Droppingsby Pigeon

Pigeon transparency report

How this works

The plain version, with no jokes, because this is the part that matters if you're deciding whether to trust us.

What we require before we answer

We respond only to valid legal process that is properly served and names the data it seeks precisely. We review every request and may object to or narrow one that is unclear, too broad or not valid. Under US law, in short:

  • Basic subscriber records (for Pigeon, only a handle and its public key, if any): a subpoena, court order or warrant.
  • Other records that aren't message content: a court order under 18 U.S.C. 2703(d), or a warrant.
  • Stored content: a search warrant. Stored content is encrypted, and we can't decrypt it.
  • Preservation: we preserve what we hold that the request identifies, for 90 days, extended by 90 more on a renewed request. It can't capture what we don't hold.
  • Requests from outside the US: through a mutual legal assistance treaty or another process US law recognises.
  • Emergencies: US law lets a provider share information without a court order when it believes in good faith that someone is in danger of death or serious injury. We decide each request ourselves, and what we could share is still only what our table shows.

The full text, and where to send legal process, is in our law enforcement guidelines.

Some orders legally prevent disclosure

A court can order a provider not to tell anyone about a subpoena, order or warrant for a time (18 U.S.C. 2705(b)). National security letters carry a gag by law. Publishing in breach of an order like that is a crime.

So: a gagged request is never published here while the gag is in force. Not as an entry, not in a count, not as a hint. When a gag ends, we add the request, with the period in which we received it, and say when we were first allowed to.

That means this site can only ever show what we're allowed to say. We'd rather say that plainly than let anyone read more into a page than it holds.

National security requests

For national security letters and orders under the Foreign Intelligence Surveillance Act, US law lets a provider publish only ranges, for set periods, after a delay, and a longer delay for a new service (50 U.S.C. 1874). We publish no national security figure yet, not even a range. When the law allows us to, we will, in the form it allows.

No warrant canary, and why

Some services publish a statement such as “we have never received a secret order” and take it down if one arrives. We don't, for three reasons.

  • Whether a canary works in law is untested in the courts. A provider could be ordered to keep a false one up.
  • A canary that stays up can give a false sense of safety, which is worse than none.
  • The honest statement is the one above: some orders can stop us telling you, and when they do, the request isn't here.

Nothing on this site is a canary. If a page stops being updated, read nothing into that alone.

How we count

  • Every request we receive is counted under its kind, as of the report's date, with the number of accounts it named and what we produced.
  • Counts are exact: a zero means zero received, as of that date, and makes no promise about any later date.
  • An entry's number is given when it's published, not when the request arrives, so the numbers have no gaps that could hint at something we can't publish.
  • Dates are shown to the day, the month or the quarter. In a small service, one exact date can identify the person a request was about.
  • Every file we remove after a report or request is counted. Our servers delete only the exact upload named.
  • Corrections are added with their date. We never quietly edit a published number.
  • We publish a new report at least every six months.

Documents

Where it's lawful and safe, we publish the request and our reply, with personal details removed from the page image itself, so there is no hidden text underneath. Sealed court documents aren't published. Anything about a child's safety or an emergency is never published in a way that could identify anyone.

Telling the person concerned

Our policy is to tell a user when someone has asked for their data, unless the law or a court order forbids it, or there's an emergency. Pigeon has no email address or phone number for anyone, and in-app notices aren't built yet, so currently we may have no way to reach them. Each entry says which.

Who signs off

Nothing on this site publishes itself. Every entry and every report is built from structured data, and the build refuses any item, and any page, that Pigeon's owner hasn't signed off. Each entry and report shows the sign-off and its date.

Drafts of the plain-language summaries may be prepared with software help, including an AI drafting assistant. It works only from details already cleared for publication, never from an order itself or anything under a gag, and its drafts change nothing until a person approves them. Numbers are never drafted: they're counted from the data.