Your BirdWeather token is held in sessionStorage — a temporary browser store that exists only for the lifetime of this tab. It is automatically cleared the moment you close the tab or browser. It is never written to disk, never sent to our servers, and never persisted between sessions unless you re-enter it.

Cleared automatically on tab close

When you load your station data, your token is sent as an HTTP request header (X-Auth-Token) to a lightweight Cloudflare Worker proxy — never as part of a URL. This means your token never appears in browser history, server access logs, CDN logs, or network monitoring tools that record URLs.

The Worker receives the header, constructs the BirdWeather API request server-side, and returns only your bird data. The token is not logged or stored by the Worker.

Token travels as a header, never in a URL

We do not: log your token, store it on any server, share it with third parties, use it for any purpose other than fetching your BirdWeather detection data, or transmit it to any destination other than the BirdWeather API.

Your BirdWeather token is essentially a password for your station data. To keep it safe:

• Don't use this site on shared or public computers. If you do, always click Revoke before leaving.
• Don't share your token in screenshots, social posts, or messages.
• Don't paste it into sites you don't trust.
• If you believe your token has been compromised, you can regenerate it from your BirdWeather account settings.

All bird detection data displayed on this site is retrieved directly from BirdWeather via their official API. Once your request reaches BirdWeather's servers, their own privacy policy and data practices apply. You can review the BirdWeather API documentation and their privacy policy for full details on how they handle your station data.