Privacy Policy
Last updated: 14 September 2026 · Stird LTD
Who we are
Stird LTD (“we”, “us”) is the data controller for personal data collected through Stird. If you have any question about your data, email [email protected].
Information we collect
Account information. Your email address and sign-in credentials, or — if you use Google sign-in — the profile information Google shares with us (email, name, profile picture).
Your profile. Your display name, handle, avatar image, and any bio you add. Avatar images are automatically re-processed on upload to remove embedded location and device information.
Content you create. Your memories, entries, and stories, together with the audience you choose for each one:
- Private — only you
- Friends — people you and the other user have mutually connected with
- Followers — people who follow you (following doesn’t require your approval, but you can remove a follower at any time)
- Public — everyone
A wider audience choice means more people can see that content.
Conversations. Messages you exchange with a digital twin — your own, or someone else’s. See “Digital twins and AI” below for how these are used. If you own a twin, you can view the conversations it has had, including with visitors, from your account.
Voice data. If you start a voice or video call with a twin, your microphone audio is processed in real time to power the call.
Location. If you choose to add a location to your profile for the discovery map. You can remove it at any time in settings.
Reactions and feedback. Reactions you leave on messages, and any feedback you submit through our in-product feedback form (your message, the page you were on, and basic device information).
Invite and referral data. Which invite code you used, and who referred you, where relevant.
Payment information, if you subscribe to a paid plan: your plan, billing interval, subscription status, renewal date, and your card brand and last 4 digits, together with identifiers from our payment provider. Your full card number, expiry date, and security code are never sent to or stored on our servers — card entry happens entirely on our payment provider’s own checkout page, and we don’t keep a copy of your invoice history.
Technical information. Standard server logs (IP address, browser, request data), and — if you consent — analytics cookies. See our Cookie Policy for details.
Digital twins and AI
Stird lets you create a “digital twin”: an AI system, built from content you choose to share, that can hold conversations — including with other people — on your behalf.
- You’re talking to an AI, not to the person. When you chat with someone else’s digital twin, you’re interacting with a system that generates responses from that person’s shared content. You are not messaging them directly.
- A twin’s replies are generated, not verified statements. They may not reflect that person’s current views, may contain errors, or may be outdated. Don’t treat a twin’s output as a statement the represented person has personally made or endorsed.
- What a twin is built from. The content its owner has created, subject to the audience settings they’ve chosen, plus their own conversations with their twin. Content marked “private” is not used to answer other people.
- Your messages are processed by our AI infrastructure (see “Who we share information with” below) to generate a response and, for your own twin, to help it learn over time.
How we use your information and our legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account and profile data | Operating your account | Contract |
| Content you create, and your audience choice | Building and running your digital twin; showing content to the audience you chose | Contract; consent for public/follower visibility |
| Conversations | Generating responses; improving your own twin | Contract |
| Location (if added) | Showing you on the discovery map | Consent |
| Reactions and feedback | Improving the product and providing support | Legitimate interest |
| Server and error logs | Keeping the service secure and reliable | Legitimate interest |
| Analytics cookies | Understanding aggregate site usage | Consent |
| Payment and subscription data | Managing your paid plan | Contract |
Who we share information with
We use the following service providers to operate Stird. Each is bound by its own data-protection terms.
| Provider | What they do | Region |
|---|---|---|
| Supabase | Database, authentication, and file storage | European Union (Ireland) |
| Railway | Application hosting, including the databases and background processing we run on their platform | United States |
| OpenAI | Generates digital-twin responses and powers search, using the content you share | United States (global infrastructure) |
| Anam | Powers voice and video calls with a digital twin, including processing your voice during a call | United States |
| Optional sign-in via Google | United States (global infrastructure) | |
| Google Analytics | Aggregate website usage statistics (only with your consent) | United States (global infrastructure) |
| Cloudflare | Content delivery, security, and aggregate website analytics | Global network |
| Sentry | Error and performance monitoring | European Union (Germany) |
| Slack | Internal review of feedback you submit | United States |
| Resend | Delivers account-related email (such as sign-up confirmation) | United States |
| Paddle | Processes subscription payments and acts as merchant of record for your purchase — it handles your card details directly and, for the data it collects to complete the sale (name, billing address, tax details), acts as an independent controller under its own privacy policy | — |
International transfers
Some of the providers above are located outside the UK and the EU. Where personal data is transferred internationally, we rely on the safeguards required by UK GDPR and EU GDPR — such as adequacy decisions or standard contractual clauses.
How long we keep information
| Category | Kept until | Typical duration |
|---|---|---|
| Account information | Your account is active | Permanently deleted 30 days after you request deletion in Settings (you can cancel by signing back in during that time) |
| Content you create (memories, avatar, profile) | You delete it, or your account is deleted | Permanently deleted 30 days after you request deletion |
| Data derived from your content (used for search and building your twin) | The content it's built from is deleted | Typically within 30 days |
| Conversations with your own digital twin | Your account is deleted | Permanently deleted 30 days after you request deletion |
| Conversations you have with someone else's digital twin as a visitor | — | Kept, but no longer associated with your profile if you delete your account — see note below |
| Server and error logs | Collected | Up to 90 days |
| Analytics data | Collected | Up to 14 months |
| Backups | Disaster recovery only | For the duration of our provider's standard backup cycle; not used for any other purpose |
| Payment records | Legal requirement | Kept by Paddle, our payment provider, as merchant of record, for as long as the law requires them to. The copy of your subscription status we hold is deleted when your account is deleted. |
| Usage and cost records (no message content) | Kept for service accounting | Disconnected from your identity when your account is deleted |
| Support and feedback correspondence | Your request is resolved | Up to 2 years |
A note on visitor conversations. If you chat with someone else’s digital twin and later delete your own account, that conversation is not deleted — it stays with that twin, but it is no longer associated with your profile. If the twin’s owner deletes their twin or account, the conversation is deleted along with it.
Deleting your account. You can delete your account yourself from Settings. Your twin is hidden from everyone right away, and you’re signed out of every device. For the next 30 days, you can change your mind by signing in again. After that, your account and the data described above are permanently deleted. If you have a subscription, it’s set to cancel at the end of the current billing period. You can also request deletion by emailing [email protected].
Your rights
Under UK GDPR (and, if you’re in the EU, the equivalent EU GDPR rights) you may:
- Request access to your data
- Correct inaccurate data
- Request deletion
- Restrict or object to processing
- Withdraw consent (via the cookie banner or your browser settings)
- Request portability of data you provided
- Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk), or your local EU supervisory authority
To exercise any of these, email [email protected].
Automated decision-making
Digital-twin responses are generated automatically by an AI model. This does not amount to automated decision-making that produces legal or similarly significant effects on you — a twin’s replies don’t, by themselves, grant or deny you any right, service, or benefit.
Children
Stird is not intended for anyone under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have, we’ll close that account and delete the data we hold about them, except where we’re required to retain it by law.
Changes to this policy
We may update this policy. Material changes will be shown by an updated date above and, where appropriate, an on-site notice.
Contact
[email protected] · Stird LTD, registered in England & Wales.
See also our Cookie Policy and Terms of Service.