Privacy Policy

This Privacy Policy explains how the operator of RockID, arockid.com, and the RockID app (“RockID”, “we”, “us”) handles personal data. It is meant to meet expectations under the UK GDPR and Data Protection Act 2018, and US state laws including the California Consumer Privacy Act as amended (CCPA/CPRA).

This is a protective baseline, not legal advice. Have counsel review it, and add your registered company name and address when the entity is formed.

Controller contact: support@arockid.com. Related contract: Terms of Use.

1. Data we collect

• Account. Email, display name, optional phone and bio, sign-in tokens.
• Identifications. Photos you upload, optional device location if you allow it, model output (names, confidence, notes), and corrections you submit.
• Cabinet and Field board. Specimen name, notes, location label, listing and Smart sell flags, and contact you choose to show when listed.
• Billing. Plan, status, renew date, Stripe customer and subscription IDs, and payment history. We do not store full card numbers.
• Device. App version, basic diagnostics, and favorites stored on your device. Dark-mode preference is stored on the device.

We do not ask for government ID, precise health data, or payment card PAN/CVC.

2. Why we use it (UK legal bases)

• Contract. Create your account, run identifications, save your cabinet, take payment, show your listings.
• Legitimate interests. Security, abuse prevention, improving prompts from corrections you send, and keeping the Field board usable. You may object where the law allows.
• Consent. Optional location for an identification; optional listing of a specimen; optional marketing email if we ever send one (we do not today).
• Legal obligation. Tax, accounting, and responding to lawful requests.

3. Photos and the identification model

Identification photos are private to your account unless you list the specimen. To produce a result we send image bytes to a vision model through OpenRouter. Providers may process the image in the United States or other countries. We do not sell your rock or stone photos. We do not use them to advertise other products.

A Field board listing shows the photo(s), name, notes, and — only to signed-in users — the contact you set. Smart sell only adds a for-sale flag. You can unlist at any time in the app.

4. Who we share with

We share personal data only with:

• Supabase — auth, database, and photo storage;
• Stripe — checkout and subscription records;
• OpenRouter and the model provider — identification only;
• our hosting provider for arockid.com;
• authorities if the law requires it.

We do not sell personal information and we do not “share” it for cross-context behavioural advertising as those words are used in the CCPA/CPRA.

Other users see listing content you mark public. They are not our processors. You choose what to publish.

5. International transfers

RockID is used from the US, the UK, and elsewhere. Data may be stored or processed in the United States. For UK users, transfers outside the UK rely on the UK Extension to the EU-US Data Privacy Framework where a processor is certified, or on the UK International Data Transfer Agreement / Addendum, or another safeguard the UK GDPR allows.

6. Retention

We keep account, identification, and cabinet data while the account is open. Billing records are kept as long as tax and accounting rules require (often six years in the UK). If you delete the account we remove photos, listings, and profile data from production systems, except backups that expire on their normal cycle and records we must keep.

Favorites on the phone stay on that device until you clear them or uninstall.

7. Your rights — United Kingdom

If UK GDPR applies, you may request access, correction, erasure, restriction, portability, and to object to legitimate-interest processing. You may withdraw consent without affecting earlier lawful use. You may complain to the Information Commissioner’s Office (ico.org.uk). Email support@arockid.com. We will respond within one month, or explain if we need more time as the law allows.

8. Your rights — United States

If you are a California resident (and in other states with similar laws), you may request to know, access, correct, or delete personal information, and to opt out of sale or share (we do not sell or share). We will not discriminate against you for exercising those rights. Email support@arockid.com. We may need to verify the request. An authorized agent may act for you as state law allows.

Categories we collect in the last 12 months: identifiers (email), customer records (plan, Stripe IDs), commercial information (purchases), internet activity (app use of identify), geolocation (optional, coarse or precise only if you grant it), visual information (specimen photos), and inferences from the model (suggested stone names). We use them for the purposes in this policy.

9. Children

RockID is not directed at children under 13 (US COPPA) or under 16 where UK GDPR requires a higher age. If we learn we hold data from a child below those ages without required consent, we will delete it. Parents: write to support@arockid.com.

10. Cookies and similar technology

The website uses cookies that are necessary to keep you signed in and to run checkout. We do not run advertising pixels today. The app stores a small amount of data on the device (session, favorites, appearance). UK PECR: strictly necessary cookies do not need consent; if we add analytics or marketing cookies later, we will ask.

11. Security

We use encrypted transport, access-controlled storage, and row-level rules so other customers cannot read your private cabinet. No method is perfect. Do not upload photos you cannot afford to have processed by a third-party model.

12. Deletion

You can delete the account from the RockID app (Edit profile) or by emailing support@arockid.com. We cancel an active subscription where the product allows, remove photos and listings, and delete the sign-in. Some billing records remain where the law requires.

13. Changes

We may update this policy. The date at the top will change. If the change is material we will try to email you or notice you in the product.