Privacy Policy

1. Introduction

We believe in transparency about how we handle your data because that's what we expect from the services we use. We appreciate your trust in FossilVault and are committed to handling your data thoughtfully and responsibly. By using our services, you accept this privacy policy.

Important: We do not require any personally identifiable information (PII) to use FossilVault. If you choose to provide PII to enable certain features, we store it securely and never sell it to third parties.

2. Information We Collect

Personal Information

• Email address (for account creation)
• Account credentials (username and encrypted password, or authentication via Google Sign-In or Apple Sign-In)
• Profile information you voluntarily provide

Fossil Collection Data

• Specimen information (taxonomy, geologic time, dimensions, etc.)
• Photos and images of your fossil specimens
• GPS coordinates and location data (only when explicitly provided by you)
• Custom tags, notes, and organizational data
• Collection statistics and analytics

Technical Information

We do not collect or store:

• Device information (iOS version, device model, or hardware details)
• App usage analytics or tracking data
• Network information (IP addresses, connection types, or browsing behavior)
• Location data (unless explicitly provided by you for fossil discovery locations)
• Any form of behavioral tracking or analytics

FossilVault is designed to work without invasive data collection. We believe your fossil collection data should remain private and under your control.

3. How We Use Your Information

• Service Provision: To provide and maintain the FossilVault app functionality
• Data Synchronization: To sync your collection across your devices
• Account Management: To create and manage your user account
• Communication: To send important service updates and respond to your inquiries
• Improvement: To analyze usage patterns and improve our services
• Support: To provide customer support and respond to inquiries
• Security: To detect and prevent fraud, abuse, and security issues

4. Legal Basis for Processing (GDPR)

For users in the European Union, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the FossilVault service you've requested (account creation, data synchronization, service delivery)
• Consent: Where you have given explicit consent for specific processing activities (e.g., optional features, marketing communications)
• Legitimate Interests: Processing necessary for our legitimate business interests (service improvement, security, fraud prevention), provided these interests don't override your rights
• Legal Obligation: Processing required to comply with legal obligations (e.g., tax requirements, legal requests)

You have the right to object to processing based on legitimate interests and withdraw consent at any time.

5. Information Sharing and Disclosure

We do not sell, share, or rent your personal information to advertisers or third-party marketing companies.Your fossil collection data, photos, and personal information remain private and are never used for advertising purposes.

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following limited circumstances:

• Service Providers: Trusted third parties who assist in operating our service (including cloud storage and authentication providers, and subscription management services). These providers are contractually obligated to protect your data and use it only for providing services to us.
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred, but the new entity will be required to honor this Privacy Policy
• Consent: When you explicitly consent to sharing specific information

AI Training and Processing: We do not use your personal data, fossil collection information, photos, or any user-generated content to train AI models or machine learning systems. When you use optional AI-powered features in the app (such as caption generation, field mapping, or collection search):

• We first attempt to process your request using on-device local AI models when available. This processing happens entirely on your device and does not share any data with third parties.
• If local processing is not available or does not achieve the desired result, your data may be sent securely and encrypted to third-party AI service providers solely to generate the requested output.
• Third-party AI services do not use your data for training. They may retain request data briefly for abuse monitoring (our current AI provider, OpenAI, retains API inputs and outputs for up to 30 days, after which they are deleted; verified August 2026), and process it under a data processing agreement with Standard Contractual Clauses for international transfers.

Cloud collection search ("Ask Your Collection"): When you ask a question about your collection and on-device answering is not available, your question and a limited set of catalog fields are processed on our servers in the European Union and by our AI provider to find the answer. The catalog fields are: specimen names, category, geological time, country, place and locality names, formation, tags, element, and find/creation dates. Prices and values, GPS coordinates, and your notes are never sent to the AI provider; they are excluded from this processing by design. On iOS, the app asks for your explicit confirmation before the first cloud-processed question; on Android, cloud processing is disclosed in the feature itself.

6. Data Storage and Security

We implement industry-standard security measures to protect your information:

• Data encryption in transit and at rest
• Secure authentication mechanisms
• Regular security audits and updates
• Limited access to personal data by authorized personnel only
• Data backup and recovery procedures

Your data is stored on secure servers provided by Google Firebase, which complies with international security standards and regulations.

7. Your Rights and Choices

Depending on the laws of your country (including GDPR for European users), you may have the following rights regarding your personal information:

• Right to Access: Request access to your personal information and obtain a copy of the data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure (Right to be Forgotten): Request deletion of your account and personal data
• Right to Data Portability: Request export of your data in a portable, structured format
• Right to Restriction: Request limitation of data processing in certain circumstances
• Right to Object: Object to certain types of data processing, including for marketing purposes
• Right to Withdraw Consent: Withdraw your consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection authority if you believe your rights have been violated

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days in accordance with applicable data protection laws.

For European users, you have the right to lodge a complaint with your local supervisory authority if you believe we have not handled your personal data in accordance with GDPR requirements.

8. Children's Privacy

Our service is not intended for children. The minimum age requirement is 13 years (or 16 years in certain European countries where required by GDPR). We do not knowingly collect personal information from children below the applicable age threshold. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected], and we will delete such information.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States where our service provider (Google Firebase) operates data centers.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we ensure that appropriate safeguards are in place for international data transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission where applicable
• Our service providers' compliance with relevant data protection frameworks

These safeguards ensure your data receives the same level of protection as required under GDPR, regardless of where it is processed.

10. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill our legal obligations. Specifically:

• Account information: Retained while your account is active and for a reasonable period after deletion for legal compliance
• Collection data: Retained while your account is active or until you delete it
• Transaction records: Retained for tax and legal compliance purposes as required by law
• Support communications: Retained for a reasonable period to provide ongoing support

You can request deletion of your account and data at any time by contacting [email protected]. Upon deletion request, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

11. Automated Decision-Making and Profiling

FossilVault does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Any AI-powered features in the app (such as caption generation, field mapping suggestions, or collection search) are optional tools that assist you but do not make automated decisions about you or your data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the effective date. We encourage you to review this policy periodically.

13. Contact Information

If you have questions about this Privacy Policy or our privacy practices, please contact us: