Privacy policy
Last updated 12 October 2026
Feedback Pigeon is where you report bugs, suggest features and see what’s new in our apps. This policy explains what we collect when you use it, why, and the choices you have. In short: we collect only what we need to run the boards, we never sell your data, and there’s no advertising or tracking.
Who we are
Feedback Pigeon is run by Way of the Pigeon Ltd, a company registered in England & Wales (company number 16797488), registered office 82, Suite A, James Carter Road, Mildenhall, IP28 7DE. We’re the data controller for the information described here, and we’re registered with the Information Commissioner’s Office (registration number ZC178319). Questions about privacy go to hello@feedbackpigeon.com.
Some boards on Feedback Pigeon may be run by other organisations. For those, that organisation decides how feedback on its board is used and is the controller for it; we process it on their behalf.
What we collect
| What | Why | Lawful basis |
|---|---|---|
| Your account: email address, display name and picture (from Google if you sign in with Google, or from the app that signed you in) | To sign you in, show who posted what, and email you updates you asked for | Contract (providing the service) |
| What you post: posts, comments, votes (and how important something is to you), follows and images you attach | That’s the service. Public boards are visible to anyone; private posts only to you and the team | Contract |
| Details attached to bug reports: app version, system (e.g. “Windows 10/11”), browser, page, screen size and language | So the team can reproduce and fix the problem. You can see exactly what’s attached before you send | Legitimate interests (fixing our software) |
| A guest’s email address, if you add one to a report without an account | So the team can reply. Only the team sees it | Consent (you choose to give it) |
| Notifications and your email settings | To tell you when something you follow changes, gets a reply or ships | Legitimate interests — you can switch each kind off |
| Billing, if your workspace is on a paid plan: the name and email on the subscription, your workspace, plan and billing status. Card details go straight to Paddle — we never see or store them | To take payment, send receipts and invoices, and switch on what you’ve paid for | Contract, and legal obligation (keeping tax records) |
| Technical data: IP address and request logs held by our hosting providers, and the “are you human?” check on guest reports | Security, preventing spam and abuse, keeping the service running | Legitimate interests |
We don’t use your data for advertising, we don’t sell it, and we don’t build profiles of you. We read feedback to decide what to build — that’s the point of it.
Signing in with Google
If you choose Continue with Google, Google asks you to share three things with us, and that’s all we receive: your name, your email address and your profile picture (the standard “openid”, “email” and “profile” permissions). We never see your Google password and we get no access to your Gmail, contacts, Drive, calendar or anything else in your Google account.
- How we use it: only to create and sign in to your Feedback Pigeon account, show your name and picture next to what you post, and send the emails you’ve asked for (replies, status changes, what shipped). Nothing else.
- Where it’s kept: in your account in our Supabase database (London, UK), until you delete your account.
- Sharing: we don’t sell it or share it with anyone, and never use it for advertising, profiling or to train AI models. Your name and picture appear on your public posts; your email address is never shown publicly (the team of a board you post on can see it so they can reply).
- Removing it: delete your account on My feedback and we delete what we received from Google with it. You can also remove Feedback Pigeon’s access at any time from your Google Account’s security settings (Third-party apps and services).
Feedback Pigeon’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Signed in through one of our apps instead (for example Collektory)? That app passes us the same three things — your name, email and picture — under the same rules.
Who helps us run it
- Supabase — database, sign-in and file storage, hosted in London (UK).
- Cloudflare — serves the website and runs Turnstile, the “are you human?” check on guest reports.
- Resend — sends our notification emails.
- Paddle — our reseller for paid plans (Paddle.com Market Ltd, the merchant of record). Paddle takes the payment, handles VAT and sales tax, and sends receipts and invoices. For the checkout itself Paddle is a controller of the details you give it, under Paddle’s privacy notice; it tells us which workspace has paid and for which plan.
- Google — only if you choose “Continue with Google”.
Some of these providers may process data outside the UK (for example in the United States). Where they do, transfers are covered by the UK’s adequacy regulations or the International Data Transfer Addendum / standard contractual clauses.
How long we keep it
- Your account and what you’ve posted: until you delete your account (or ask us to).
- Guest emails: as long as the report they came with.
- Billing records (plan, payments, invoices): six years after the end of the financial year they belong to, because UK tax law asks us to keep them.
- Images that were uploaded but never posted: deleted automatically within about a week.
- Hosting logs: kept by our providers for short periods, typically days to weeks.
Your rights
You can ask to see, correct, export or delete your personal data, and object to or restrict how we use it. Two of these are self-service: on My feedback you can export your data as a file and delete your account. When you delete your account we remove your sign-in, profile, votes, follows, notifications, comments, private posts and uploaded images; public posts stay up without your name because other people voted on them (delete them first if you’d rather they went too).
For anything else, email hello@feedbackpigeon.com. We’ll reply within a month. If you’re unhappy with how we’ve handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies and storage
We only use storage that’s needed for the site to work, so there’s no cookie banner:
- Sign-in session (your browser’s local storage) — keeps you signed in.
- Theme (local storage) — remembers light or dark if you pick one.
- Unsent posts (local storage) — what you’ve typed into a new post until you send it, so it isn’t lost if you close the window or sign in part-way. Cleared when you send it, or after a week.
- “What’s new” last seen — inside an app that shows our widget, remembers when you last read the release notes so it can show an unread dot.
- Cloudflare Turnstile — may set what it needs to tell people from bots on guest reports.
No analytics, advertising or social-media trackers.
Children
Feedback Pigeon isn’t meant for children under 13, and we don’t knowingly collect their data. If you think a child has given us personal data, email us and we’ll remove it.
Changes
If we change this policy we’ll update the date at the top, and tell signed-in people about significant changes.