Privacy Policy

This Privacy Policy explains how RockID (arockid.com and the RockID app) handles personal data. It is meant to meet expectations under the UK GDPR and Data Protection Act 2018, and US state laws including the California Consumer Privacy Act as amended (CCPA/CPRA).

This is a protective baseline, not legal advice. Have counsel review it before you rely on it in a dispute.

Who we are

AppRoots (approots.net), based in Pakistan, owns and operates RockID. AppRoots is the data controller for accounts, photos, identifications, and your cabinet. AppRoots privacy policy.

Applebite2ndbite Ltd is a UK company (company number 09364332; registered office 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE). Companies House record. It is the merchant of record for plans bought on arockid.com through Stripe. It is an independent controller only of website payment records (plan, Stripe customer and subscription IDs, payment status). It does not operate RockID and does not decide how identification or account data is used.

For RockID users, write to support@arockid.com. You may also contact AppRoots at hi@approots.net. Related contract: Terms of Use.

1. Data we collect

• Account. Email and password if you register that way; optional display name, phone, and bio; session tokens.
• Sign in with Apple. Apple returns an identity token that we validate with our account service. We may receive your email (real or Apple’s private relay), a name on the first sign-in only, and an Apple user identifier. Apple processes the sign-in on the device.
• Sign in with Google. Google returns an identity token (native app) or completes an OAuth flow (website). We may receive your email, name, and a Google profile identifier.
• Identifications. Photos you upload, optional place name you type in field notes (not GPS coordinates), model output (names, confidence, notes), and corrections you submit.
• Cabinet and Field board. Specimen name, notes, location label, listing and Smart sell flags, and contact you choose to show when listed.
• Website billing (Stripe). Plan, status, renew date, Stripe customer and subscription IDs, payment history, and payout method (card, Apple Pay, or Google Pay). Applebite2ndbite Ltd is the merchant. We do not store full card numbers.
• App Store and Google Play. Product IDs, purchase tokens or original transaction IDs, subscription status, and whether the purchase is sandbox or production. Apple and Google handle payment credentials. We do not take card numbers in the mobile app.
• Device. App version, basic diagnostics, and favorites stored on your device. Dark-mode preference is stored on the device.

We do not ask for government ID, precise health data, or payment card PAN/CVC.

2. Why we use it (UK legal bases)

• Contract. Create your account (including social sign-in), run identifications, save your cabinet, take payment, show your listings.
• Legitimate interests. Security, abuse prevention, improving prompts from corrections you send, and keeping the Field board usable. You may object where the law allows.
• Consent. Optional place name on field notes; optional listing of a specimen; optional marketing email if we ever send one (we do not today).
• Legal obligation. Tax, accounting, and responding to lawful requests.

3. Photos and the identification model

Identification photos are private to your account unless you list the specimen. To produce a result we send image bytes to a third-party vision model. That provider may process the image in the United States or other countries. We do not sell your rock or stone photos. We do not use them to advertise other products.

A Field board listing shows the photo(s), name, notes, and — only to signed-in users — the contact you set. Smart sell only adds a for-sale flag. You can unlist at any time in the app.

4. Who we share with

We share personal data only with the people and services needed to run RockID. We name the companies you deal with directly. Other infrastructure is described by category so we do not publish a map of our stack. We will give the current processor names to you or to the ICO on request at support@arockid.com.

• Stripe — website checkout and subscription records for Applebite2ndbite Ltd (card, Apple Pay, Google Pay);
• Apple — Sign in with Apple; App Store in-app purchases and server notifications for the iOS app listed as RockSnap;
• Google — Sign in with Google; Google Play billing and real-time developer notifications;
• our account, database, and photo-storage provider — sign-in and your cabinet;
• a third-party vision model — identification photos only;
• our website host — delivery of arockid.com;
• authorities if the law requires it.

We do not sell personal information and we do not “share” it for cross-context behavioural advertising as those words are used in the CCPA/CPRA.

Other users see listing content you mark public. They are not our processors. You choose what to publish.

5. International transfers

RockID is used from the US, the UK, and elsewhere. AppRoots is based in Pakistan. Apple, Google, Stripe, and our hosting, account, and identification providers may store or process data in the United States and other countries. For UK users, transfers outside the UK (including to Pakistan) rely on the UK Extension to the EU-US Data Privacy Framework where a processor is certified, or on the UK International Data Transfer Agreement / Addendum, or another safeguard the UK GDPR allows.

6. Retention

We keep account, identification, and cabinet data while the account is open. Billing records are kept as long as tax and accounting rules require (often six years in the UK). If you delete the account we remove photos, listings, and profile data from production systems, except backups that expire on their normal cycle and records we must keep.

Favorites on the phone stay on that device until you clear them or uninstall.

7. Your rights — United Kingdom

If UK GDPR applies, you may request access, correction, erasure, restriction, portability, and to object to legitimate-interest processing. You may withdraw consent without affecting earlier lawful use. You may complain to the Information Commissioner’s Office (ico.org.uk). Email support@arockid.com. We will respond within one month, or explain if we need more time as the law allows.

8. Your rights — United States

If you are a California resident (and in other states with similar laws), you may request to know, access, correct, or delete personal information, and to opt out of sale or share (we do not sell or share). We will not discriminate against you for exercising those rights. Email support@arockid.com. We may need to verify the request. An authorized agent may act for you as state law allows.

Categories we collect in the last 12 months: identifiers (email, Apple or Google account identifiers); customer records (plan, Stripe IDs, App Store or Google Play purchase records); commercial information (purchases); internet activity (app use of identify); location labels you choose to type (not GPS or device coordinates); visual information (specimen photos); and inferences from the model (suggested stone names). We use them for the purposes in this policy.

9. Children

RockID is not directed at children under 13 (US COPPA) or under 16 where UK GDPR requires a higher age. If we learn we hold data from a child below those ages without required consent, we will delete it. Parents: write to support@arockid.com.

10. Cookies and similar technology

The website uses cookies that are necessary to keep you signed in and to run checkout. We do not run advertising pixels today. The app stores a small amount of data on the device (session, favorites, appearance). UK PECR: strictly necessary cookies do not need consent; if we add analytics or marketing cookies later, we will ask.

11. Security

We use encrypted transport, access-controlled storage, and row-level rules so other customers cannot read your private cabinet. No method is perfect. Do not upload photos you cannot afford to have processed by a third-party model.

12. Deletion

You can delete the account from the RockID app (Edit profile) or by emailing support@arockid.com. Cancel a website (Stripe) plan from Account on arockid.com first if you want the subscription to stop. Cancel an App Store or Google Play plan in the store settings on the device — we cannot cancel those subscriptions for you. We then remove photos and listings and delete the sign-in. Some billing records remain where the law requires.

13. Changes

We may update this policy. The date at the top will change. If the change is material we will try to email you or notice you in the product.