CanaryBell Privacy Policy

Last updated: 14 October 2026

The short version

• CanaryBell lets a business's staff and customers send private messages to its owner or manager, and get replies.
• Staff and customers never create an account. We don't ask for their names, email addresses or phone numbers.
• Every message starts out anonymous. Our servers never collect IP addresses, device details, location or the time of day a message was sent. There are no cookies, analytics or ad trackers.
• The keys that connect you to your messages stay on your own phone or browser.
• Only a business's owner and the managers they add have accounts. For them, we keep an email address, first name and role.
• Businesses pay through Stripe. Staff and customers never pay for anything.
• We never sell information, share it for ads or use it to train AI.
• One honest warning: the words in a message can still give away who wrote it.

At a glance

We store messages so the business can read them. We read a message only if someone reports or blocks it (see "Reports and blocks"), or as "Honest limits" describes.

Who we are

CanaryBell is run by Cerebra Enterprises, LLC, a Maryland limited liability company ("we" or "us"). This policy covers canarybell.com, the CanaryBell web app and the CanaryBell iPhone app.

Our role

• Messages that staff and customers send, and the replies to them, are handled for the business that receives them. We act as that business's service provider (sometimes called a "processor"), and use messages only to run CanaryBell for it. The business decides what to do with them. A business can ask us to sign a data processing agreement.
• Owner and manager accounts, billing, our website and emails you send us are our own responsibility. For these, we're the "controller".

If you're a staff member

You join with your workplace's join code, from a QR code or a link. You never create an account or tell us your name, email address or phone number.

What we keep, for each tip:

• The business it went to.
• Its type (like Idea, Problem or Safety), its status (Received, Heard, Working on it or Done), your message and the replies.
• The day it was sent, and the day of each reply, in the business's time zone. Never the time.
• The batch it's delivered in, if the business uses batches (for example, "10 PM on the 28th").
• Who can read it: "Owner only", or "Owner and managers" (only if the business had managers when you sent it).
• A scrambled copy (a "hash") of the tip's secret key. The key stays on your phone. The copy can check a key but can't recreate it.
• For "Open to talk": the public half of a key pair. The private half never leaves your phone, so only your phone could ever prove you wrote the tip.
• A block tag (from 14 October 2026): a scrambled code made from the random value your phone sends to slow down spam, mixed with the business and a secret only our server knows. It's what lets a business block someone without learning who they are (see "Reports and blocks"). The business never sees it, and it can't connect you across businesses.

What stays on your phone or browser: your workplace's join code and a pass that's the same for everyone there, each tip's ID and key, and a random value we use to slow down spam and to make blocking work. Each tip has its own key. Only our server could tell, from the block tag, that two tips to the same business came from the same phone, and it never shows or uses that for anything except stopping a phone the business has blocked.

Who reads your tip: your tip goes to the owner or manager. If your workplace has managers, you choose for each tip: "Owner and managers" (where every tip starts) or "Owner only" (choose it if the tip is about a manager). Every tip also starts Anonymous, and your choices are never remembered. Managers can't see, count or get reminders about "Owner only" tips.

Whoever reads your tip sees its type, "Anonymous" or "Open to talk", your words, and the day it reached them (for a batched tip, the batch's day). Never the time you sent it, or anything about your phone or connection. Tips in a batch appear in random order, and your later replies reach them after a short random delay. The Sent screen tells you when your tip will arrive.

Leaving a workplace: "Leave" in My tips removes the join code and pass from your phone or browser. Your tips and their keys stay, so you can still read replies.

If you're a customer

You write from a QR sign at one of the business's locations, like "Lobby". You don't need an account, phone number or email address. Every customer form reminds you: "Please don't include personal information, like names, birth dates, account numbers or health details."

What we keep: the business and location, the topic you picked, your words (if any), the status and any replies, and the day you sent it. Never the time. If the business gets customer messages in batches, we also keep which batch yours arrives in. If you leave "Show me replies here" on, we keep a scrambled copy of a key that stays in your browser, so only that browser can see replies. If you turn it off, we keep nothing that could reconnect you to your message, and nobody can reply to it.

What stays in your browser: if you asked to see replies, your message's ID and key, the sign's code and the topic, so you can find it again. Your words aren't saved there. Your browser also keeps a random value we use to slow down spam and to make blocking work. We keep a block tag made from it with your message, as described for staff above, so a business can block a browser without learning who it belongs to.

Who reads it: the owner or manager. If the business gets customer messages right away, yours shows as "Live now" for about 30 minutes, so they know you may still be nearby. That mark is kept apart from your message and deletes itself, so no send time survives. After that, they see only the day. Messages that arrive in a batch never show as "Live now".

Updates: an owner or manager can post a short update to a location's page. Anyone who opens that page sees it, with the poster's first name and role, for up to 2 hours. Then it deletes itself.

If you're an owner or manager

What we keep:

• Your email address, first name and role. Your first name and role appear on your replies ("Dana · Owner", "Sam · Manager"), and we record which of you wrote each one.
• Your business's name, time zone (from your device when you set it up), join code, locations and their sign codes, and settings, with the day the business, each location and each person was added.
• Sign-in codes and sessions, stored only as scrambled copies, each with the email address it's for. Codes expire after 10 minutes, stop working after 5 wrong tries and are deleted once used. Sessions end after 90 days, or when you sign out, whether or not you finished setting up a business.
• How far each conversation has been read (a number, not a time), for "New reply", and the day we last sent your business a safety reminder.
• For owners: your plan and billing status.

On your phone or browser: your sign-in token and a copy of your profile, in the iPhone Keychain or the web app's browser storage. Signing out deletes both, and ends the session on our server.

Managers: an owner adds a manager by typing their first name and email address. We email the manager once, from sign-in@canarybell.com, to say who added them and how to sign in, and nothing about any message. Managers read and answer customer messages and the tips shared with them. Only owners can change delivery, customer alerts, the join code and People, or see managers' email addresses. Removing a manager deletes their sign-in and ends their sessions at once. Their past replies keep their first name and role.

Emails we send: sign-in codes and manager invitations, from sign-in@canarybell.com (codes never appear in subject lines), and, while a safety issue waits for a follow-up, one reminder each morning from reminders@canarybell.com. Managers get reminders only for safety issues they can read. Reminders say how many are waiting, never what they say, when they arrived or anything about who sent them. We may also email owners about their plan or important changes. Cloudflare, which sends our email, keeps a record of each email's recipient, subject line and delivery status, but not its contents.

Billing

Businesses pay for CanaryBell monthly. Staff and customers never pay, and never deal with Stripe.

We use Stripe Managed Payments. Link, Stripe's checkout service, is the merchant of record: it's the seller for the payment, adds any sales tax on top of the price and sends your receipts. Link collects your payment details under its own privacy policy (link.com/privacy), and Stripe's privacy policy (stripe.com/privacy) also applies.

We can see order details in our Stripe account, such as the name, email address, phone number and billing address given at checkout, the plan, the amounts charged and the card's last four digits. CanaryBell's own database keeps only your plan, subscription status and Stripe's customer and subscription IDs. Full card numbers never reach us.

Pausing

If a business cancels or stops paying, it's paused. Its staff and customers can't send new messages, and the owner and managers can still sign in to read and finish conversations for 90 days. Choosing a plan again within those 90 days reopens it. After that, the business and its messages are deleted.

On your phone: the iPhone app and the web app

Nobody has to download anything: the web app works from a QR code or link. Staff with an iPhone can use the CanaryBell app instead. Customers always use the web app.

The iPhone app:

• Keeps join codes, tip keys, the spam-limit value, owner sign-ins and a note that you agreed to the Terms of Use in the iPhone Keychain, set to "this device only". They never sync to iCloud or move to another phone through a backup.
• Makes each "Open to talk" key inside the Secure Enclave, the phone's built-in security processor, so it can't be copied out, not even by the app. On a device without one, it's an ordinary key, kept in the Keychain on that device only.
• Has no analytics or tracking code (its privacy manifest declares no tracking), and never asks for your camera, photos, contacts, microphone or location.
• Identifies itself only as "CanaryBell", not by phone model or iOS version, and keeps no cookies or cache. Keys and sign-in tokens travel in a request header, never in a web address.
• Runs the join screen's human check in a small web view that keeps nothing afterwards.

The web app:

• Keeps join codes, tip keys, customer reply keys, owner sign-ins, the spam-limit value and a note that you agreed to the Terms of Use in this browser's local storage, plus a note if you close the "Add to Home Screen" tip. Each key is only ever sent to our server, and only for its own message.
• Makes each "Open to talk" key one your browser can use but never export, kept in its built-in database (IndexedDB).
• Keeps a copy of the app's own files (a "service worker") so it works offline. That copy never includes tips, replies or sign-ins.
• Loads nothing from other websites, except Cloudflare's human check on the join screen. Its pages tell your browser not to share where you came from, and switch off the camera, microphone, location and ad-topic tracking.

Browsers can clear a website's storage (in a private window, or Safari after a while), which would remove your keys. That's why My tips suggests adding CanaryBell to your Home Screen. Customer pages never ask you to install anything.

Reports and blocks

CanaryBell has zero tolerance for objectionable content and abuse (see our Terms of Service). To keep it that way:

• Filtering. Slurs and strong profanity are starred out automatically as messages are sent, before anyone sees them. The starred-out words aren't kept.
• Reporting. Owners and managers can report a tip or customer message, and staff and customers can report the replies they get. A report emails us the reported words, the business's name and the role of the person who reported it (for example "a manager" or "a staff member"), never anything that identifies a staff member or customer.
• Blocking. When an owner or manager blocks a sender, the message disappears from the business at once, and we add that message's block tag to the business's blocked list, so that phone or browser can't send it anything again. Nobody learns who it was. When staff or customers block the replies in a conversation, it's closed. Blocking also sends us a report.
• What we do. We review every report within 24 hours. If something breaks our Terms, we delete it, and we ban the phone or browser it came from, remove the manager who wrote it, or suspend the business.

What we never collect

CanaryBell's servers never collect or store:

• IP addresses, device or browser details, or location. (The only device details we ever see are in crash reports Apple may pass on, described under "Service providers".)
• The time of day anything was sent by a staff member or customer. We keep only the day and, for batched messages, which scheduled batch it goes out in.
• The names, email addresses or phone numbers of staff or customers, unless someone writes them in a message or emails us.
• Anything that shows a business which messages came from the same phone or browser. (Our server keeps a block tag with each message, described above, and uses it only to stop a blocked phone or browser.)
• Cookies. What we keep on your device is only what CanaryBell needs to work, which is why you won't see a cookie banner.
• Analytics, ad tracking or tracking of any kind.

Honest limits

• Your words can give you away. A detail only you would know, or your way of writing, might point to you. On a small team, when a message arrives might too, which is why businesses can deliver tips in batches. Safety tips skip the batch unless the business changes that.
• Our host sees IP addresses. Cloudflare's network has to see IP addresses to deliver pages and stop attacks. All logging is turned off in our Cloudflare account, and CanaryBell never reads or stores them. Cloudflare's security tools may keep records of requests they block as attacks.
• The human check on the join screen. Cloudflare Turnstile checks that a person, not a script, is entering a join code. It looks at your browser, as any website's host can, only on the join screen, never while you write, send or read a message. We never send it your IP address. Cloudflare handles what it sees under its own terms (Turnstile privacy addendum).
• Anyone with the join code can send tips. That's the price of having no accounts. Owners can change the code at any time.
• Messages aren't end-to-end encrypted. They're stored on our servers so the business can read them. We don't read them, except when someone reports or blocks a message, when needed to keep CanaryBell running, to help the business that received them when it asks, or when the law requires it.
• Backups. Our database host keeps automatic backups. Deleted information is gone from them within 30 days. Only we could use them, never a business.
• Your phone. Anyone who can use your unlocked phone or browser could see the messages you sent from it.
• Emailing us. If you write to us, we see the address you write from. To stay anonymous, use one that doesn't show your name.

How we use information

Only to run CanaryBell: to deliver messages and replies, sign people in, send the emails described above, bill businesses, stop spam and abuse, keep the service secure, answer you when you write to us, and meet legal obligations.

We never:

• sell personal information, or share it for advertising;
• build profiles of anyone;
• use messages, or anything else you give us, to train AI.

If a message happens to contain sensitive information, like health details, we use it only to deliver the message.

We share information only with the business a message was sent to, with the service providers below, when the law requires it, or with a new owner if CanaryBell is ever sold or merged, who would have to keep the promises in this policy.

Service providers

• Cloudflare hosts CanaryBell: our servers, database, short-lived storage and spam counters. It also sends our emails, runs Turnstile (the human check, on the join screen only) and passes email sent to hello@canarybell.com on to our inbox.
• Google hosts the inbox where we read that email.
• Stripe and Link handle payments. Only businesses deal with them.
• Apple distributes the optional iPhone app through the App Store. If you've chosen to share analytics with app developers in your iPhone's settings, Apple may give us crash reports (which include the phone model and iOS version, never messages) and overall numbers, like downloads.

We use no analytics, advertising, AI or text-message providers. Before we add any provider, or any feature that handles a new kind of information, we'll update this policy first.

Legal requests

We only have what this policy describes. We can't identify anonymous senders, because we don't collect what would identify them. We share information only when the law requires it, and only what it requires. We'll tell the business involved before we disclose anything, unless the law forbids it.

How long we keep things

Deleting your information

Owners: Delete business. An owner can delete their business at any time, in Settings → Delete business (in the iPhone app or the web app), or by emailing us from the owner's email address. After two confirmations, we immediately and permanently delete the business and its join code, every team tip and reply, every customer message and reply, every location and its sign code, the business's "Live now" marks and updates, your account and your managers', and every sign-in code and session for you and your managers. It also cancels your plan, and it can't be undone. Staff phones and customer browsers keep only their own keys, which stop working. Database backups are gone within 30 days. Billing records in Stripe are kept as tax law requires.

Managers: Leave this business. In Settings → Leave this business. It deletes your sign-in (email address, first name and role) and ends your sessions at once, the same as an owner removing you. Your past replies keep your first name and role, as part of the business's conversations.

Staff and customers. Your messages stay with the business, which controls them. What's on your own device is yours to remove:

• Web app: clearing your browser's website data for canarybell.com removes everything CanaryBell keeps there, including your keys. Then nobody, including you, can reconnect you to those messages.
• iPhone app: your tips and their keys stay in the Keychain, and there's no button to remove them. Deleting the app may not remove them either, because iPhones can keep an app's Keychain items after it's deleted. Erasing the phone removes them.
• Customers who turned "Show me replies here" off have nothing to remove.

Your rights

Owners and managers can see their name, email address and role in Settings, and can email hello@canarybell.com to get a copy of their information, correct it or delete it.

Staff and customers: we don't know who you are, on purpose. So we can't confirm that a message is yours, or look it up, change it or delete it for you: anyone could claim to have written it, and the only proof is the key on the sender's own phone or browser, which we never keep. You can read your own messages and replies in the app, or ask the business that received them, which controls them, though asking may show them it was you. If you email us, we'll use your email address only to reply, and we'll never tell a business who contacted us.

US state privacy rights

California and a growing number of other US states give people rights over their personal information. Here are the details those laws ask for.

What we've collected in the last 12 months:

We don't collect geolocation, biometrics, browsing history or inferences, or anything else except what someone chooses to write in a message. How long we keep each kind is under "How long we keep things".

No selling, sharing or profiling. We don't sell personal information or share it for cross-context behavioral advertising, and haven't in the last 12 months, including for anyone under 16. We don't use it for targeted advertising, profiling, or automated decisions with legal or similarly significant effects, or share it with anyone for their own direct marketing. We use sensitive personal information only to provide CanaryBell and keep it secure, never to infer anything about anyone. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of sale and sharing, which is already true for everyone. We don't track you across websites, so Do Not Track has nothing to switch off.

Your rights. Depending on your state, you can ask to know what we have about you and how we use it, get a copy, correct it, delete it, and opt out of sale, sharing, targeted advertising and profiling (which we don't do). We'll never charge you more, give you a worse service or treat you differently for using these rights.

Making a request. Email hello@canarybell.com, or write to us at the address under "Contact us". We'll answer within the time the law allows, usually 30 to 45 days. To check it's you, we'll confirm through the email address on your account, or the one you wrote from. We can't verify staff or customers as the senders of messages ("Your rights" explains why). Someone you choose can make a request for you with your signed permission, and we may ask you to confirm your identity with us directly.

Appeals. If we turn down a request, we'll explain why. Reply with "Appeal" in the subject line, and we'll answer within the time the law allows. If you're still unhappy, you can contact your state's attorney general.

Rights in the UK, the EU and other countries

CanaryBell is offered in the United States and other English-speaking countries. Wherever you live, you can ask for a copy of your information, and ask us to correct or delete it. We'll answer within the time the law allows, usually 30 to 45 days. For messages, the business that received them is the controller and we're its processor, so we'll help the business answer.

The UK and the EU (including Ireland). Under the UK GDPR and the EU GDPR, you can also object to how we use your information, ask us to restrict it, get it in a portable form, and complain to a data protection authority: the Information Commissioner's Office in the UK, the Data Protection Commission in Ireland, or the authority where you live or work. Our legal bases are:

• Contract: running owner and manager accounts, and providing CanaryBell to the businesses that pay for it.
• Legitimate interests: keeping CanaryBell secure and free of spam (including the human check), letting the managers an owner chooses sign in, and answering your emails. You can object, and we'll stop unless we have compelling reasons not to.
• Legal obligation: keeping billing and tax records, and answering lawful requests.

International transfers. We're based in the United States, so your information is processed there and in other countries where our providers operate. Cloudflare's and Stripe's data processing terms include the EU Standard Contractual Clauses where they apply.

Canada, Australia, New Zealand, India, Singapore, South Africa and similar places. Your privacy laws may give you similar rights, including to withdraw consent where our use depends on it. In some places, like India, you can also name someone to use your rights if you die or can't act yourself. You can complain to us first, and you can always contact your country's privacy regulator.

Children

CanaryBell isn't meant for children under 13, and we don't knowingly collect personal information from them. Owners and managers must be at least 18. Staff at a workplace may be teenagers: they never create an account or give us their name, email address or phone number. If you think a child under 13 has given us personal information, email us and we'll help remove it.

Security

• Connections are encrypted with HTTPS: always in the iPhone app, and in the web app whenever its address starts with https.
• Tip keys, customer reply keys, sign-in codes and sign-in tokens are stored only as scrambled copies.
• Our database uses random IDs, with no row numbers that could show the order messages arrived in.
• Every update is checked automatically before it goes live, and stopped if it would turn on logging, read IP addresses or location, store clock times on messages, keep short-lived information without an expiry, or load anything from other websites beyond the human check.
• Our server enforces who can see what: managers can't open "Owner only" tips, even by guessing their address. Spam limits and the human check stop scripts from guessing join codes.

No system is perfectly secure. If a breach affects personal information, we'll tell the businesses, owners and managers affected without undue delay, and regulators where the law requires. Because we don't know who staff and customers are, we'll also post a notice on canarybell.com.

Where information is processed

CanaryBell runs on Cloudflare's worldwide network, so your requests are usually handled in a Cloudflare data center near you, which may be in another country. Our database is stored in Cloudflare's Eastern North America region. "Live now" marks and location updates may be copied to Cloudflare data centers around the world until they expire. Information may also be processed in the US and other countries where Stripe, Link, Apple and Google operate.

Changes to this policy

We'll post any changes here with a new "Last updated" date. If a change is material, we'll email owners before it takes effect. Before we add a service provider, or a feature that handles a new kind of information, we'll update this policy first.

Contact us

Questions, requests or worries about privacy? We'd like to hear from you.

• Email: hello@canarybell.com
• Mail: Cerebra Enterprises, LLC, 5000 Thayer Center, Ste C, Oakland, MD 21550, USA
• Website: canarybell.com