This policy explains which personal data the Catacapea app processes, why, who it is shared with and what rights you have, under Regulation (EU) 2016/679 (GDPR).
Controller
Hundredjack OÜ, a private limited company under Estonian law, registry code 17310584, VAT number EE102905090, registered office Telliskivi tn 57, 10412 Tallinn, Estonia, email [email protected].
What data we process
Account. When you sign in with Apple or Google we receive an account identifier, your name and email address. With Apple you can hide your email: in that case we receive an address forwarded by Apple.
Data you save. Your area (position and radius), preferences, saved spots (coordinates and name), the car position you mark, finds and “Nothing here” entries (coordinates, date, species and notes).
Phone location. Used for the blue dot, the Compass, distances and to set your area by GPS. It stays on the phone: it reaches our servers only if you save it yourself as your area, a spot or the car.
Recorded days (Pro). Only when you tap “Record the day” does the app record the route, even with the screen off (iOS shows this with the blue location symbol), until you tap “Finish”. The route (path, times, distance, climb) is saved in your account and visible only to you; you can delete any day, and deleting the account deletes them all.
Identify photos. The photos are sent, through our server, to Google’s Gemini service, which suggests possible species. With the photos we send only the month, altitude, forest type and region, never the exact position. We don’t keep the photos on our servers: they stay on your phone until you delete them. We count how many identifications you make each month, for the plan limits.
Identify finds. When you photograph a mushroom with the app’s camera, the place where you took the photos and the suggested species are saved in your account, even if you don’t tap “Save”: your map only shows the finds you save, and no other user sees them. The controller sees everyone’s finds on an internal map, with the position rounded to about 1 km, to understand how and where the app is used. Deleting the analysis deletes its find too. You can turn this off in Profile › Identify: the finds saved this way are then deleted.
Subscription. Payment goes through Apple or Google Play: we never see your card details. Through RevenueCat we receive the subscription status: plan, trial period, expiry and renewals.
Technical data. To show you weather, maps and reports, the phone requests the data directly from the services listed below, naming the area to analyse. Like any request on the internet, these services see the phone’s IP address.
Error reports. If something breaks in the app, a technical report is sent: the error message, the place in the code, the app version and the phone model and system. It contains no location, name, email or other account data. It is used only to fix the error and is deleted after 90 days.
App usage. To understand what to improve we save a few usage numbers in your account: minutes of use, how often you open the app, version and system (iOS or Android), when you see the plans and whether you tap Subscribe or cancel, whether location isn’t allowed or you are outside the covered area, how often you tap “Take me there”. If you answer the question “Are you enjoying Catacapea?”, we save your answer and comment. These contain no location and are deleted with the account.
Ad videos (free plan). Only if you choose “Watch a video” to unlock something for a day does the app show a Google AdMob video. The first time Google asks for your consent, as the GDPR requires; you can change it at any time. Google processes technical data from the phone (IP address, model, system, language and, if you consent, advertising identifiers) to show and measure the video, as an independent controller: policies.google.com/privacy. On iPhone we don’t ask for tracking permission, so the videos are not personalised with the device identifier. We send Google neither your location nor your account data.
“Flush coming” notifications. If you turn them on, your area (or where you are), the chosen mushrooms, the language and the notification code are saved in your account: every evening our server checks the weather there and notifies you when a flush is coming. Turn them off any time in Profile › Notifications.
“News and gifts” notifications. Only if you say yes in the app, we save in your account the phone’s notification code (issued by Apple or Google), its language and system, to tell you about days of Pro as a gift, the end of a gift and what’s new in the app, a couple of times a month at most. Turn them off any time in Profile › Notifications or in the phone’s settings: the code is deleted.
We don’t use your data for advertising, don’t sell it and don’t build profiles for commercial purposes.
Why we process it and on what basis
To provide the app and the features you use, including saving to your account: performance of the contract (Art. 6(1)(b) GDPR).
To manage the subscription and the plan limits: performance of the contract (Art. 6(1)(b)).
Service security and abuse prevention, for example the number of identifications per month: legitimate interest (Art. 6(1)(f)).
Understanding how the app is used and what to improve (usage and feedback): legitimate interest (Art. 6(1)(f)).
Ad videos you choose to watch: your consent (Art. 6(1)(a)), collected by Google’s form.
“News and gifts” notifications: your consent (Art. 6(1)(a)), withdrawn by turning them off.
Legal obligations, for example tax: legal obligation (Art. 6(1)(c)).
Who we entrust it to
Google Firebase (Google Ireland Ltd): sign-in, database in Europe (Milan) and server functions.
Google Gemini API: analysis of Identify photos.
Apple (Sign in with Apple, App Store and payments) and Google (Sign in with Google, Google Play and payments).
Google AdMob (Google Ireland Ltd): the ad videos you choose to watch on the free plan.
Apple Push Notification service and Firebase Cloud Messaging (Google Ireland Ltd): delivering the “News and gifts” notifications on iPhone and Android.
RevenueCat Inc.: subscription status management.
Expo (650 Industries): distribution of app updates.
Data services, queried directly by the phone without your account data: our server for map, weather, place search and soil (Hetzner Online GmbH, in Germany, on our behalf: map from OpenStreetMap data, weather computed with Open-Meteo, places from GeoNames, soil from ISRIC SoilGrids), Esri (satellite), AWS Terrain Tiles (elevation), European Environment Agency (land use, protected areas), iNaturalist (reports), the geoportals of the Lombardy, Piedmont and Veneto regions (forest maps), Waymarked Trails (trails).
Some providers (Google, Apple, RevenueCat, Expo) may process data in the United States. In these cases the transfer is covered by the safeguards of the GDPR: the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.
How long
We keep your account data as long as the account is active. If you delete it, we delete your data from the database straight away; any backups are overwritten within 30 days. Error reports, which are not linked to the account, are deleted after 90 days. Purchase data is kept by Apple, Google and RevenueCat for as long as the law requires.
Your rights
You can ask for access to your data, rectification, erasure, restriction and portability, and object to the processing, by writing to [email protected]. You can export your finds from the app at any time. You also have the right to lodge a complaint with the data protection authority of the country where you live, or with the Estonian authority where the controller is based (Andmekaitse Inspektsioon, aki.ee).
Deleting the account
In the app: Profile › Delete account. We delete the account and all linked data. The subscription, however, must be cancelled separately, in your Apple ID or Google Play settings.
Children
Catacapea is not meant for people under 14.
Security
Data travels over encrypted connections. In the database each account can only read and change its own data.
Changes
If we change this policy we update the date at the top; for important changes we let you know in the app.