How we protect access to your data.
Here we explain the safeguards built into Crowdbird's code: from your sign-in to access to your workspace's data.
Signing in to Crowdbird
Crowdbird uses a dedicated authentication service for signing in and for checking your session. You can request a sign-in link by email. Protected app pages check whether you're signed in. Open the sign-in link in the same browser you requested it from.
Connecting platforms without storing passwords
For Instagram, TikTok and Facebook, the connection runs through the platform's official OAuth login. That's where you confirm what access the connection gets. Crowdbird stores neither platform passwords nor OAuth access keys for these accounts in its database. Our social media interface holds the platform connection.
Access to your workspace
The database tables for the app and the website are protected by Row Level Security. For workspace data, these rules check whether you belong to that workspace and which role you have. Owners and admins can, for example, publish and export data. Members can edit drafts. Internal tables for server tasks are closed to direct access from the browser.
Public content, such as published link-in-bio pages and marketing texts, has its own read rules. Being visible without signing in gives no access to the rest of your workspace's data.
Protection in the browser
Crowdbird sets a Content Security Policy that defines which sources the browser may load content and scripts from. Signed-in app pages get a one-time value per request for scripts. Other security headers prevent, among other things, embedding in third-party frames, and they restrict browser features such as camera, microphone and location.
The Strict-Transport-Security header tells browsers to open the website over HTTPS. X-Content-Type-Options stops the browser from interpreting a file as a different content type.
IP addresses as hashed values
For click tracking on your link-in-bio page, a hash is built from the IP address and the browser identifier. From that, the database stores a value with a key that changes daily, not the raw IP address. For the usage limits of the free tools and the contact form, Crowdbird turns the IP address into a value with a secret key (HMAC). The IP address itself is not stored. For the contact form, this value is stored with your message and deleted with it: after 12 months, or after 30 days for messages marked as spam. This applies to these three features, not to logs kept by hosting or platform providers.