🪨 Rock Identifier

Privacy Policy

Last updated: April 9, 2026

Rock Identifier ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

1. Who we are

Rock Identifier is an AI-powered app for identifying rocks, minerals, and crystals using your camera. Developed and operated by Poised Venture Studio, Denmark.

Contact: hello@rockscan.app

2. Data we collect

Photos you submit: Images you take or select for rock identification. These are sent to our AI service (Google Gemini) for analysis and stored on our servers to improve identification accuracy over time.
Identification results: The rock name, confidence score, and details returned by our AI for each scan you perform.
Account information: If you sign in with Apple, we receive your name and email (only what you choose to share). Sign-in is optional.
Usage data: Number of scans performed per day (for enforcing free-tier limits), your saved collection and wishlist (stored locally on your device).
Anonymous device ID: A randomly generated ID used to enforce daily scan limits and for debugging. Not linked to your identity.
Feedback: If you correct an identification result, we save your correction to improve the AI.

3. What we do NOT collect

Precise GPS location
Contacts, microphone, or any data unrelated to rock identification
Payment details (handled entirely by Apple / RevenueCat)
Data for advertising purposes

4. How we use your data

Identify rocks, minerals, and crystals from your photos
Improve AI identification accuracy over time
Enforce daily free scan limits
Manage your subscription status
Debugging and app improvement

We never sell your data to third parties.

5. Legal basis for processing (GDPR Art. 6)

Consent (Art. 6(1)(a)): When you take a photo and submit it for identification, you consent to that image being processed by our AI service. You can withdraw consent at any time by stopping use of the app and requesting deletion of your data.
Contract performance (Art. 6(1)(b)): Processing necessary to provide the identification service you requested, manage your subscription, and maintain your collection.
Legitimate interest (Art. 6(1)(f)): Anonymous usage analytics and service improvement, where our interest does not override your rights.

6. Photo data and AI processing

Important — third-party AI processing: Photos you submit are sent to Google Gemini AI for analysis. This means your photo data is processed by Google LLC (a US-based company) in accordance with Google's Privacy Policy. By using the identification feature, you explicitly consent to this transfer and processing.

We store a copy of submitted photos on our servers (Supabase, EU/Frankfurt) to build a training dataset for future model improvements. Photos are not publicly accessible and are not shared with third parties beyond what is described here.

7. International data transfers

Your data may be transferred to and processed in countries outside the EU/EEA:

Google Gemini AI (USA) — for image analysis. Google operates under EU-US Data Privacy Framework and Standard Contractual Clauses.
RevenueCat (USA) — for subscription management. Operates under Standard Contractual Clauses.
Supabase — servers in EU/Frankfurt, but the company is US-based.

We ensure appropriate safeguards are in place for all international transfers in accordance with GDPR Chapter V.

8. Third parties

Supabase — database and storage infrastructure (EU/Frankfurt)
Google Gemini AI — rock identification (image analysis)
Apple Sign-In — optional authentication
RevenueCat — subscription management (no payment details stored by us)

9. Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

Access — obtain a copy of the data we hold about you
Rectification — correct inaccurate data
Erasure — delete your data ("right to be forgotten")
Restriction — limit how we process your data
Objection — object to processing based on legitimate interest
Portability — receive your data in a structured, machine-readable format
Withdraw consent — at any time, without affecting the lawfulness of prior processing

You can delete your account and all associated data directly in the app under Settings → Delete Account. For other requests, email hello@rockscan.app — we respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For users in Denmark, this is Datatilsynet (Danish Data Protection Agency).

10. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Anonymous scan data (no photos, no identity) may be retained for statistical purposes.

11. Children

Rock Identifier is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We will notify you of material changes via the app or email. Continued use of the app after changes constitutes acceptance.

13. Contact

Questions? Email hello@rockscan.app