Privacy policy

Last updated 10 September 2026

The short version

We collect what we need to run the product: your email, your quiz answers, what you save and open, and your subscription status.
Card details go straight to Stripe. We never see or store them.
We do not sell your personal information, and we do not share it with anyone except the services that make Early Bird work.
You can ask for a copy of your data, ask us to fix it, or ask us to delete it, any time, by emailing info@theearlybird.co.
Some of our providers store data in the United States. We tell you which ones below.

1. Who we are

Early Bird is operated by The Early Bird Co (Early Bird, we, us). This policy covers the website at theearlybird.co, the application at app.theearlybird.co, and the emails we send (together, the Service). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and where they apply to you, other privacy laws such as the UK and EU General Data Protection Regulation.

2. What we collect

Information you give us

Account details. Your email address and a password when you create an account. The password is stored as a one way hash, so we cannot read it. If you sign in with a third party login such as Google, we receive your email address and name from them.
Quiz answers. Your goal, the time you have, your budget, your skills and what kind of work you are drawn to. These produce your match score on each gap.
Subscription details. Which plan you are on, when it renews, and the last four digits and card brand that Stripe reports to us so you can recognise your card. We never receive your full card number.
Messages. Anything you send us by email or through a form, including refund requests and support questions.

Information we collect as you use the Service

Activity. Gaps you view, save and launch, plans you open, tasks you tick, stages you complete, and when you last used the app.
Technical information. Your IP address, approximate location derived from it (country or city level), browser and device type, operating system, language, referring page, the pages you visit and how long you spend on them, and error reports if something breaks.
Email activity. Whether an email we sent was delivered, opened or clicked, where your email client reports that.

We do not ask for, and please do not send us, sensitive information such as health, religious, political, biometric or criminal information. If a quiz answer or message happens to include something sensitive, we treat it with extra care and use it only for the purpose you gave it.

3. Why we collect it

To create and secure your account and let you sign in.
To show you the board, score gaps against your answers, and remember your saves and progress.
To take payment, manage your subscription, send receipts, and handle refunds and disputes.
To send you account emails (sign in links, receipts, renewal reminders, changes to these policies). You cannot opt out of these while you have an account.
To send you product emails, such as the drop notification, if you have opted in. Every one has an unsubscribe link.
To answer your questions and handle complaints.
To understand which parts of the product are used, find bugs, and improve it.
To measure and improve our advertising (see section 6).
To detect fraud, abuse, account sharing and attempts to bypass the paywall.
To comply with the law, including tax and record keeping obligations.

Where the GDPR applies, our legal bases are: performance of our contract with you (account, board, payments); our legitimate interests (improving the product, security, fraud prevention, direct marketing to existing customers); your consent (optional emails, the advertising pixel); and legal obligation (tax records).

4. Who we share it with

We do not sell, rent or trade personal information. We share it only with the providers we use to run Early Bird, each of which may only use it to provide their service to us:

Supabase stores our database and runs sign in. Hosted in the United States.
Stripe processes payments and holds your card details under its own privacy policy. United States, with operations in Australia and Europe.
Vercel hosts the website and app and serves them from data centres near you. United States.
Resend sends our transactional and product emails. United States.
Google Workspace handles our email inbox, so anything you email us is stored with Google.
Analytics and error reporting tools, which receive the technical information in section 2 in aggregated or pseudonymous form.
Meta, if you arrived from one of our ads or the pixel is active (section 6).

We may also share personal information:

with professional advisers such as accountants and lawyers, under confidentiality;
with a buyer or successor if the business is sold or restructured, in which case this policy continues to apply and we will tell you;
where the law requires it, for example to a court, regulator or law enforcement body, or to establish or defend a legal claim;
with anyone else, only with your consent.

5. Overseas disclosure

As listed above, several of our providers store or process data in the United States and potentially other countries. Those countries may not have privacy laws equivalent to Australia's. We choose providers that commit contractually to protect personal information and, where the GDPR applies, we rely on their standard contractual clauses or an adequacy decision. By using the Service you consent to your personal information being handled in those countries as described here.

6. Cookies, analytics and advertising

We use a small number of cookies and similar technologies:

Essential. A cookie or local storage entry that keeps you signed in and remembers your quiz answers and saves on your device. The Service does not work without these.
Analytics. To count visits and see which pages and features are used. Where possible we use tools that do not use cross site cookies and do not build a profile of you.
Advertising. We advertise on Meta platforms (Facebook and Instagram). Our website may load the Meta pixel, which sets cookies that let Meta recognise that your browser visited us, measure whether an ad led to a sign up, and show you our ads later. Meta uses this information under its own privacy policy. You can limit this through your Meta ad preferences, by using your browser's cookie controls, or by installing an ad or tracker blocker. Where the law requires it, we will ask for your consent before loading the pixel.

We do not respond to "Do Not Track" browser signals because there is no agreed standard for them, but the controls above work regardless.

7. How we keep it safe

All traffic to the Service is encrypted in transit. Data is encrypted at rest by our providers. Passwords are hashed. Access to production data is limited to the people who run Early Bird and is protected by two factor authentication. No system is perfectly secure, and we cannot guarantee that unauthorised access will never happen. If we become aware of a data breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

8. How long we keep it

Account, quiz and activity data: while your account is open, and for up to 30 days after you close it, in case you change your mind.
Payment and subscription records: for seven years after the transaction, because Australian tax law requires it.
Support emails: for up to two years after the last message.
Technical logs: for up to 90 days.
Marketing list: until you unsubscribe or ask us to delete you. We keep a record of your unsubscribe so we do not email you again.

After those periods we delete or de-identify the information.

9. Your rights

You can ask us, at any time, to:

give you a copy of the personal information we hold about you, in a readable format;
correct anything that is inaccurate or out of date;
delete your personal information and close your account, except for records we must keep by law;
stop marketing emails, which you can also do from the link in any of them;
restrict or object to certain processing, or withdraw consent where consent is the basis, if you are in the UK or EU;
port your data to another service where the GDPR gives you that right.

Email info@theearlybird.co from the address on your account. We will confirm your identity, and we will respond within 30 days. There is no charge for a reasonable request.

If you are not happy with how we have handled your personal information or a request, tell us first and we will try to fix it. If you are still not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or if you are in the UK or EU, to your local data protection authority.

10. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us their information, email us and we will delete it.

11. Links to other sites

Our plans link to many third party tools and services. We are not responsible for their privacy practices, and this policy does not cover them. Read their policies before you give them your information.

12. Changes to this policy

We may update this policy as the product and the law change. We will update the date at the top, and for a significant change we will email account holders before it takes effect.

13. Contact

The Early Bird Co
info@theearlybird.co