In short
BirdGrab has no accounts, sets no cookies by default and uses no advertising trackers. By default, no third-party analytics run; our own first-party statistics count page views, lookups and downloads without storing IP addresses, cookies or the links you paste, with optional Google Analytics 4 available only upon explicit consent. We process the link you paste solely to fetch the post from X. If you email us, we keep your message in order to answer it (see When you email us).
The links you paste
To find a post, our server asks X for its public embed data, which contains the post's ID. A t.co short link is first opened by our server to see which post it leads to. If X cannot be reached or does not return the post, the post's address may be sent to the third-party service fxtwitter.com, which looks the post up for us; its own privacy policy applies to that request. The result (the post's public details and media addresses) is kept in memory for up to 10 minutes so that repeated requests are fast, and is never written to disk.
Videos, sounds and pictures
We do not store any media. When your browser can, it downloads videos and GIFs straight from X's servers: X then receives your IP address and browser details, as when you watch the video on X, and your browser tells it that the request comes from this site; we send it no cookie and no referrer. Otherwise, and for photos, thumbnails, MP3 and the real GIF, files are streamed from X through our server to your device while you download them, and audio conversion to MP3 and video conversion to GIF happen on the fly without saving the file.
Server logs
Like any website, our web server and our hosting and network providers (such as Cloudflare) record technical data for each request: IP address, date and time, the address requested, and the browser's user agent and referrer. We use this data only to keep the service secure, prevent abuse, enforce rate limits and produce aggregated statistics on traffic and on search-engine and AI crawlers. Logs are kept for up to 14 days and then deleted. The aggregated statistics contain no IP addresses; we keep their daily totals for the site's long-term statistics in our own site-management system (see Site statistics below). Rate-limit counters exist only in memory for a few minutes.
Site statistics
To know whether the site works and how people find it, BirdGrab records a small event on its own server when a page is viewed, a link is looked up, a download button is clicked and a file is delivered. An event holds only: the date and time; the page address and language; the country reported by Cloudflare; whether the request came from a regular browser or from a named search or AI crawler; for a regular browser, the type of device (such as phone, tablet or computer) and the names of its operating system and of the browser or app, read from the user-agent string without version numbers; the host name of the referring website (no path or query); for a lookup, whether the link was a full X link or a t.co short link, the public ID of the post and whether it worked; for a download, the chosen format and the file size. It never holds your IP address, your browser's user-agent string, the link you pasted or a cookie. When you click a download button, your browser sends one small request with the post ID and the chosen format, and when a video or GIF came straight from X, one more with the post ID, the format, how it was downloaded and the file size.
To count unique visitors per day without cookies, we combine your IP address and user-agent string with a random value that changes every day, keep only a short one-way hash of the result, and delete the random value when the day is over; the hash cannot be traced back to you or linked across days. Individual events are deleted after 14 days; the daily totals made from them (no IP addresses, no hashes) are kept for the site's long-term statistics in our own site-management system, which keeps every exported day, while the site's own database only keeps its copy for a limited time. Only the site's operators can see these statistics.
Cookies and analytics
By default, we do not set cookies for visitors; the first-party statistics described above run entirely on our own servers without cookies or IP addresses. (Only the operators' login to the statistics dashboard uses an essential cookie.) To download videos straight from X, browsers that support it keep a small script of ours (a service worker) that only handles the download buttons you click; it stores no personal data and is removed when you clear this site's data. To help understand site traffic, the site optionally supports Google Analytics 4 (Google LLC, United States). It only runs if you click "Allow" in the footer Analytics Settings and is automatically blocked if Do Not Track (DNT) or Global Privacy Control (GPC) is detected. Your consent preference is stored locally in your browser for up to 180 days. When active, statistical cookies (such as _ga and _ga_*) are used with an expiration of up to 180 days to distinguish visits; Google receives technical connection data including your IP address (technical information required to deliver analytics, determine approximate region, and prevent abusive or spam traffic), browser and device details, a clean page path, a fixed page title, and the referring domain. We never send the links you paste or any tool inputs. This implementation disables Google Signals, ad personalization, and advertising features. If enabled, operational data retention in Google Analytics is required to be limited to 2 months (aggregated overview reports may be retained longer by Google). Data may be processed in the United States under Google's Privacy Policy and How Google uses information from sites or apps that use our services. You can revoke consent at any time using the footer Analytics Settings; revoking consent immediately disables measurement and clears the analytics cookies (without clearing any site functionality data).
Page language
When you open one of our English pages from another website, a bookmark or the address bar, we show it in the language your browser asks for if we have that language, using the language list every browser sends; for Chinese without a region, the country reported by Cloudflare decides between simplified and traditional characters. Nothing about this is stored, and a language you pick in the menu is kept while you browse the site. Search and AI crawlers always get the English page.
When you email us
If you write to contact@birdgrab.com, the message is received by the email routing service of Cloudflare, which passes it on to the mailbox our operators read, hosted by Google (Gmail); both companies are based in the United States. Cloudflare passes the message on to that mailbox and also hands a copy to a small program we run on Cloudflare, which keeps it only until our own server has fetched it — normally within minutes and never longer than 14 days. Our server, hosted by Google Cloud in the United States, keeps your email address and name, the subject, the text of the message, the technical headers and the names and sizes of any attachments (not the attachments themselves) in our internal support list for up to 180 days and then deletes them. Cloudflare's delivery log records the sender and recipient addresses, the subject and the result of the delivery for about a month. The mailbox keeps your message as it arrived: your email address and name as your mail program sends them, the subject, the text, any attachments and the technical headers added by the mail servers along the way. Only the site's operators can read it, and we use it only to answer you and to handle what you asked for.
We reply from our own address through the email delivery service Resend, based in the United States: it receives each reply we send you (your address, the subject and the text, including any part of your message we quote) and, under its own privacy policy, keeps the content of sent messages for about 30 days; our copy of the conversation stays in the mailbox. We keep messages only as long as we need them to handle your request (the copy in our support list for 180 days at most) and delete them when you ask us to. We never add your address to a mailing list or share it, unless the law requires us to.
Your requests
Apart from the short-lived logs described above, the messages you send us, and pseudonymous statistical identifiers stored only if you choose to enable Google Analytics, we hold no data that identifies you. To ask about or delete your data, email contact@birdgrab.com.
Children
The service is not directed at children under 13.
Changes
We will post any change to this policy on this page and update the date at the top.