Last updated: October 31, 2026
Little Bird Says lets people send feedback to organizations without giving their name or email. This policy explains what we collect, what organizations can see, and how long we keep it. It covers our website, littlebirdsays.com, and the app at app.littlebirdsays.com. Little Bird Says is run by We Are Volume LLC, 92 Oak Ridge Road, Greenfield Park, NY 12435, United States (“we”, “us”). Little Bird Says is intended for people and organizations in the United States.
If you send feedback anonymously
You don’t give us a name, email address or phone number. Your only login is a private identity code that we show you once.
- Your identity code. We store a one-way, keyed fingerprint of it, never the code itself. We cannot show it to you again or recover it if you lose it.
- Your conversations. We store the subject and messages you send and the replies you receive, so you and the organization can read them.
- No contact details. Because we have none, we can’t notify you of replies. Check back with your code.
What the organization sees: your subject, your messages, the date and time of each message, and which of its locations or event codes you wrote to. It does not see your IP address, device, browser, location, or anything that links your conversations with it to conversations with other organizations.
What can still identify you: what you write. If your message includes names, dates or details only you would know, the organization may work out who you are. Write with that in mind. Your employer’s or school’s network, or a device it manages, may also record that you visited Little Bird Says and when. For the most privacy, use a personal device on a personal connection, and sign out when you’re done.
We can’t tell an organization, or anyone else, who you are: we never collect your name or contact details, and we don’t store your IP address with your identity or your feedback. If the law requires it, we may have to share what we do hold, such as your messages.
If you use Little Bird Says for an organization
- Account details: your email address, a password (stored by our sign-in provider as a secure hash, never readable by us), and the display name you choose. Your display name is shown to your colleagues, never to anonymous senders.
- Organization details: organization and location names, addresses and descriptions you enter, feedback codes, and members’ roles.
- Audit log: security events such as invitations, membership and permission changes, and settings changes, with who did it and when. It contains no message content.
- Email: we send verification, password-reset, invitation, security and new-feedback emails. Feedback emails link to the conversation and never include its text. You can turn feedback emails off per organization on your profile.
IP addresses and abuse protection
To stop spam and password guessing, we briefly keep a scrambled form of the network (IP) address of some requests, such as creating an identity, failed sign-ins, failed code lookups, and directory searches. It can’t be turned back into an address from our database, isn’t stored with your identity or your feedback, and deletes itself automatically after 13 hours at most. We also use a proof-of-work check (ALTCHA) that runs in your browser and sets no cookies.
Our app doesn’t write IP addresses to its logs. Our hosting provider, DigitalOcean, may keep its own logs of requests, including IP addresses, under its own policies; we don’t copy or forward them, and we don’t use them to identify anyone who sends feedback.
Our website
Our website only describes Little Bird Says; it has no accounts or forms. Its server, run on DigitalOcean, keeps standard logs of the pages requested, including IP addresses and browser details, to keep the site running and secure. If you email us at support@littlebirdsays.com, we keep your message and address to answer you.
Cookies
The app uses only the cookies needed to keep you signed in. Neither the app nor our website uses advertising or tracking cookies, so there is no cookie banner.
| Cookie | What it does | How long it lasts |
|---|---|---|
| sAccessToken | Keeps you signed in | Up to 1 year; the token inside expires after about 1 hour and is renewed while you use the app |
| sRefreshToken | Renews your sign-in; only sent to the sign-in service | About 100 days |
| sFrontToken | Lets the app know you’re signed in and when your sign-in expires | Same as your sign-in |
| sIRTFrontend, st-last-access-token-update | Small helpers that track sign-in renewal | Same as your sign-in |
These cookies are marked Secure, so they’re only sent over an encrypted (HTTPS) connection, and the sign-in tokens can’t be read by scripts on the page. Signing out ends your session on our servers and removes these cookies.
On a shared or work device, sign out when you’re done. Otherwise you stay signed in on that device for up to about 100 days.
Analytics
We may use privacy-friendly, cookie-free analytics, such as Umami Cloud, on our website and the app to count page views and see which pages are used. When we do, it sets no cookies and doesn’t track you across websites, and we never send it your identity, your feedback, or your account details. Umami Cloud stores this data in the United States.
Who processes data for us
| Provider | What for |
|---|---|
| DigitalOcean | Hosting the app, its database, and our website |
| SuperTokens | Sign-in and sessions (receives organization members’ email addresses and password hashes; never anonymous identity codes or feedback) |
| Mailgun | Sending email to organization members |
| Umami | Cookie-free page-view analytics (Umami Cloud), when in use |
| Font Awesome | Icons, loaded from Font Awesome’s servers, which receive your IP address and browser details when the icons load. We don’t send them your identity or your feedback. |
| Google Fonts | Fonts on our website, loaded from Google’s servers, which receive your IP address and browser details when the page loads |
We don’t sell personal data or share it for advertising.
How long we keep things
| Data | Kept for |
|---|---|
| Conversations | 26 months after the last message, then deleted automatically. A new message restarts the clock. |
| Audit log entries | 26 months after the event |
| Database backups | 7 days, so deleted data can remain in a backup for up to 7 more days |
| Scrambled IP abuse counters | 13 hours at most |
| Anonymous identities, member accounts, organizations | Until deleted on request |
Security
Data is encrypted in transit (TLS) and at rest by our database provider. Messages are not end-to-end encrypted: our authorized staff can technically read them, and we access them only to run the service, investigate abuse, or meet legal obligations. We work to the best of our ability to keep data secure and senders anonymous, but no service can guarantee either.
Your choices and rights
Organization members can view and change their name, email and password on their profile. To delete an account or organization, or to ask about your data, email support@littlebirdsays.com. Anonymous senders: because we hold no contact details, we can only help with an identity you can prove you hold. Depending on where you live, you may have rights to access, correct, delete or object to the use of your data, and to complain to your data protection authority. If you’re in the EU or UK: we use your data to provide the service you ask for, to protect it from spam and abuse (our legitimate interest), and to meet legal obligations.
Children
Little Bird Says is not intended for children under 16, and you must be 16 or older to use it.
Changes
We’ll update the date above when this policy changes, and tell organization members by email about significant changes.