Bird Dog — Privacy Policy

Effective date: 2026-06-06 Last updated: 2026-06-08

Bird Dog ("Bird Dog," "we," "us") is a service operated as a sole proprietorship (business-entity formation pending; this policy will be updated with the entity name when it forms) that helps small federal contractors find U.S. government solicitations that fit their business. This policy explains what we collect, why, and your choices. Questions: [email protected].

What we collect

1. Account identity (via sign-in). You sign in with Google or Microsoft (OAuth/OIDC). We receive your verified email address and basic profile (e.g., name) from that provider. We never see or store your Google/Microsoft password — we don't run our own password system.
2. Capability profile. Information you enter so we can match solicitations to your business: set-aside eligibility, NAICS codes, place of performance, contract value range, contract vehicles, past-performance keywords, and similar fields.
3. Sensitive note: your set-aside eligibility (e.g., SDVOSB, WOSB, 8(a), HUBZone, veteran-owned) can reveal demographic or socio-economic status about you or your business. We collect it only to match opportunities, store it solely for that purpose, and do not sell it or use it for advertising.
4. Usage data. Which opportunities you view and unlock, and basic technical/log data (IP, device/browser, timestamps) needed to operate and secure the service.
5. Payment data. When you unlock an opportunity or buy a 7-day pass, payment is processed by Stripe. We do not collect or store your card number — Stripe does. We retain a record of the transaction (amount, date, what was unlocked).

The solicitation data itself

Federal solicitation data shown in Bird Dog comes from SAM.gov, a public U.S. Government source. That data is public. What you pay for is our matching and curation work, not exclusive access to the data (see our Terms). We use SAM.gov data consistent with its terms of use (public API; no bulk redistribution).

How we use your information

• To find and rank solicitations that fit your capability profile.
• To create and secure your account and process your unlocks/passes.
• To send transactional email (e.g., payment receipts, via Stripe).
• To operate, debug, and improve the service.

We do not sell your personal information, and we do not use it for third-party advertising.

Who we share it with (service providers only)

• Google / Microsoft — sign-in.
• Stripe — payment processing and payment receipts.
• Render — hosting and running the service.
• PostHog — privacy-first product analytics and session replay (see Analytics below). We share only what each provider needs to perform its function. We may disclose information if required by law.

Security

• Sign-in is delegated to Google/Microsoft; we store no passwords.
• Sessions use signed, HTTP-only cookies; secrets are kept out of source control.
• We apply reasonable technical and organizational safeguards. No method is 100% secure, and we can't guarantee absolute security.

Analytics

We use cookieless, privacy-first web analytics (Cloudflare Web Analytics) to count page views and see which pages are useful. It sets no cookies, uses no cross-site tracking, and does not profile you; we see aggregate counts, not individuals. There is nothing to opt out of because nothing identifies you.

We also use PostHog, a third-party product-analytics processor, to understand how people move through the app and where the experience is confusing — and, to that same end, to record anonymized session replays. We use this only to improve usability; we never sell it. This is configured privacy-first: it is cookieless (it sets no cookies and uses no persistent local storage), and every form input and all on-screen text — including your NAICS codes, set-aside eligibility, profile details, and email — is masked in recordings, so a reviewer watching a replay sees the page's layout, not your actual data. We honor the Do Not Track browser signal: if your browser sends it, PostHog does not run.

Retention and deletion

We keep your profile while your account is active. You can delete your profile/account at any time (contact us / use the in-app deletion); we delete your capability profile and account identity, retaining only what we must for legal, tax, or fraud-prevention reasons (e.g., transaction records).

Your choices and rights

You may access, correct, or delete your profile. Depending on where you live, you may have additional rights (access, deletion, portability); contact [email protected] and we'll honor applicable requests.

Children

Bird Dog is a business tool not directed to children under 18 and not intended for their use.

Changes

We may update this policy; we'll change the "Last updated" date and, for material changes, provide notice.

Contact

Bird Dog · [email protected]