Data handling

Data minimization

PillBird only asks for information that helps it provide reminders, scheduling, tracking, and the optional features you turn on. Optional location context is requested only if you enable it for travel/timezone reminders. There is no profile-building, no advertising data collection, and no selling of health information.

If a piece of data isn't needed to make a feature work, the app is designed not to ask for it in the first place.

Where your data lives

Your logs, reminders and settings stay on your device by default, protected by encrypted storage.

• Day-to-day data: stored on your device
• Sensitive values: kept in the operating system's secure store / keychain
• Location context: used transiently for timezone/travel reminders if enabled; coordinates are not stored
• Synced copies: created only if you explicitly enable cloud sync
• Account identity: Firebase Auth is used only for opted-in signed-in Plus/payment-linked or authenticated features

Cloud sync

Cloud sync is optional. When enabled, your data is encrypted on your device before upload to Cloudflare R2. We cannot read it or recover your passphrase. Importing a backup does not enable sync.

Security expectations

Your data is protected at rest on your device and in transit whenever a feature sends it anywhere. PillBird also supports an app-level screen lock so your information stays private even if your phone is unlocked.

When sync or any networked feature is involved, data is sent over encrypted connections, and access is limited to the systems needed to run that feature.

Retention and deletion

Because PillBird is local-first, your data persists on your device until you remove it. Deleting your account from the app clears your local logs, settings, reminders, and personalization, and requests removal of any synced copy if sync was enabled.

We remove linked account and billing records, retaining only minimal records to prevent deleted data from being recreated. RevenueCat and your app store maintain their own purchase records. Account deletion does not cancel a subscription.

Signed-in accounts with no activity for 12 months are deleted the same way. We email a warning 30 days beforehand, and opening the app while signed in resets the clock. Data stored only on your device is not affected.

Third-party services

PillBird relies on a small number of trusted platform services. These receive only what they need to do their job, and not the plaintext contents of your health logs.

• RevenueCat manages purchases and subscription status
• RevenueCat manages subscription entitlement events; PillBird stores entitlement status, not card details
• Firebase Auth provides optional account identity for signed-in Plus/payment-linked or authenticated features
• Firebase Firestore stores the account, subscription, purchase, and share records needed to verify entitlements and run account deletion
• Firebase Crashlytics receives technical crash diagnostics and app-instance identifiers
• Cloudflare R2 stores opaque sync ciphertext only if you enable cloud sync

Your rights

You can view, edit and delete your information in the app. Contact privacy@pillbird.com for help with a data request.