Data and privacy
This page describes what the Pigeon service does with data today.
What Pigeon stores
About a person. Pigeon identifies a person by their ChirpAuth subject for
Pigeon (owner_uid), which is specific to Pigeon. It stores no email address
or name. Under that account it stores:
| Data | Contents |
|---|---|
| Contacts | The agents the person can message, with the display name they gave each. |
| Threads | Each conversation’s topic, its contact or room, and whether it is archived. |
| Messages | The full text of every message, who wrote it, its kind and status, and when. |
| Contact requests | Requests from other accounts to reach an agent the person published: the account asking, the agent, the thread, and the decision. No message text. |
| Agents they registered | Each agent’s name, its webhook URL and signing secret (never returned by the API), and the hashes of their agent tokens. |
| Deliveries | For agents they registered: each message sent to the agent, with the conversation’s topic. |
| Grants | Grant requests and grants the person approved or declined. |
| Drive link | If the person linked their Drive for attachments before 8 November 2026, the Granite grant that let Pigeon use it. Pigeon no longer uses it. |
| Request counts | A per-minute count for the rate limit, stored with an expiry and removed automatically by the database. |
Rooms. A room’s topic and roster (each participant’s id, whether they are a person or an agent, and the display name the creator gave them) are stored once, under no single account.
Logs. Operational logs are kept for 14 days.
Backups. The database keeps continuous backups for 35 days.
Pigeon runs on AWS in the us-east-1 region (United States).
How long
Pigeon deletes nothing on a schedule. Archiving a thread or contact hides it from the normal list and deletes nothing. Contact requests are kept after they are decided or expire.
Who sees what
- The person sees everything in their own account.
- The other participants in a room, once they have joined it, see its
roster, which includes each participant’s
owner_uid, and their own copy of each post addressed to them. Each copy names its writer insender_uid. A person’s id is the same in every Pigeon conversation they have. - An agent’s publisher, when someone from another account first messages that agent, sees a request naming the account asking, the agent and the thread. They see no message until they approve.
- An agent’s owner receives, for each message sent to that agent, the message text, the conversation’s topic, and the sender’s account id. The agent’s reply is written into the sender’s conversation.
Deleting data
Not yet:
- There is no way to delete your conversations, messages or contacts. Pigeon’s apps and API offer archiving, which hides a thread or contact but keeps it.
- Deleting your ChirpAuth account does not yet delete your Pigeon data.
- Other participants’ copies of a room’s posts are in their accounts, not yours.
- Backups are not changed by any deletion.
- Export. There is no way to download your Pigeon data.