Skip to content

Privacy Policy

Last updated 26 October 2026.

Version 2. This version takes effect on the date shown as last updated at the top of this page, and replaces the policy dated 1 January 2021. It is written for the Protection of Personal Information Act, 2013 (POPIA), and for what Bïndo does today.

In plain language

  • We collect what we need to run a birding app: who you are, what you saw, where and when, and the photos and recordings you attach.
  • Your name goes with your records. Other birders and, in some cases, the public can see your sightings, subject to the privacy controls in the app.
  • We share records with bird atlassing, research and conservation, and we use photos, recordings and sightings to build and improve the tools that identify birds.
  • We do not sell your personal information, and we do not show advertising.
  • Some of our providers are outside South Africa. We tell you which, and where.
  • You can see, correct, export and delete your information, and you can complain to the Information Regulator.

1. Who is responsible

The responsible party for your personal information is Bindo Group (Pty) Ltd (registration number 2020/853100/07), Unit 105 La Montagne, 35 Marmion Road, Oranjezicht, Cape Town, 8001, South Africa. In this policy "Bïndo", "we", "us" and "our" mean Bindo Group (Pty) Ltd.

Our Information Officer is Robert Elliott, Director, who can be reached at support@bindo.app or at the address above.

This policy covers the Bïndo mobile apps for iOS and Android, the web app at web.bindo.app, the website at bindo.app, and the emails we send. It should be read with our Terms of Service, which set out the licence you give us over what you add to Bïndo, and our Child Safety Standards.

It does not cover other organisations you deal with through Bïndo, such as the atlas project you submit cards to, or Apple, Google, Paystack and other providers, whose own policies apply to what they do with your information.

2. What we collect

Your account. Your full name, email address, display name, profile photo, password (stored only as a hash by our sign-in provider), the tags on your profile, and your settings. If you sign in with Apple or Google, we receive your name and email address from them, or a relay address if you choose to hide your email.

Your sightings and lists. The species, the date and time, the precise location, counts, notes, whether the record is marked sensitive or private, the lists it belongs to, your SABAP2 observer number if you enter one, and the verification and review status we attach. This is the core of Bïndo and most of it is visible to other birders, as section 6 explains.

Photographs. Photographs you attach to sightings and lists, their dimensions, and the metadata in the file. A photograph attached to a sighting is placed at the sighting's location, not at the location in the file. A photograph attached to a list keeps the file's location information, if it has any. Photographs are stored and delivered by Cloudflare and Amazon Web Services.

Sound recordings. Recordings you make or upload for Bird Call ID, recordings you attach to sightings, and recordings you attach to lists or trips, together with their length, quality, the species our model suggested and how confident it was, and the sharing choices you make. Bird Call ID processes your clip on our own servers to suggest a species; the clip is only kept if you choose to keep it. Any recording we hold, whether or not you have shared it with other birders, may be used to train and improve the models that identify birds by their calls, as section 4 explains. Voice Add listens for a bird's name and uses your device's speech recognition, which stays on the device where the operating system supports that and otherwise uses Apple's or Google's speech service.

Location. Your device's location while you are using the app, to place sightings, show what is nearby, and load the right maps. We do not track your location when you are not using the app. You can turn location off in your device settings, and enter a location by hand instead.

Device and technical information. Device model, operating system and app version, language, time zone, IP address, crash and performance information, and identifiers for your device and installation. Our servers keep logs of requests, including IP addresses and account identifiers.

How you use Bïndo. Which screens and features you use, in the app and in the web app, and events such as adding a sighting, starting a list or opening the membership page, so that we can see what works and fix what does not. This is collected through PostHog, an analytics service. In the web app this starts when you first open a page, before you sign in, and is linked to your account once you do.

Social activity. Who you follow and who follows you, groups and shared lists you belong to, likes, comments, blocks, reports you make, and invitations you send or receive.

Payments. If you become a Member on the web, Paystack processes your card. We receive confirmation of payment, the last four digits and type of card, the email address used, and the subscription status, and we keep records of charges, refunds and failed payments. If you subscribe through the App Store or Google Play, Apple or Google process the payment and we receive a purchase confirmation and a subscription status through RevenueCat. We never receive your full card number.

Imports. Files you upload to import sightings from another platform, and the records in them.

Support and communications. Emails you send us, and our replies.

On the website (bindo.app). If you vote in a campaign such as the club caps vote, we store a one-way hash of your email address so that each address votes once. We also keep the address itself, on a list kept apart from the votes, so we can tell you when the caps are made; it does not record which design you chose, and you can leave the list at any time. The website does not run analytics.

Early access. If you apply for or are invited to early access to the web app, your email address and invitation status.

Information about other people. A sighting logged to a shared list is visible to the other members. A recording may capture other people's voices. Please do not upload recordings of other people's conversations, or personal information about others, beyond what a sighting needs.

3. Special personal information and children

We do not ask for and do not intend to collect special personal information under POPIA, such as information about your health, religion, race or biometrics. Sound recordings are used to identify birds, never to identify people by their voices.

Bïndo may be used by people under 18 only with a parent's or guardian's consent, and children under 13 may not hold their own account, as set out in the Terms of Service. Where we process a child's personal information we do so on the basis of that consent. If you believe a child has given us personal information without consent, contact us and we will delete it.

4. Why we use your information, and on what basis

POPIA allows us to process personal information where it is necessary to provide what you have asked for, where you have consented, where the law requires it, and where it is needed for our or a third party's legitimate interests that are not outweighed by yours. The purposes below say which applies.

To run Bïndo for you (necessary for our agreement with you). Creating and securing your account; storing and syncing your sightings, lists, photos and recordings across your devices; showing you your own records, statistics and lists; showing you what is nearby; suggesting species; sending the emails needed to run your account, such as a welcome, a receipt or a security notice.

To run the community (necessary for our agreement with you, and our legitimate interest in running a shared record). Showing your sightings, photos, recordings, lists and profile to other birders according to your privacy controls; feeds, leaderboards, groups, shared lists, challenges, comments and likes; letting other birders follow you; and letting you block and report.

To keep the record honest (our legitimate interest, and the interest of everyone who relies on the data). Verifying, flagging and reviewing sightings; detecting fabricated, mislocated or duplicated records; and enforcing the Terms of Service. We use automated checks that compare records against species distributions, dates and past records, and produce internal quality signals about accounts. A person reviews before any decision that significantly affects you, and you can ask us to review any decision.

For conservation, atlassing and research (your consent, given in the Terms of Service, and the legitimate interest in bird conservation). Submitting atlas cards to SABAP2 when you choose to; sharing sightings, photographs and recordings, with place, date, species and attribution, with bird atlas projects, universities, research institutions, conservation organisations and open biodiversity datasets; and publishing aggregated statistics about birds and birding.

To build and improve the tools that identify birds (your consent, given in the Terms of Service, and our legitimate interest in improving the Services). Using photographs, sound recordings, sightings and text to develop, train, test and improve the models and features behind Bird Call ID, image and trait-based identification, Next Bird, error detection and similar features, and to produce derived data such as embeddings and labels. This includes every sound recording we hold, including recordings you have not shared with the community. Audio used for Voice Add is not kept and is not used for training. Where we can, we do this without your name attached.

To show birds to the public (your consent, given in the Terms of Service). Showing community photographs and recordings, credited to you by display name, on species pages and on public pages of our websites that search engines can index.

To take payment and manage Membership (necessary for our agreement with you, and legal obligation). Charging subscriptions, sending receipts, handling refunds and failed payments, preventing fraud, and keeping the financial records the law requires.

To improve Bïndo (our legitimate interest). Analysing how the app and web app are used, diagnosing crashes and slow screens, and testing changes.

To keep you informed (your consent, or our legitimate interest in telling existing users about similar services, with an opt-out). Emails about challenges, new features and Bïndo news. Every such email has an unsubscribe link, and we send them only as POPIA section 69 allows. We never send marketing on behalf of anyone else.

To protect people and comply with the law (legal obligation, and legitimate interest). Responding to lawful requests from authorities, protecting the safety of people, birds and places, and establishing or defending legal claims.

5. Your controls

  • Private profile. Limits who can see your activity to the people you approve.
  • Sensitive sightings. Marking a sighting sensitive hides its precise location from other birders. Some species are treated as sensitive automatically.
  • Private sightings and areas. Records and areas you mark private are visible only to you.
  • Recordings. From My Recordings you can withdraw any recording from community sharing at any time, and it will stop being played. Recordings on lists and trips are never shared with the community. Withdrawing a recording from sharing does not remove it from training use; deleting the recording does, for any future training set.
  • Location. Grant or revoke the app's location permission in your device settings, and enter locations by hand.
  • Microphone and camera. Granted only when you use Bird Call ID, Voice Add or take a photo, and revocable in your device settings.
  • Blocking and reporting. Block any birder, and report recordings and other content from the app or by email.
  • Emails. Unsubscribe from marketing email using the link in any such email. Service emails, such as receipts and security notices, cannot be switched off while you have an account.
  • Delete a sighting, photo or recording at any time from the app.
  • Export your sightings and lists from the app, or ask us for a copy at support@bindo.app.
  • Delete your account from Settings in the app or by emailing us. Section 8 explains what happens.

6. Who can see your information, and who we share it with

Other birders and the public. Your name, display name and profile photo are visible to other Bïndo users. Your sightings, lists, photographs and shared recordings are visible to other users according to your privacy controls, and appear in feeds, on the map, on species and area pages, and on leaderboards. Community photographs and recordings, credited to you, may also appear on public pages of our websites and on our social media accounts, and public pages may be indexed by search engines. Precise locations of sightings you mark sensitive or private are hidden.

Bird atlassing. When you submit an atlas card to SABAP2 we send the card, your SABAP2 observer number and the email address on your account to the atlas project, which is run by the FitzPatrick Institute of African Ornithology at the University of Cape Town. Their own policies then apply, and we cannot recall a card once it has been submitted.

Research and conservation partners. We share sightings, photographs and recordings, with place, date, species and attribution, with universities, research institutions, conservation organisations and open biodiversity datasets, under agreements or licences that require attribution and prohibit resale of the content on its own. Precise locations of sensitive records are generalised or withheld. Today the only such flow is atlas cards to SABAP2, which you initiate yourself; partners we may add include the South African National Biodiversity Institute (SANBI), BirdLife South Africa and open biodiversity databases such as GBIF, and we will name them here when a data flow exists.

Challenge sponsors. If you win a prize supplied by a sponsor, we give the sponsor your name and delivery details so they can send it, and nothing else.

Service providers. Companies that process information for us, under contracts that require them to protect it and use it only for our purposes:

  • Amazon Web Services (Ireland, EU): sign-in through Cognito, our servers and API, Bird Call ID inference, file storage and backups.
  • MongoDB Atlas (Ireland, EU): the database that holds your records.
  • Cloudflare (global network): storage and delivery of photographs and recordings.
  • Vercel (United States and global edge): hosting for web.bindo.app and bindo.app.
  • PostHog (United States): usage analytics for the app and the web app.
  • Twilio SendGrid (United States): sending our emails.
  • Paystack (South Africa): card payments for web subscriptions.
  • RevenueCat (United States): managing App Store and Google Play subscriptions.
  • Apple and Google (United States and global): sign-in, app distribution, in-app billing and speech recognition.
  • Mapbox (United States): maps in the app.
  • Upstash (United States): the vote counter on bindo.app, and the list of voters' email addresses.
  • GitHub (United States): storage of the website's content, including journal images.

Legal and safety. We may disclose information where the law requires it, to respond to a court order or a lawful request from an authority, to protect the safety of a person, a bird or a place, to enforce our terms, or to establish or defend legal claims.

Business changes. If Bïndo is sold, merged or reorganised, your information may be transferred to the new owner, who must honour this policy or tell you before using it differently.

We do not sell personal information, and we do not share it with advertisers.

7. Information leaving South Africa

Bïndo is run from Cape Town, but much of our infrastructure is outside South Africa: our servers, sign-in and file storage are in Ireland, and several providers listed above are in the United States. Your information is therefore transferred to and stored in those countries.

POPIA section 72 allows this where the recipient is bound by a law or an agreement that protects your information in a way substantially similar to POPIA. Our providers in the European Union are subject to the GDPR, and our contracts with providers elsewhere require protection equivalent to it. By using Bïndo you also consent to these transfers.

8. How long we keep information, and what happens when you delete your account

While you have an account we keep your information for as long as it is needed to provide the Services to you.

When you delete your account, the following are deleted promptly, usually within minutes: your profile, sightings, lists, comments, likes, notifications, feed items, follows, and your sign-in account. You are removed from groups and shared lists, and leaderboards are recalculated.

Your photographs and recordings are deleted too. They stop being visible anywhere the moment you delete your account, and are removed from our systems 90 days later. Backup copies of the files can take up to a further 30 days to cycle out of our storage. Once deleted, they cannot be reinstated.

We keep a copy of your sightings for 90 days. It is written as your account is deleted, kept encrypted and separate from the Services, and used for nothing else. It is there so that you can still ask us for your own records after the account is gone. Email support@bindo.app from the address the account used, within those 90 days, and we will send it to you. After 90 days the copy is deleted automatically and there is nothing left for us to send.

We may keep information for longer only where we reasonably need it to investigate suspected fabricated records, other misuse of the Services or a breach of the Terms; to comply with the law or a lawful request from an authority; or in connection with an actual or possible legal claim. We keep it for as long as that purpose requires and then delete it.

Backups. Copies remain in our routine database backups, which are kept on a rolling basis and overwritten on schedule, and in a small number of long-term backup copies held for disaster recovery. Backups are used only to restore the service after a failure, never to reinstate deleted information.

Other things that remain:

  • Records already sent to SABAP2, or shared with research and conservation partners, stay with them, and we cannot recall them.
  • Models already built using your photographs, recordings and sightings are not unbuilt, but nothing of yours is added to a new training set after deletion.
  • A recording of yours that a moderator chose as the reference recording for a species stays on that species page after you delete your account, with your name removed. If you would rather it did not, withdraw it from community sharing in My Recordings before deleting your account. No other photograph or recording is kept.
  • Your contributions to shared lists remain part of the shared record, without your name.
  • Payment and refund records are kept for as long as tax and company law require, which is at least five years.
  • Server logs are kept for 90 days.
  • Aggregated, de-identified statistics are kept indefinitely.

Content you shared that other people copied, and public pages cached by search engines, may remain visible for a time after deletion.

9. Security

We protect your information with encryption in transit and at rest, access controls, and providers who hold recognised security certifications. Passwords are never stored in a form we can read. No system is completely secure, and we cannot guarantee that unauthorised access will never happen. If a breach affects your personal information we will notify the Information Regulator and, where required, you, as POPIA section 22 requires.

10. Your rights

Under POPIA you have the right to:

  • be told what personal information we hold about you, and to receive a copy, free of charge;
  • have inaccurate or incomplete information corrected;
  • have information deleted, where we no longer have a lawful reason to keep it;
  • object to processing based on our legitimate interests, and to any direct marketing;
  • withdraw consent you have given, without affecting what was done before;
  • not be subject to a decision based solely on automated processing that has a significant effect on you; and
  • complain to the Information Regulator.

To exercise any of these, email support@bindo.app. We may ask you to confirm your identity. We aim to respond within 30 days.

The Information Regulator (South Africa) can be reached at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; by telephone on 010 023 5200; for complaints at POPIAComplaints@inforegulator.org.za; and for general enquiries at enquiries@inforegulator.org.za.

If you are in the European Economic Area or the United Kingdom, you have equivalent rights under the GDPR and UK GDPR, and may also complain to your local data protection authority. We do not have an establishment or a representative in those regions.

11. Automated decisions

We use automated checks to flag records that look unusual, mislocated or fabricated, and to produce internal quality signals about accounts. These help our team decide where to look. Any decision that significantly affects you, such as hiding your records, restricting your profile or closing your account, is made by a person, and you can ask us to review it.

12. Cookies and similar technologies

The web app uses cookies that are strictly necessary to keep you signed in and to remember settings such as your feed view. It also sets a PostHog cookie and a local storage entry that hold a random identifier for your browser, so that we can tell one visit from another for the usage analytics described in section 2; if your browser sends a Do Not Track signal, or has data saving on, this is not set. The website sets no cookies for visitors, and a sign-in cookie for editors. Neither uses advertising cookies. The mobile app uses device and installation identifiers for analytics and to keep you signed in. You can clear cookies in your browser, but you will be signed out.

13. Changes to this policy

We may update this policy. If a change is material we will tell you by email or in the app before it takes effect, and we will update the date at the top of this page. Continuing to use Bïndo after a change takes effect means you accept it.

14. Contact

Bindo Group (Pty) Ltd Attention: Information Officer Unit 105 La Montagne, 35 Marmion Road, Oranjezicht, Cape Town, 8001, South Africa support@bindo.app