Privacy policy

Who we are

SiteBirdy (sitebirdy.com, and the SiteBirdy apps for Mac and Windows) is made and run by Site B.V. (Site.eu), Operetteweg 7, 1323 VJ Almere, Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 53309847 (“we”). We are responsible for the personal data described here. Questions about privacy go to support@site.eu.

SiteBirdy runs on our own servers in the Netherlands; no other company hosts it. If you use SiteBirdy for your organisation, we handle the mail, calendars and contacts of your organisation on its behalf, and a processor’s agreement is available on request.

In short

• Your email stays on your own mail server. SiteBirdy reads it from there when you use it, and keeps only what it needs to show your lists quickly.
• We don’t sell your data, show ads, or use your mail to train AI. SiteBirdy has no AI of its own that reads your mail.
• If you connect an AI assistant such as Claude or ChatGPT, it gets only what you allow, and you can disconnect it at any time.
• You can download your data and delete your account yourself, in Settings → Account.

What we keep, and why

Your account

Your name, your email address (or the username a team owner gave you), your password as a scrambled hash we can’t turn back into the password, your two-step verification secret (encrypted) and recovery codes (hashed), your settings, and when you last used SiteBirdy. We need these to give you an account (performance of our contract with you).

Your mailboxes

For each mailbox you add: its address, display name and signature, the names and settings of its mail servers, and the password for it, which we encrypt (AES-256-GCM) and use only to connect to your mail server for you.

To show your lists and search quickly, we keep a summary of the messages in your folders (when you add a mailbox, of the newest 20,000 in each folder; new mail is added as it arrives): the sender, the recipients, the subject, the date, whether it is read, answered, flagged or Priority, the names of its attachments, the first 160 characters of its text, and what SiteBirdy needs to sort and group it (its message IDs and conversation, its size, the kind of mail it is, whether it passed your mail server’s checks, and its unsubscribe link). The whole message is read from your mail server when you open it and isn’t kept, with these exceptions:

• a message you send, schedule to send later, or send one by one to many people, until it has been sent (if sending fails, until you try again or cancel it);
• a message you delete for good: we keep a copy for up to 7 days, so you can undo it;
• files you attach to a message: for 7 days after you upload them.

We also keep what you make in SiteBirdy: labels, saved searches, rules, sender lists and groups, templates, snoozed and follow-up reminders, notes and to-dos. Your calendars and address books are stored on our servers, and external calendar accounts you add are kept with their password encrypted.

Read receipts

Unless you turn them off (Settings → Writing), SiteBirdy adds a tiny invisible image to messages you send. When the recipient’s mail app shows it, we note when and how often the message was opened, and where we can tell, the kind of mail app (Gmail, Yahoo or Apple), together with the message’s subject and who it went to, so you can see which message was opened. We never keep the recipient’s IP address, and we don’t log these requests. Recipients aren’t asked about this.

Signing in and security

For each place you’re signed in: the browser and system (as your browser describes itself), the IP address and when it was last used, so you can see and end your sessions in Settings → Account. To stop people guessing passwords, we keep each sign-in attempt, sign-up and password reset for 24 hours, with its IP address and the email address used, and the codes we email you for a day after they run out. We use these for security (our legitimate interest in keeping accounts safe).

Our server logs

Like most websites, our web server logs each request: the IP address, the time, the address requested (which can include what you searched for or an email address you looked up) and the browser. It keeps them for 14 days. SiteBirdy’s own log keeps errors, slow requests (by kind of request, without what you searched for) and notes about its connections to mail servers (which mailbox and folder) for 60 days. We use the logs to find faults and abuse (our legitimate interest).

Visitor statistics

We count visits on sitebirdy.com and in the apps with Matomo, which we run on our own server. It uses no cookies and stores nothing on your device. It sees the first part of the address you visit (not your mail, searches or folders, nor the links you click), whether you use a browser or the app, and, when you’re signed in, your account number; like any website, also your IP address and your kind of browser and screen. We use this to see how SiteBirdy is used and to improve it (our legitimate interest); it stays with us.

When you contact us

What you write to support@site.eu, and our answers, to help you.

What SiteBirdy does on your mail server

SiteBirdy works directly with the mail on your mail server, so what you do in SiteBirdy also happens there: it saves drafts and sent messages, moves mail between folders, and marks messages (for example as Junk or Priority). Two things happen by themselves, and you can change both:

• Trash is emptied for good after 90 days (Settings → Mailboxes, per mailbox);
• for a newsletter you put in Junk and leave there for 10 days, SiteBirdy unsubscribes you from that list, through the sender’s unsubscribe link or an email from your mailbox. Only for senders that pass your mail server’s checks (Settings → Senders).

AI assistants you connect

SiteBirdy has no AI that reads your mail. You can connect an AI assistant you already use, such as Claude (Anthropic) or ChatGPT (OpenAI), in Settings → Connected apps or from the assistant itself. You choose what it may do (from reading to sending) and which mailboxes, calendars and address books it can reach.

When you then ask the assistant something, it receives from SiteBirdy what it asks for within those limits: for example lists of messages, the text of a message, calendar events, contacts or notes. Files it attaches to a draft or an email are taken from your messages by SiteBirdy itself, or are files the assistant made and sends to us. From then on, the assistant’s provider handles what it received under its own terms and privacy policy, which may mean outside the European Economic Area. We send nothing to an assistant you haven’t connected, and nothing to any AI provider ourselves.

For each connected assistant we keep its name, the permissions and reach you chose, when it was last used, and hashes of its keys or sign-in tokens (an access token works for an hour; a refresh token ends after 90 days without use). Disconnect it in Settings → Connected apps and it stops working at once.

Who else receives data

We never sell your data. Others receive data only as below:

• Your own mail and calendar providers, which you chose: SiteBirdy connects to them with your password for each action you take.
• The people you write to: your messages, and the read receipt image unless you turn it off.
• Senders’ websites: to show a sender’s icon, our server visits the website of the sender’s domain (its home page and the icon files it names), and it looks up the logo a sender publishes for its mail (BIMI). This sends nothing about you; the website sees only our server. It happens for the mail SiteBirdy receives whether or not you show icons.
• Newsletter senders, when you unsubscribe or SiteBirdy unsubscribes you from mail in Junk.
• Weather: for the weather on your Today board, our server sends the coordinates of the city you chose to the Norwegian Meteorological Institute (MET Norway). “Use my location” sends a rounded location to our server only, which picks the nearest city itself. Exchange rates come from the European Central Bank; nothing about you is sent.
• AI assistants you connect, see above.
• Anthropic translates SiteBirdy’s own buttons and texts into other languages; none of your data is part of that.
• Authorities, only when the law obliges us.

The emails SiteBirdy sends you itself (codes, security notices) go out through our own mail servers. Images in a message, such as a newsletter’s pictures, load from the sender’s servers only after you choose to show them, or if you set SiteBirdy to always show them. The sender’s server can then see your IP address.

How long we keep it

When you delete your account (Settings → Account), we delete your data at once, and your mail on your mail server stays where it is. What runs out by itself (your team’s activity history, sign-in attempts) stays until then, as listed above, and visitor statistics stay in Matomo under your account number. Copies in backups disappear as the backups are replaced.

Cookies and storage in your browser

• wm_session: keeps you signed in (30 days). Needed for SiteBirdy to work.
• wm-lang and wm-look: your language and look, also before you sign in (1 year).

That is all: our visitor statistics use no cookies. SiteBirdy also keeps things in your browser’s own storage: your look and panel sizes, and, to open quickly, what it showed you last (lists, calendar, contacts, notes and settings, not the messages themselves). What it showed you is cleared when you sign out; your look and panel sizes stay. A message you write can stay in the tab’s undo history until you sign out or close the tab, so you can bring back a draft you discarded. The apps for Mac and Windows keep the same, and their window position.

How we protect it

• All connections to SiteBirdy are encrypted (TLS 1.2 or 1.3).
• Passwords are stored as hashes (scrypt); mailbox and calendar passwords and two-step secrets are encrypted.
• Two-step verification, limits on sign-in attempts, and an email when something important changes in your account.
• Messages are shown in a sealed-off frame, with images and scripts blocked, and links are checked before they open.
• Only the people who run SiteBirdy can reach the servers, with personal keys.

Your rights

You may ask to see, correct, delete or move your data, to have us use it less, or object to how we use it. Much of it you can do yourself: Download my data and Delete my account are in Settings → Account. For anything else, write to support@site.eu; we answer within a month. If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.

SiteBirdy is not meant for children under 16.

Changes and contact

When we change this policy, we update the date at the top, and for changes that matter we tell you in SiteBirdy first. See also our terms. Questions: support@site.eu.