Spoonbird.Talk to us

Your information

Privacy, in plain words.

Privacy and consumer health data notice. Effective October 18, 2026. Last updated 1 November 2026.

Spoonbird is a personal record and AI companion. This notice explains what you share with Spoonbird, how it is processed, and the choices you have.

You decide what to share. AI processing needs your permission. This version needs AI permission to continue. You can withdraw it in Settings. Your saved records, corrections, reports, export and account deletion remain available if you withdraw permission or do not have an active subscription.

Who is responsible

Spoonbird is published by 8 O’Clock, LLC, using the Stabilize publisher name. For privacy requests, consumer health data requests, or an appeal, contact help@8oclock.co.

What Spoonbird collects and why

We collect the information you provide when you create an account, complete onboarding, write messages, record a voice turn, or add entries. This includes your account identifier, email and sign-in information; your chosen name, optional bird name and profile answers; conversations; symptoms, energy, medication schedules, manually entered inventory and actual-use entries; Pace day plans and repeating activities; notebook drafts; and other details you choose to share. AI extraction and descriptive patterns can produce health-related inferences. These are part of your record and can be reviewed and corrected.

We use this information to maintain your account, remember your record, answer conversations, prepare reports, process your instructions, provide support, and protect the service. Medication schedules and inventory describe what you enter; they do not establish that a dose was taken. Completing a planned activity does not create a health record. Saving a plan or notebook draft does not itself send that content for AI processing.

Services that process your information

Health values, conversation text, selected health answers and health-related event names are excluded from advertising and analytics events. Those services may receive pseudonymous identifiers, general screen or action events, durations, technical errors and purchase information. We do not sell your health record, use it for targeted advertising, or send it to advertising or analytics providers. Apple’s tracking permission controls use of advertising identifiers. These public pages contain no advertising pixels or third-party analytics. The launch-list pages record anonymous page events (which link you came from, a general browser and device type, which form steps you reached and whether the signup succeeded) in our own database, without cookies, IP addresses, field contents or identifiers that persist beyond that single page visit, to improve the page.

Website launch list

If you join the Spoonbird launch list, we collect your name, US mobile number and optional email for launch notification by text and email. By tapping the signup button, you agree to one text when the app launches and a reminder if you have not downloaded it. Message and data rates may apply. We store your name, normalized mobile number, optional email, the consent text shown, consent timestamp, signup page and browser user agent in our private server database hosted by Supabase. Repeated signups for the same mobile number replace its signup details. When provided, your email is also stored with Resend in a dedicated Spoonbird segment for launch news. Joining does not create an app account or collect your health record.

Reply STOP to a launch text to opt out of texts, use the unsubscribe link in an email to opt out of email, or email hello@8oclock.co to opt out or request removal from the launch list. We retain launch-list information until you request removal or it is no longer needed for these launch notifications, subject to restricted backup retention described below.

Optional email waitlist for a version without AI

If you join the optional waitlist for a version without AI, we save your email, the notification permission you gave and its timestamp with your account. This is used only to contact you about that version. Joining does not enable AI, start a subscription or enroll you in the website launch list. You can leave the waitlist from this screen or Settings. The signup is included in your account export and removed from the active account when you leave the waitlist or delete your account, subject to the backup retention described below. It is stored through our existing Google Cloud API and Supabase database; joining does not send it to an AI or email provider.

AI and voice choices

Withdrawing AI permission in Settings stops new AI processing; it does not automatically erase existing conversations. Spoonbird requests Responses API processing with storage disabled. OpenAI does not use API content to train its models by default. Its standard abuse-monitoring logs may retain content for up to 30 days, with longer retention possible when required by law or necessary to prevent harm. Supported models can also retain encrypted prompt-cache state for up to 24 hours. OpenAI’s API data controls explain these limits.

Spoonbird does not retain raw audio on its server after processing. Recording, playback and retry files are temporary on your device; interrupted files are checked for cleanup when Spoonbird next opens. The transcript and reply are stored as conversation text. The transcription endpoint has no content retention under OpenAI’s published standard policy; text and generated speech follow the applicable policies above.

When you use live voice through LiveKit, LiveKit carries microphone audio and generated speech and hosts Spoonbird’s voice worker. That worker processes conversation text, relevant profile and saved-record context, and account and session identifiers to run the conversation and save your entries. OpenAI receives microphone audio and relevant context to generate an AI voice reply. Spoonbird separately checks finalized transcripts for record entries. A spoken reply may arrive before that check finishes; review the saved-entry result to confirm what was saved.

Spoonbird’s LiveKit voice worker is configured not to record session audio or include conversation content in diagnostic reports. LiveKit also processes connection and operational information to provide its service. These settings do not mean that all provider logs are absent. OpenAI’s retention terms below apply to the AI processing; LiveKit’s own privacy policy describes its handling of service information.

Finalized transcripts, replies and tracking status are stored with your account, including words whose record extraction did not finish. OpenAI’s standard Realtime abuse-monitoring logs may retain content for up to 30 days, with longer retention possible under its stated exceptions. The standalone transcription endpoint’s retention policy does not apply to live voice. You can end voice or switch to typing at any time. Words already sent may still finish processing. Stopping playback alone does not withdraw AI sharing. Turning off AI sharing stops new processing but does not erase existing account content or provider logs.

How long information stays

We keep your account and saved content, including conversations, records, plans and notebook drafts, until you remove that content or delete your account. Deleting a record removes its active entry and revisions, while the original conversation message may remain. Account deletion revokes access and removes active account content. Daily database backups are retained for up to seven days under our current Supabase plan, so deleted content may remain in a restricted backup until that backup expires.

We retain a limited deletion receipt with account and request identifiers, timestamps and completion status, without conversations or health entries, to honor deletions during recovery. Receipts stay while deletion or linked-provider follow-up is unresolved; completed receipts become eligible for cleanup after 90 days. Application operational logs are kept for 14 days. Google’s required infrastructure audit logs are kept for 400 days. We avoid placing conversation content, health values and request URLs in application logs.

For Sign in with Apple, we may store encrypted authorization tokens to revoke Apple access when you delete your account. If Apple has not confirmed revocation, these tokens can remain encrypted after your active account content is deleted while we retry. We remove them after Apple confirms revocation.

To check an interrupted change, we keep a small marker in secure storage on your device. It contains only opaque account and request identifiers, with no message, health entry, recording or sign-in token. We clear it when the request is confirmed or account deletion is confirmed on this device.

Apple and other billing, authentication and support providers retain information needed for their services and legal obligations under their own policies. Contact us for a request concerning personal information outside your active Spoonbird account. Information may be retained where the law requires it or to handle a dispute or protect against abuse.

Your controls and rights

In Settings you can withdraw AI consent, review onboarding answers, export your data, or delete your account. You can correct or remove record entries. Exports and shared reports leave Spoonbird only when you choose to share them, and the recipient handles its copy under its own practices. Deleting the app does not delete your server account or cancel an App Store subscription.

Depending on applicable law, you can ask for access, correction, a copy, deletion, or withdrawal of consent to collection and sharing of consumer health data. Washington residents have rights under the My Health My Data Act; California residents may have rights under applicable privacy and consumer health laws. We may verify your identity before completing a request. We will not discriminate against you for exercising these rights. To request help or appeal a decision, email help@8oclock.co. Washington residents can also contact the Washington Attorney General.

Children, security and updates

Spoonbird is intended for people aged 17 and over. Please contact us if you believe a younger person has provided information. We use encrypted network connections, account access controls and restricted service credentials; no service can guarantee absolute security. This notice will be updated when our practices change, with a new effective date and additional notice where required.