SnowRaven Privacy Policy

Overview

SnowRaven is a self-hosted birding tools app. It runs as a standalone desktop app (macOS and Windows), as an app on iPhone, iPad, and Android, or on your own machine such as a Raspberry Pi. This policy describes what happens to your data. The short version: it stays with you.

Your Data Stays on Your Device

SnowRaven keeps your data on your own device by choice and design. You keep it, and you control it.

• Your API keys, app settings, and the files you upload (your eBird backup and Macaulay Library export, and any eBird bar-chart files you add on the Targets tab) are stored only on your device (in the desktop app's local data directory, in the iOS app's on-device sandbox on iPhone and iPad, together with the small copy its home-screen widgets read and, if you turn on Alerts, the alert settings and inbox, all described in the iOS App section below, or in the Android app's private storage, described in the Android App section below), or on your own machine when you self-host the web/Pi version, unless you turn on the optional iCloud Sync on a Mac, iPhone, or iPad, which copies your data files (your eBird backup, your Macaulay Library export, and any eBird bar-chart files you have added), and your API keys only if you also turn on its separate Sync API keys switch, into your own iCloud account and nowhere else (see the iCloud Sync section below). They are never uploaded to the developer or to any service the developer runs.
• All processing of your eBird and media files happens locally, on your own device.
• There is no SnowRaven account, no login, and no SnowRaven-operated server sitting between you and your data.
• You can delete your stored files and keys at any time from the Settings tab (a single county's bar-chart file, also from the Targets tab), or by removing the app's data directory. With iCloud Sync on, clearing a data file or removing a bar-chart file also removes it from iCloud, and with Sync API keys on, clearing a key does the same; each of your other devices then removes its copy at its next check if it has the same switch on, and a device with it off keeps its own. Clearing your eBird backup also removes what was worked out from it and saved on your device: the escapee and Projects answers for your checklists, the county species lists behind the map's Completeness shading, the day-by-day eBird reports behind the Targets tab's live counts (and, with iCloud Sync on, every device's copy of them in iCloud), the saved weather and tide readings for your checklists, and, on iPhone and iPad, the list of your species that the home-screen widgets compare against, and the Alerts inbox together with any alert waiting for the end of your quiet hours and the position the app read for Alerts. Replacing a file with a newer export keeps those saved answers, which is what lets a newer export ask only about the checklists that have not been answered yet.

No Data Collection

SnowRaven collects nothing about you.

• No analytics, usage tracking, or telemetry of any kind.
• No crash-reporting services.
• No advertising networks.
• No accounts, profiles, or identifiers.

Connections to Bird and Weather Services

SnowRaven's job is to fetch birding and weather information for you, so the app does make requests to a few outside services, using your own API keys, and only to get the data you ask for, which includes the nearby sightings a home-screen widget you placed shows and, if you turn on Alerts on iPhone or iPad, the nearby sightings an alert check looks at. These requests go directly from your device (or your own self-hosted server) to the provider. There is no SnowRaven server in the middle, and nothing is logged or retained by the developer.

• eBird: to look up checklist details, hotspots, recent nearby sightings (including, on iPhone and iPad, the same kind of nearby-sightings request made by a Nearby Lifers or Media Targets home-screen widget each time it refreshes, and by an alert check if you turn on Alerts, both described under Your Location, and, when you turn on the map's Recent activity hotspot coloring, the recent community sightings at each public hotspot in your current search, one request per hotspot, bounded and cached on your device for six hours), region info (including the species list ever reported for a county region, used by the map's county Completeness shading and by the Targets tab), a per-day list of the species reported in a county over the last 30 days, when you open the Targets tab and whenever you choose another county there, and again when your connection or key comes back or you press Retry (the answers are kept on your device, so each of these asks again only about days whose answer was not yet final: the current day, an earlier day that was still in progress when it was last asked, and any day with no answer kept on your device), and species taxonomy. Uses your own eBird API key. See eBird's terms.
  • An eBird bar-chart file you add on the Targets tab, which you download yourself from ebird.org, is read only to show eBird's frequencies for its county. It is stored on your device, and on a Mac, iPhone, or iPad with iCloud Sync on it is copied to your own iCloud account along with your other synced files (see the iCloud Sync section below).
  • The Statistics tab also asks eBird about a set of your own checklists, in order to find out which of your birds eBird tags as exotic escapees. It sends only your own checklist IDs, and only a small covering subset of them (a set of checklists that between them carry every species you have recorded, worked out on your device before anything is sent), not your whole history. The answer is stored on your device for 30 days, so returning to the tab does not repeat the requests. If you have no eBird key or no connection, nothing is sent and the tab says so. What is new here is that a figure summarizing your own history now depends on a lookup: the Statistics tab's displayed numbers were previously worked out on your device. The tab itself has always made requests, which is a different thing, and worth stating plainly on this page: it matches your species names against the bird taxonomy, and it asks eBird which locations in the regions you have birded are public hotspots. The name matching happens against a copy of the taxonomy the app already holds, so your species list is not sent to eBird. Other parts of the app already show numbers that come from eBird, such as a county's completeness percentage on the map and a hotspot's species count. The Statistics tab's Projects section makes one further request per checklist, to find out which eBird projects your checklists were submitted to. It sends only your own checklist IDs, and only after you press one of that section's own controls: it is never started automatically, on tab open, or on relaunch. The answers are stored on your device, so stopping, quitting, or loading a newer export asks only about checklists that have not been answered yet, and an answer already given is not re-checked for a year unless you press Check again, which re-asks about all of them. With no eBird key or no connection, nothing is sent and the section says so.
• OpenWeather: to fetch weather: the historical weather for a checklist, the current or forecast weather for a location and time you choose, or the forecast across the days ahead for a place you choose. Uses your own OpenWeather API key. See OpenWeather's privacy policy.
• Nominatim (OpenStreetMap): to turn a place name you type into map coordinates, and to look up the county for a set of coordinates. See the OSM privacy policy.
• NOAA Tides & Currents (CO-OPS): to fetch the tide for a checklist's location and time, the current or predicted tide for a location and time you choose, or the predicted tide across the days ahead for a place you choose. No key or account; a U.S. government service. See NOAA's privacy policy.

What you send to these services (a checklist ID, a location, a search term) is governed by each provider's own privacy policy. SnowRaven only relays the request you initiated, or the scheduled request of a widget you placed or of Alerts you turned on. It adds no tracking, and neither the request nor its answer ever reaches the developer. Anything the app saves from an answer stays on your device, with one exception that is yours to turn on: with iCloud Sync on, the Targets tab's day-by-day eBird answers are also copied to your own iCloud account, one copy per device, so your other devices do not ask again (see the iCloud Sync section below). The widgets' saved results are described in the iOS App section below.

Your Location

When you use a location control (the location button on the map, "Use my location" in the map's filters or when setting a default location in Settings, "My location" when choosing where the Targets tab measures distances from, "My location" or "Use my location" in the Alerts section of Settings on iPhone and iPad, or the "Current" weather and tide lookup), SnowRaven asks your device or browser for your current coordinates, with your permission. Pressing the Weather tab's "Plan" button with no place chosen yet asks the same way, to fill in "Your location" in the form it opens; nothing is sent until you press one of that form's two buttons. Those coordinates stay on your device: they set the map's center, measure distances on the Targets tab, and can be saved locally as your default location or as the place Alerts checks around. They are only sent outward if you then run a search (for hotspots or nearby sightings), use the "Current" lookup, which sends your coordinates to OpenWeather and NOAA to fetch the weather and tide where you are, or press either of the "Plan" form's two buttons, which sends them to the same two services for the forecast there, the same as coordinates you type in by hand, or, on iPhone and iPad, when a home-screen widget you placed refreshes or an alert check runs, as described below. You can deny or revoke the permission at any time through your operating system or browser settings.

One thing worth saying plainly, because the paragraph above is easy to read as more than it claims: centering the map on you moves the map to where you are, and the map then draws that area, which means it requests map tiles for it. Your coordinates are not sent to the tile provider, but the tiles you request are for the area around you, and the provider sees your IP address and which part of the map you are looking at, exactly as described in "Map Tiles" below. That is true of panning the map there by hand as well. It is the normal behavior of any map, and it is the one outward consequence of centering on yourself.

On iPhone and iPad, the first time SnowRaven asks for your location (for example when you tap "Use my location", use the "Current" lookup, or press "Plan" with no place chosen) iOS shows the system location permission prompt ("SnowRaven uses your location to center the map on your current position, and to measure distances in its home-screen widgets"). The app itself uses your location only while you're using it. If you place one of SnowRaven's home-screen widgets (Nearby Lifers or Media Targets, on iOS and iPadOS 17 or later), the widget also reads your location each time iOS refreshes it, about every 30 minutes and as often as iOS allows, including while SnowRaven is not open, under that same permission. It sends those coordinates to eBird with your own eBird key to find the nearest recent reports, the same kind of request the app's Nearby Lifers view makes, and nothing reaches the developer. A widget you set to measure from your Default Location reads no location and sends that saved point instead. The widget never asks for permission itself and never asks for Always access. To stop it, remove the widget from your Home Screen, or deny SnowRaven location; with location denied, a widget measures from your saved Default Location if you have set one, and reads no location. If you turn on Alerts in Settings (off until you do), SnowRaven checks eBird about hourly or about daily, as iOS allows, including while SnowRaven is not open, for species you have never recorded near a place you choose, and notifies you on your device. Each check sends that place's coordinates and your chosen radius to eBird with your own eBird key, the same kind of request the app's Nearby Lifers view makes, and nothing reaches the developer; the notifications are made on your device, with no notification server. With Fixed place chosen, no location is used at all. With My location chosen, a check measures from the most recent position the app read while you were using it, or that a widget refresh read from your device, within the past 24 hours, rounded to about a kilometer (a widget that could not read your location and used your Default Location instead does not count; without such a position, a check measures from your fixed place, if you have one); it never reads your location while the app is closed and never asks for Always access. Turning Alerts off stops every check at once. You can allow or deny location, and change your choice at any time in Settings → Privacy & Security → Location Services. Denying it leaves everything else working: you can always type coordinates or search for a place by name.

On Android, SnowRaven never asks for your location and requests no location permission. The Android app has none of the location controls described above, and pressing "Plan" with no place chosen leaves the place empty for you to search or tap. You choose a place by typing its coordinates or searching for it by name.

Map Tiles

The maps in SnowRaven are drawn using map tiles served by third-party providers. As you pan and zoom, your device requests the tiles for the area you are viewing directly from these providers, so, like any website that displays a map, they receive your IP address and which part of the map you are looking at. No SnowRaven server is involved, no API key or account is used, and the developer adds no tracking and keeps no copy. You choose which base map is active with the layer switcher, and only the active layers' tiles are requested. Tiles come from:

• OpenFreeMap (tiles.openfreemap.org): the default "Map" base map, served as vector tiles. The map's style definition is fetched from OpenFreeMap as well. The label fonts (glyphs) and icon sheet (sprite) are not: they ship inside the app and load from it directly, so no request for them leaves your device. A free, keyless, community-run service; see openfreemap.org.
• Esri (server.arcgisonline.com): the "Satellite" base map. See Esri's privacy statement.
• USGS: The National Map (basemap.nationalmap.gov): the "Topo (US)" base map (United States only); a U.S. government service.
• Waymarked Trails (tile.waymarkedtrails.org): the optional "Trails" overlay. See waymarkedtrails.org.

iOS App

The iOS/iPadOS app is the same local-first application: your files, keys, and settings live in the app's sandbox on your device, are included in your device/iCloud backups under the iOS defaults, and are removed when you delete the app. The app collects nothing and adds no service connections beyond those listed above.

For its home-screen widgets, the app also keeps a small document in a container on the same device that only SnowRaven and its widgets can read: your eBird key, the species names in your eBird backup, which of them you lack a photo, audio, or video of in your Macaulay Library export, and your Default Location's coordinates. It holds none of your sightings, checklist details, or media. The app rewrites the document when your key, either file, or your Default Location changes. If a rewrite cannot finish after you remove or replace your key or remove a file, the app empties the document instead of leaving what you removed in it, and keeps trying until it can. In the rare case that SnowRaven closes before it has done that and cannot rebuild the document the next time it opens, the earlier document stays until the app can rebuild it. Beside the document, the widgets keep what their latest refresh fetched: the nearby eBird reports it found, the area it searched, rounded to about a kilometer, and a short fingerprint of your eBird key (not the key itself), which tells them when the key has changed. They keep one such set for widgets that measure from your location and, once a widget measures from your Default Location, a second for that; a successful refresh replaces only the set for that widget's setting. Like the rest of the app's data, both are included in device backups under the iOS defaults and removed when you delete the app, and neither is ever synced through iCloud Sync.

If you turn on Alerts, the app also keeps, in that same container: your alert settings (including the fixed place you chose, and its name if you picked it by search); when the last check ran and what it found; under My location, the most recent position the app itself read while you were using it; any alert waiting for the end of your quiet hours; and the inbox of past alerts. Each alert in the inbox keeps the species, the place eBird reported it, how far away it was, when it was reported, when you were alerted, the radius it was found in, the place's label (your fixed place's name, "near you" or "nearby"), and the point its check measured from: your fixed place, or under My location your position rounded to about a kilometer. An alert waiting for the end of your quiet hours keeps its species, the place eBird reported it, how far away it was, and its check's point, radius, and place label, at most until it is delivered and then forgotten at the next check or the next time you open the app. None of it is your eBird key. The inbox holds at most 200 alerts, and an alert, with its point, is deleted 30 days after it was made, at the next check or the next time you open the app. The position the app read is deleted when you switch to Fixed place, turn Alerts off, or clear your eBird backup, and otherwise at the next check or the next time you open the app once it is 24 hours old or location access for SnowRaven is off. Switching to Fixed place or turning Alerts off does not remove the points already in the inbox: each stays with its alert at most until that alert is deleted or cleared, and a later check that finds the same species within seven days replaces it with that check's point. Clear in the Alerts inbox removes its alerts and their points, and clearing your eBird backup removes the inbox, any alert waiting for the end of your quiet hours, and the position the app read. Like the widgets' documents, they are included in device backups under the iOS defaults, removed when you delete the app, and never synced through iCloud Sync.

iCloud Sync

On the Mac, iPhone, and iPad apps, SnowRaven can keep your data files (your eBird backup, your Macaulay Library export, and any eBird bar-chart files you have added on the Targets tab) the same across your own devices through iCloud. This is off until you turn it on in Settings, and it is a different thing from the iOS device backup described above: it is sync between your own devices, under your own account.

• What is stored in iCloud. With iCloud Sync on, SnowRaven writes your eBird backup, your Macaulay Library export, and each county's eBird bar-chart file into an iCloud container that belongs to your Apple ID, together with a small record for each file: its name, when it was uploaded, its size, and a checksum of its contents, and which device it came from (the device's name, its kind, and a random identifier the app makes up on that device, which is not a hardware or account identifier). Your API keys are written only while the separate Sync API keys switch, described next, is also on. Your app settings, map preferences, and cached lookups stay on each device and are never synced, with one exception: the day-by-day lists of species that eBird reported in a county, which the Targets tab fetches with your key, are written into the same container as one copy per device, each holding the day lists that device has, whether it fetched them from eBird or took them from your other devices' copies (the county, the day, when the list was asked for, whether the day was over by then, the list's size, and each species eBird listed with the time and place of that report as eBird gives them), along with the same small record each file has, so your other devices do not repeat those requests. They hold nothing from your own files.
• Sync API keys. A second switch in the same section, off by default and available only while iCloud Sync is on, keeps your eBird and OpenWeather API keys the same across your own devices. With it on, SnowRaven writes one small record into the same private container holding, for each of the two keys, the key exactly as you entered it, when it was last changed, and which device changed it (the device's name, its kind, and the same random identifier). It goes only to your own iCloud account, and only your devices that also turn the switch on receive it. Apple encrypts the record in transit and at rest; it is end-to-end encrypted only if Advanced Data Protection is turned on for your iCloud account, and without it Apple's standard iCloud protection applies, the same as for your synced files. The developer has no way to see it. Turning the switch off leaves the keys on each device in place and removes the copy from iCloud, and Remove synced keys from iCloud deletes the copy at any time without touching any device.
• Whose account. The copies live only in your own iCloud account, on Apple's servers, and move only between devices signed in to that account. There is no SnowRaven server in the path, and the developer has no way to see, receive, or access what you sync. The container is private to the app and does not appear in iCloud Drive's file listing. Apple's handling of iCloud data is described in Apple's privacy policy.
• Copy iCloud details. If sync is not working, Copy iCloud details at the foot of the iCloud Sync section in Settings puts a plain-text report on your clipboard, for you to paste into a message to the developer if you choose. It lists what iCloud reports for each synced file: the app's version, your devices' names, and the random identifier the app made up for each, whether iCloud is available, county codes, file sizes, and dates, sync states, and Apple's error codes and messages. It holds no file contents, no file names you chose, and no API keys. SnowRaven never sends it anywhere itself: it reaches the developer only if you paste it into a message.
• Turning it off and removing the copies. Switch iCloud Sync off at any time in Settings; the files on each device stay in place and keep working, and Sync API keys goes off with it. Remove synced files from iCloud in the same section deletes the file copies in your iCloud account, the bar-chart files and the day-by-day lists included, without touching any device, and Remove synced keys from iCloud does the same for the key copy. Deleting the app or its data on one device does not by itself remove the copies in iCloud, so use those controls first if you want iCloud empty.

Android App

The Android app is the same local-first application, built from the same published source. Your files, keys, and settings live in the app's private storage on your phone or tablet, which other apps cannot read and which needs no storage permission, and they are removed when you uninstall the app. They are included in Android's own backup under Android's default settings, whether your phone backs up to a cloud account or transfers directly to a new phone. Android's documented limit for a cloud backup is 25 MB per app, and an app holding more than that is left out of the cloud backup entirely, which a large eBird backup can bring about; on Android 12 and later, a direct transfer to a new phone has no such limit. The Android app contains no Google services, no Firebase, and no analytics, advertising, or crash-reporting library, and adds no service connections beyond those listed above. SnowRaven's own code makes no request to Google. Its screens are drawn by your phone's Android System WebView, a system component that may contact Google on its own; SnowRaven turns off the WebView's Safe Browsing and usage statistics, and has no setting for the rest. The home-screen widgets, Alerts, and iCloud Sync described in this policy are iPhone, iPad, and Mac features and are not part of the Android app.

Embedded Bird Media and Link Icons

A few things in the app load directly from the Cornell Lab of Ornithology's websites, the same way any web page loads an embedded image, so, like the map tiles above, those sites receive your IP address and the specific item requested:

• Macaulay Library embeds: while embedded media is enabled, the Species Detail tab and the Named Birds tab can show your photos, audio, and video embedded from macaulaylibrary.org; loading one tells the Macaulay Library which asset was viewed. Because the Cornell Lab now runs a bot check that an embedded player cannot pass, SnowRaven also makes one small status request to macaulaylibrary.org per session, to find out whether players will work at all and show its own placeholder instead of a broken one. That request carries no information about you beyond what any request carries (your IP address) and the catalog number of an item already about to be shown. In the web/Pi version it is made by your own self-hosted SnowRaven server rather than by your browser; in the desktop and mobile apps the app makes it directly. The Disable embedded media option in Settings is off by default. Turning it on prevents all of those players, their asset requests, and that status check from happening at all; direct Macaulay Library links remain available and contact the site only when you choose to open one.
• Site icons next to bird names: the small link icons shown beside bird names throughout the app load from ebird.org and birdsoftheworld.org.

No key or account is used for these loads, no developer-operated server is involved, and the developer adds no tracking and keeps no copy. These are Cornell Lab of Ornithology services; see Cornell's privacy statement.

Software Updates

In the desktop and web/Pi versions, SnowRaven checks whether a newer version is available by requesting the latest release information from GitHub (api.github.com). In the desktop apps, choosing Check For Updates then downloads the new version directly from GitHub's release assets and installs it in place. As with any request to a website, GitHub receives your IP address when these checks and downloads happen. No API key or account is used, no SnowRaven server is involved, and the developer adds no tracking and keeps no copy. Downloaded updates are cryptographically verified before they are installed. See GitHub's privacy statement.

On iPhone and iPad, updates are delivered through the App Store (or TestFlight for pre-release builds). The iOS app contains no self-update mechanism of its own and does not make the GitHub update check described above.

On Android, SnowRaven installed from F-Droid is updated through the F-Droid client. F-Droid builds each release from SnowRaven's published source on its own servers and signs it with F-Droid's own key. SnowRaven installed from the APK attached to a GitHub release is signed with the developer's key and is updated by downloading a newer release's APK from GitHub and installing it over the old one. The two are signed by different keys, so neither installs over the other: switching from one to the other means uninstalling first, which removes the files and keys stored in the app. The Android app contains no self-update mechanism of its own and does not make the GitHub update check described above.

Children

SnowRaven does not collect data from anyone, including children under 13.

Changes to This Policy

If this policy ever changes, the updated version will be posted here with a revised effective date.

Contact

Questions about privacy? Reach out at developer@dtgibson.com.