Privacy Policy

Kestrel Labs · Kestrel Cloud and the Kestrel Labs applications

Version 2.0 · Effective 21 October 2026

Summary in plain language

This summary is part of the Policy. It is here because the law requires us to tell you clearly what happens to your data. The numbered sections below set out the same things in full detail and prevail where they say more.

• Who we are. Kestrel Labs is a non-commercial project run by Eike Meeksa in Estonia, who is responsible for your data. Contact: privacy.kestrellabs@gmail.com.
• Where it's from. Kestrel Labs is an Estonian service under Estonian law (see the Terms of Use). Your rights in this Policy apply to everyone whose data we process, wherever they live.
• What we keep. Your username, a scrambled (hashed) password, the files you upload, and the records our services need to work (for example sign-in sessions, your playlists, what you publish, reports and moderation decisions).
• What we don't do. No advertising, no selling or renting of data, no tracking, no analytics, no profiling for marketing.
• Where. On a server we control in Estonia, in the European Union.
• Who sees it. Only you, unless you choose to publish something. Admins and moderators see what they need to run and police the service. YouTube is contacted only when someone imports from YouTube or a moderator compares songs.
• How long. Until you delete it or your account. Technical records are deleted automatically on fixed schedules (Section 9).
• Your rights. Download everything, delete your account, correct data, object, restrict, and complain to the Estonian Data Protection Inspectorate. Most of this you can do yourself in Nest Drive at any time.

1. Introduction and scope

1.1 This Privacy Policy (the "Policy") explains how personal data is collected, used, disclosed, stored and otherwise processed in connection with Kestrel Cloud, the Kestrel Labs applications Magpie Photos, Nest Drive, Quill (Docs, Sheets and Slides), Owl Calendar, Heron Video and Lyrebird Music, the Kestrel Labs website, Kestrel Admin and Kestrel Moderation (together, the "Services").

1.2 This Policy is provided in accordance with Articles 12, 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Estonian Personal Data Protection Act (isikuandmete kaitse seadus) and other applicable data protection law.

1.3 This Policy applies to everyone whose personal data is processed through the Services, including account holders ("Members"), moderators and administrators, people who contact us, people who send us notices, and visitors to the website.

1.4 This Policy does not apply to services operated by third parties (for example YouTube), even if the Services link to or interact with them. Those services are governed by their own privacy notices.

1.5 The Services are operated from Estonia and directed to Estonia (Terms of Use, Section 3). This does not reduce the protection of personal data: this Policy and the GDPR apply to the processing of the personal data of every data subject, irrespective of nationality or place of residence, as required by Article 3(1) of the GDPR.

1.6 This Policy should be read together with the Terms of Use. Capitalised terms that are not defined here have the meaning given in the Terms of Use.

2. Definitions

2.1 In this Policy:

• "personal data", "processing", "controller", "processor", "data subject", "recipient", "consent" and "personal data breach" have the meanings given in Article 4 of the GDPR;
• "we", "us", "our" and the "Controller" mean Eike Meeksa, a natural person resident in Estonia, operating the non-commercial project known as Kestrel Labs;
• "you" and "your" mean the data subject whose personal data is processed;
• "Content" means files and other material you upload, create, store, import, publish or share through the Services;
• "Kestrel Cloud" means the server operated by us on which the Services store data;
• "Moderator" means a Member appointed by an administrator to review imports, songs submitted for public sharing and reports, and "Admin" means a Member with administrative rights over Kestrel Cloud;
• "Device" means the phone, computer or other equipment you use to access the Services.

3. The Controller and how to contact us

3.1 The controller responsible for the processing described in this Policy is Eike Meeksa, Estonia, operating as Kestrel Labs.

3.2 For any question, request or complaint about personal data, contact privacy.kestrellabs@gmail.com. Please write "Privacy" in the subject line.

3.3 We are not required to appoint a data protection officer under Article 37 of the GDPR, because our processing is not carried out by a public authority and does not involve large-scale regular and systematic monitoring or large-scale processing of special categories of data. We have not appointed one.

3.4 We are established in the European Union and are not required to appoint a representative under Article 27 of the GDPR.

4. Personal data we process

4.1 Account data. Your username; a salted cryptographic hash of your password (we never store your password in readable form); the date your account was created; the invite code used to create it; your role (Member, Moderator or Admin); whether your account is disabled; any storage limit set for you; for Moderators, which Admin created the account and whether a one-time password is still pending; and a record of your acceptance of this Policy and the Terms of Use (the version accepted and the time of acceptance).

4.2 Session data. For every device on which you are signed in: a random session token, when the session was created and when it was last used.

4.3 Content. All files you upload or create in the Services, including photos, videos, documents, spreadsheets, presentations, calendars, music, playlists, album covers, video thumbnails and the information contained in or attached to those files (for example the date a photo was taken, song titles and artists embedded in music files, or location data embedded by your camera).

4.4 Data generated by the applications. Records the applications create in your own drive to work, for example the Lyrebird music library index, Lyrebird playlists, Heron thumbnails and Owl calendar data.

4.5 Published-content data (Heron Video). For each video you publish: title, description, thumbnail, length, file size, visibility setting (public, unlisted or private), publication time, the number of views, and the list of Members who liked it.

4.6 Public-music data (Lyrebird Music). For each song you ask to share publicly: title, artist, album, length, cover, file location in your drive, your confirmation that you made it or may share it, the result of the automated copyright check, including the audio similarity scores (Section 7), the moderation decision, the identity of the Moderator or Admin who decided, any reason, note and matching song they attached, and a count of how often the song has been played.

4.7 Import data. For each request to import from YouTube: the link, whether a video or audio import was requested, the information our server retrieved about the link (title, channel, length, thumbnail address, licence information, copyright indicators and artist findings), whether you acknowledged a copyright warning, the moderation decision and its reasons, progress and error status, and the resulting files.

4.8 Reports. When you report a video or song: your account, the reported item, the reason and the time.

4.9 Moderation records. Decisions taken by Moderators and Admins (approval, refusal, removal, dismissal), the identity of the person who decided, the time, and any reason, note, corrected title or artist, and matching song recorded with the decision.

4.10 Security data. Your device's IP address, held only in the server's working memory to limit repeated sign-in attempts, sign-ups, reports and similar actions (rate limiting).

4.11 Technical error records. When the server encounters an unexpected error, it records the time, the type of request (for example "upload a file") and a technical description of the error. Such a record may incidentally contain a file path that includes an internal account identifier or a file name.

4.12 Correspondence. If you email us, your email address, the content of your message and our reply.

4.13 Data stored only on your Device. The applications store on your Device, and not on our server: your session token, your settings, the upcoming reminders of Owl Calendar, and, for the browser-only versions of Quill and Owl on the website, the documents and calendars you create there. Magpie Photos reads the photos on your Device in order to show them to you and, only if you switch on backup, uploads them to your drive.

4.14 Data we do not collect. We do not ask for or collect your real name, email address (unless you email us), telephone number, postal address, date of birth, payment details, precise location (other than location data you choose to keep inside your own files), contacts, or any special categories of personal data within the meaning of Article 9 of the GDPR. We do not use cookies, advertising identifiers, analytics or tracking technologies.

5. Sources of personal data

5.1 We obtain personal data (a) directly from you; (b) from your Device, through the applications, as described in Section 4.13; (c) from other Members, for example when they report your content or an Admin creates a Moderator account in your name; and (d) for imports and moderation, from YouTube, to the limited extent described in Section 8.4.

6. Purposes and legal bases

6.1 We process personal data only where a legal basis under Article 6(1) of the GDPR applies:

6.2 Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against your interests, rights and freedoms. Our interests are: keeping the Services secure and available; preventing unlawful use, in particular copyright infringement; protecting other Members; and being able to defend ourselves against legal claims. We consider that these interests are not overridden by yours, because the data involved is limited, is kept only for short periods where possible, and is not used for any other purpose. You may object to this processing at any time (Section 11.7).

6.3 Contract. Providing your username and password is necessary to enter into the contract under the Terms of Use. Without them we cannot provide an account. Everything else you provide is voluntary, but some features will not work without it (for example, you cannot publish a video without uploading it).

6.4 No further processing. We do not process personal data for purposes incompatible with those set out above. We never use your Content to train artificial intelligence models, for advertising, for profiling, or for any commercial purpose.

7. Automated checks and decision-making

7.1 When you ask to import from YouTube or to share a song publicly, our server performs an automated check. It retrieves publicly available information about the link or searches YouTube and YouTube Music for the song, and assesses indicators of commercial release (for example a record label notice, an official artist channel or very high view counts) and the likely artist. It also compares the sound itself: it computes an acoustic fingerprint of the first two minutes of the song (or of the linked video) and of the possible originals found on YouTube and YouTube Music, which are downloaded temporarily for this purpose, and measures how similar they are. Fingerprints and downloaded audio are deleted as soon as the comparison is finished; only the similarity scores are kept with the request.

7.2 The result of this check is used to warn you and to inform a human Moderator or Admin, who sees the check result, listens to or watches the material, and decides. There is one exception: where the sound of a song or import is at least 90% identical to an officially released recording (a song on YouTube Music, an official artist or record-label channel, or an upload with more than one million views), the request is refused automatically, because such a request can almost never lawfully be shared. You are told that the refusal was automatic, why, and which release it matched.

7.2a After an automatic refusal, you may ask for a person to check it ("Ask a person to check"). A Moderator or Admin will then review the request from the beginning, without being bound by the automatic result. We consider that an automatic refusal to share or import a song does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR; in any case you always have the right to obtain human intervention, to express your point of view and to contest the decision, as Article 22(3) of the GDPR provides.

7.3 You can ask us to explain any decision and to have it reconsidered by a different person by writing to the address in Section 3.2.

8. Recipients and disclosure

8.1 Other Members. Content you publish is visible to other Members according to the visibility you choose: public videos and approved public songs to all Members; unlisted videos to Members who have the link; private videos only to you. Your username is shown as the channel or as the person who shared the item. View, like and play counts are shown as numbers, never as a list of who viewed, liked or played. Content you keep private is not visible to other Members.

8.2 Admins and Moderators. Admins can see the list of accounts, the storage each account uses, the number of signed-in devices per account, invite codes and roles. Admins and Moderators can see the items in the moderation queues (import requests, songs submitted for public sharing, reported videos and songs), including the username of the person concerned, and can watch and listen to that material for the purpose of reviewing it. Moderators cannot see accounts, invites, storage figures or Content that has not been submitted for review or reported. Admins and Moderators act under our instructions and are bound to confidentiality (Terms of Use, Section 6).

8.3 Server administration. Because the Services run on hardware we control, the person administering the server can technically access the data stored on it. We access stored Content only where necessary (a) to provide or repair the Services, (b) at your request, (c) to investigate a specific notice or report of unlawful content, or (d) where required by law.

8.4 YouTube (Google). We contact YouTube, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its affiliate Google LLC (United States), in the following situations only:

• when you request an import, our server retrieves the link's information and the media from YouTube. YouTube receives our server's IP address and the requested link, not your IP address or any information about you;
• when a song is shared publicly or a Moderator searches for possible matches, our server searches YouTube and YouTube Music and downloads the audio of a few possible originals to compare their sound. YouTube receives the search terms (typically the song's title and artist), the requested videos and our server's IP address. Your song itself is never sent to YouTube;
• when a Moderator or Admin reviews an item in Kestrel Moderation or Kestrel Admin, their own browser loads thumbnails and YouTube's privacy-enhanced player (youtube-nocookie.com) directly from YouTube. YouTube receives that Moderator's or Admin's IP address and browser information, and the videos viewed. This processing concerns the reviewing Moderator or Admin, who is informed of it by this Policy.

Google acts as an independent controller for the data it receives. See Google's privacy policy at policies.google.com/privacy.

8.5 Public authorities and courts. We disclose personal data to courts, law enforcement, supervisory authorities or other public bodies where we are legally obliged to, where it is necessary to report a criminal offence involving a threat to life or safety (including under Article 18 of the Digital Services Act), or where it is necessary to establish, exercise or defend legal claims.

8.6 Rights holders and notice senders. Where we act on a notice about allegedly unlawful content, we may inform the person who sent the notice of our decision. We do not disclose your identity to them unless the law requires it.

8.7 Successors. If Kestrel Labs is transferred to another person or entity (for example, a company formed to continue the project), personal data may be transferred to that successor. We will tell you in advance, the successor will be bound by this Policy, and you may delete your account before the transfer takes effect.

8.8 No sale. We never sell, rent or trade personal data, and we never disclose it for advertising.

8.9 Processors. We do not currently use any processors to host Kestrel Cloud. The website may be served by a web hosting provider, which would receive the usual technical connection data (such as IP addresses) as our processor under a contract complying with Article 28 of the GDPR. We will name any such provider in this Policy.

9. Retention

9.1 We keep personal data only for as long as necessary for the purposes for which it is processed:

9.2 Deletion of your account. When you delete your account in Nest Drive, your account data, sessions and all your Content are erased from Kestrel Cloud immediately and irreversibly, together with your published videos, likes, reports, import requests and public songs. We do not keep copies of deleted accounts. Correspondence you sent us by email is kept as stated above.

9.3 Backups. We do not keep separate backups of Members' Content. If we start doing so, we will state the retention period of backups here.

10. Security

10.1 We implement appropriate technical and organisational measures under Article 32 of the GDPR, including: encryption of all connections with HTTPS (using a certificate pinned in the applications); storing passwords only as salted scrypt hashes; one-time passwords for new Moderators that must be replaced at first sign-in; automatic expiry of unused sessions; signing out every device when you change your password; rate limiting of sign-ins and other actions; strict separation of each Member's files; and restricting administrative functions to Admins and moderation functions to Moderators and Admins.

10.2 Files on the server are not encrypted at rest. Physical access to the server is restricted.

10.3 No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for the security of your Devices.

10.4 If a personal data breach occurs, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it where required by Article 33 of the GDPR, and will inform affected Members without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34).

11. Your rights

11.1 Subject to the conditions and exceptions in the GDPR, you have the following rights. Exercising them is free of charge.

11.2 Right of access (Art. 15). You may obtain confirmation of whether we process your personal data and a copy of it. In Nest Drive, Download all my data gives you an archive with your account record and every file in your drive.

11.3 Right to rectification (Art. 16). You may correct your data. You can change your password and edit or delete your Content yourself. For anything else, contact us.

11.4 Right to erasure (Art. 17). You may delete your account and all your Content at any time in Nest Drive (Delete my account). You may also ask us to erase specific data.

11.5 Right to restriction (Art. 18). You may ask us to restrict processing, for example while the accuracy of data is being checked.

11.6 Right to data portability (Art. 20). You may receive the personal data you provided in a structured, commonly used and machine-readable format. The archive described in Section 11.2 serves this purpose. Your files are returned in their original formats.

11.7 Right to object (Art. 21). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. We will then stop, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

11.8 Withdrawal of consent. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing before the withdrawal.

11.9 How to exercise your rights. Use the functions in Nest Drive where available, or write to the address in Section 3.2. We will respond within one month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; we will tell you within the first month if so. We may ask for information to confirm your identity, for example by asking you to send the request from within your signed-in account. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act, as permitted by Article 12(5) of the GDPR.

11.10 Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Estonia, this is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee. We would appreciate the chance to address your concerns first, but this does not affect your right to complain at any time.

12. Children

12.1 The Services are not directed to children under 13. In accordance with Article 8 of the GDPR and § 8 of the Estonian Personal Data Protection Act, a person must be at least 13 years old to create an account. Members under 18 must have the agreement of a parent or legal guardian (Terms of Use, Section 3).

12.2 If we learn that an account belongs to a person under 13, we will delete it and its Content. If you believe a child under 13 has an account, contact us.

13. Data on your Device, cookies and similar technologies

13.1 The website and web applications do not use cookies. They use your browser's local storage, and the Android applications use the app's private storage, only for things that are strictly necessary to provide the service you request: keeping you signed in, remembering your settings, and storing the files of the browser-only versions of Quill and Owl. Under Article 5(3) of Directive 2002/58/EC, consent is not required for such storage. You can delete it at any time by signing out, clearing your browser data or uninstalling the application.

13.2 Lyrebird Music on Android shows the current song's title, artist and cover in your phone's media controls (lock screen, notifications and connected headphones or car systems). This information stays on your Device.

14. International transfers

14.1 We store and process personal data in Estonia, in the European Union. We do not transfer personal data to third countries.

14.2 Where Google LLC receives data as described in Section 8.4, it may process it in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by the European Commission's adequacy decision of 10 July 2023 under Article 45 of the GDPR. Google acts as an independent controller for that data.

15. Moderators and Admins

15.1 If you are a Moderator or Admin, we additionally process: your role; for Moderators, the account details created by the Admin who appointed you; and the moderation decisions you take, which are recorded with your account so that decisions can be explained and reviewed. Your username is not shown to the people affected by your decisions, but is visible to Admins.

15.2 Your own browser contacts YouTube when you review items (Section 8.4). You may avoid this by not playing comparison material, but you may then be unable to carry out reviews.

16. Changes to this Policy

16.1 We may update this Policy to reflect changes in the Services, the law or our practices. The version number and effective date at the top show which version applies.

16.2 We will announce material changes in the applications or on the website before they take effect. Where a change requires your consent, we will ask for it. The applications ask new Members to accept the current version when they create an account, and Moderators when they first sign in.

17. Contact

Eike Meeksa · Kestrel Labs · Estonia privacy.kestrellabs@gmail.com