent to Thicket’s server or saved to your Thicket account, and Sign out removes it. What you upload is then iNaturalist’s to handle, under iNaturalist’s terms and privacy policy; you can edit or delete your observations on iNaturalist.

Things you choose to share

Share cards, captions, clips and exports are created on your phone and go wherever you send them, for example to a messaging app or a social network. Thicket doesn’t receive a copy.

• A session’s card shows how many species you heard, the place name, the date and how long you listened, and up to seven of the birds, marking the ones you saw.
• A bird’s card shows its name, how confident Thicket is, when and where you heard it, and a waveform of its call when there’s a clip.
• A Recent News card shows a species’ latest report: where and when it was reported, on eBird or iNaturalist, and whether it’s scarce or rare.
• Captions say the same in words, with the place name rather than coordinates, and for a Recent News report a link to it on eBird or iNaturalist.
• Clips are shared as sound files.
• Exports are CSV files, for eBird, BirdTrack or a spreadsheet, listing the birds you marked as seen or confirmed by ear in a session or a period: when and where each session was (place name, coordinates, how accurate they are and the time zone), and each bird’s name, times, number of detections, confidence and the model that identified it. They go only where you send them; Thicket doesn’t upload them to eBird or BirdTrack.

Cards, clips and exports are saved in Thicket’s cache while they’re shared. Ones more than an hour old are removed the next time you share something, and Android can clear the cache at any time.

Device backups

If backups are turned on in your phone’s settings, Android copies Thicket’s data to your Google account, under Google’s privacy policy, so it can be restored if you reinstall Thicket or get a new phone. It copies the same data when you move to a new phone directly from your old one.

This includes your history, settings and mutes, places, your last approximate location, and Thicket’s own records, such as which rare birds you’ve already been alerted about. It leaves out:

• your sign-ins to your Thicket account and to iNaturalist, so you sign in again after restoring,
• saved clips, which stay on the phone they were saved on, and
• recordings you’ve added, which stay on your phone too.

Thicket can’t see your backups. You can turn backups off in your phone’s settings.

Server logs

Thicket’s server (Supabase) keeps a record of requests, including IP addresses, for a short time (currently one day) to keep the service running and secure.

Legal bases

• Providing the service you asked for (contract): your account, including Sign in with Google, syncing, Recent News reports and maps, downloading Perch, and uploads to iNaturalist.
• Legitimate interests: keeping the service secure and working, such as server logs, and reading and replying to feedback you send.
• Your permission (consent): the microphone, precise or approximate location and, from Android 13, notifications, which Android asks you for. You can turn each off at any time in your phone’s settings, and Thicket keeps working with less.

How long information is kept

• Account information is kept until you delete your account. Deleting it removes your account, history and settings from the account service straight away; copies in the service’s backups, if any, are removed as those expire.
• Sign-in sessions last until you sign out or they expire.
• Feedback is kept while it’s useful for improving Thicket. Feedback sent while signed in is deleted with your account, and you can ask for any feedback you’ve sent to be deleted.
• Server logs are kept for about a day.
• Information on your phone is kept until you delete it or the app.

Who else is involved

• Supabase hosts the account service, feedback and Thicket’s server in London, under a data processing agreement. Supabase is a US company, so its staff may access information from outside the UK to run the service, under legal safeguards such as standard contractual clauses.
• eBird receives approximate locations from Thicket’s server; iNaturalist receives them from your phone, and the birds you upload to it. Both are in the United States.
• Resend (United States) sends sign-in emails on the account service’s behalf.
• The OpenStreetMap Foundation (UK) provides the map tiles for places in Recent News, directly to your phone.
• Google provides Sign in with Google, the Perch download through Google Play and Android’s device backups, and on most phones place names and place search through your phone’s geocoding service (on others, your phone’s maker does).

Your information isn’t sold or used for advertising.

Your rights

Under UK and EU data protection law you can ask to:

• see the information held about you,
• correct it,
• delete it (you can also delete your account in Settings > Account),
• restrict or object to its use,
• receive it in a portable format.

Email privacy@thomasfearn.co.uk to use any of these. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EU, the authority in your country.

Children

Thicket isn’t aimed at children. If you’re under 13, or under the age your country sets for agreeing to online services yourself, please ask a parent or guardian before creating an account.

Security

Information travels over encrypted connections. Each account can only read and change its own history and settings, and there are no passwords to leak: sign-in uses Google, or a one-time email link or code.

This website

Separately from the app: if you give your email address on thicketbirds.com to be told when Thicket is released, that address is stored in a database run by Cloudflare on Thomas Fearn’s behalf, and may be passed to an email delivery provider solely to send that announcement. The lawful basis is your consent. It’s used for that message and nothing else: it isn’t added to any other mailing list and it isn’t shared. Ask at the address below to have it removed at any time.

These pages set no cookies, run no analytics and load nothing from other websites. Cloudflare, which serves the site, keeps standard server logs, including IP addresses, for security.

Changes to this policy

If this policy changes, the date at the top will change too. Significant changes will be pointed out in the app.

Contact

Thomas Fearn, privacy@thomasfearn.co.uk