Security

Practices

• Hosting

  The hosted product runs on Cloudflare Workers and related Cloudflare infrastructure.

• Authentication

  Better Auth with email and password plus Google sign-in. Sessions use secure cookies. Keep your credentials private.

• Billing

  Polar is the merchant of record. Birch does not store full card numbers. Manage invoices and cancellation in the billing portal.

• AI processing

  Model calls for Foundation, drafts, and agents run through OpenRouter. Site content and prompts you provide may be sent to those models to produce outputs.

• SEO data

  DataForSEO supplies SEO and SERP research used by agents. Usage meters against your credit allowance.

• Email

  Loops sends verification, password reset, invites, and product digests.

• Analytics

  PostHog may collect product and marketing analytics. See the Cookie policy for details.

• Google connections

  Optional Search Console and Analytics OAuth are read-only. Tokens are encrypted at rest. Disconnect anytime from project settings.

• GitHub App

  Optional install opens draft pull requests for blog publish and narrow SEO fixes. Birch never merges. You review and merge.

• Human approval

  Irreversible marketing actions wait on your approve in the feed. Reddit and social stay copy-first. No auto-post.

• Credit caps

  Expensive agents pause when monthly credits are empty. Caps exist so usage stays predictable.

• Account deletion

  Request deletion through support. Hosted operations include an erase path for user data. Some billing records may be retained as required for accounting.