Privacy policy

The service is operated by Birdie Technologies. We are the data controller for the personal data described here. Questions about this policy or your data go to [email protected], or open a support conversation from the dashboard.

We keep what the service needs to work, and no more:

• Account details. Your name, email address, chosen username (which is also your proxy username) and a salted hash of your password. We never store the password itself.
• Discord. Your Discord ID and username, which you link to use the dashboard, and whether you are in our Discord server. Your roles there (such as Customer or VIP) are visible to other members of the server.
• Applications. If you apply to join, your Discord account, email address and your answers (who referred you, the sites and tools you use, and how much data you expect to use).
• Sign-in sessions. For each sign-in we record the time, the IP address and a short description of the browser or device, so you can see and end sessions from your account page.
• Two-factor authentication. If you turn it on, the authenticator secret is stored encrypted, together with hashes of your recovery codes.
• Orders. What you bought, when, the amount, and the payment reference from our payment processor. Card numbers go directly to Stripe and never reach our servers. To show which country's tax rules apply, we also keep the billing country you choose, the country your card was issued in, and the country your connection came from.
• Auto top-up, if you turn it on. Stripe keeps the saved card; we keep only Stripe's reference to it, a label such as “Visa ending 4242”, the level and amount you chose, when you agreed, and a record of each top-up. We check your balance against your level to know when to top up. Turning auto top-up off, or deleting your account, removes the card from Stripe.
• Low balance alerts, if you set them. The percentage you chose and, if you give one, your Discord webhook address, which we use only to post your alerts to that channel. Remove it on the account page at any time.
• Proxy usage. The bandwidth used through your proxies and the destination hostnames of requests, as reported by the proxy network. This is what powers your statistics page and your balance. We do not log the content of your requests.
• Static ISP. For Static ISP we run the proxy ourselves, so we record, per proxy login, how much data you use, the hostnames you connect to and the times, how many requests you make and how many fail, which of our addresses each connection used, and for connections to Pokémon Center the technical fingerprint of the software making the connection (the unencrypted opening of the secure connection, which says which browser or tool it is). We also keep a record of which customer held which address and when. We use these to show you your usage, to enforce the Static ISP rules (which allow only browsers on Pokémon Center), and to answer abuse reports that websites send us about our addresses. We never see or keep the content of secure connections.
• Windows servers, if you rent one. The size and times of each server, the internet address it was given, and the login we create for it, which is stored encrypted and deleted when the server ends. For each server we also log its connections (the time, the addresses and ports at both ends, and the amount of data) and the website names it looks up. These logs are checked automatically for signs of abuse such as scanning, attacks, spam and mining, and are what we answer abuse reports from. We do not look at what is on your server or record your screen, and we never see the content of secure connections.
• Support conversations. Messages you send us, including free-trial requests and Discord tickets, and our replies.
• Giveaway plays. When you take a shot in the daily game, the outcome and any prize credited.
• Account activity. A log of significant events on your account, such as sign-ins, password and two-factor changes, proxy key resets, orders and support activity, with the time and IP address. It exists so we can investigate problems and abuse.
• Technical logs. Request metadata such as IP address and timestamps, used for rate limiting and to keep bots and abuse out. These are short-lived.

We process this data to provide the service you signed up for (our contract with you), to run the business sensibly (our legitimate interests in security, fraud prevention, support and improving the product), and to meet legal obligations such as keeping tax records. We do not sell personal data and we do not use it for advertising.

Proxy connections are carried by our network infrastructure partners. When you connect through a proxy, the network sees your proxy username, your IP address and the traffic you send through it, and reports usage to us. Your proxy username does not include your email address or name, and from 15 October 2026 we no longer give the network your email address when we set up your proxy account. For accounts made before then, the network was given your email address at set-up; we are working to remove it. Our infrastructure partners process this data under their own terms and privacy policies.

• Stripe, which handles card payments and issues invoices. Stripe receives your email, name, billing address, any tax ID you give, the order details and your username, and collects your card details directly.
• Network infrastructure partners, which receive your proxy username, the bandwidth allocated to it, and, when you connect, your IP address and the traffic you send (see above).
• OpenAI, to check referral claims (the screenshots and note you upload, your referral code, both Discord usernames and your friend's sign-up date) and to draft answers in Discord support tickets (the ticket's messages and a summary of your account: username, membership and VIP status, whether you are in our Discord, your application's status, account age, recent orders, this period's purchases towards the monthly minimum, and Static ISP status and any refund figures). OpenAI does not use API data to train its models.
• Discord, which hosts our community server and support tickets. Our private staff channels there receive notices of orders (username, amount and country), sign-ups and applications, free-trial requests (with your email and message) and failed sign-in attempts (with the IP address).
• Resend, which sends our emails: your email address and the content of each message.
• An IP-lookup service, used only to check failed attempts to sign in to our operator login.
• Hosting and infrastructure providers that run the dashboard, the database and the Windows servers you rent, under contracts that restrict them to processing on our behalf.
• Authorities, where the law requires it or to protect the rights and safety of others.

Some of these providers are outside the United Kingdom and the European Economic Area. Where that is the case, transfers rely on adequacy decisions or standard contractual clauses.

• Account details: while your account exists, then deleted within 30 days of closure, except the sign-up entry in the account activity log (your username, email and name when you signed up), which is kept for two years like the rest of that log.
• Sign-in sessions: ended when they expire or when you end them, and deleted 90 days after that.
• Applications and referral claims (with their screenshots): kept until you ask us to delete them.
• Orders and invoices: six years, as tax law requires.
• Proxy usage statistics: up to 12 months.
• Static ISP connection logs (each connection, with its time, address, site and size): 90 days.
• Static ISP daily summaries (data, requests, failed requests and sites, per day): 13 months.
• Which customer held which Static ISP address, and when: kept with the orders.
• Static ISP connection fingerprints: 90 days.
• Windows server connection and website-lookup logs: 90 days.
• Windows server logins: deleted when the server ends. The record of each server (size, times and address) is kept with the orders.
• Support conversations: two years after the last message.
• Account activity log: two years, except records of payments and credits, which are kept with the orders.
• Technical logs: up to 30 days.

Passwords are hashed with a modern key-derivation function, authenticator secrets are encrypted at rest, and the database enforces row-level security so an account can only ever read its own rows. Connections use TLS. Two-factor authentication is available to every account, and you can review and end sessions at any time.

We use cookies to keep you signed in: a session cookie for your account, a short-lived cookie during two-factor sign-in, and a separate cookie for operator access. Short-lived cookies also carry you through linking Discord and applying (up to a few hours) and remember a drop's password for a day. If you arrive through a referral link, a cookie remembers the code for 30 days so the referral counts when you sign up. All are HttpOnly. We do not run analytics or advertising cookies.

We keep simple page statistics on our own server: the page viewed, the site you came from, your country, whether the browser is a phone or a desktop, and a visitor key made by hashing your address and browser together with the day's date, so on its own it cannot identify you or follow you from one day to the next. If you are signed in, the view is also linked to your account. No cookie is set for this, your address itself is not stored, and nothing is shared with anyone. These records are deleted after 90 days.

Besides emails about your account and orders, we may email account holders news and offers about our own services. Every one has an unsubscribe link, and you can turn them off on the account page at any time.

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. You can correct your details and close your account yourself from the account page; for a copy of your data, or anything else, write to [email protected] and we will respond within one month. If you are unhappy with how we handle your data you can complain to your data protection authority; in the United Kingdom that is the Information Commissioner's Office.

The service is for adults. We do not knowingly collect data from anyone under 18, and we close accounts we discover belong to minors.

When this policy changes we update the date at the top. For material changes we will tell you by email or with a notice in the dashboard before they take effect.