Skip to content
naturebrain.Meet your wild side
← Back to the wild
YOUR DATA

Privacy policy

How Nature Brain uses and protects your personal data, and the choices you have.

About this document

Last updated: 25 September 2026

Open the English PDF

1. Who we are and how to contact us

Nature Brain is an app for learning about animals, with a supporting website. This policy covers the mobile app, website, purchases, reminders and support. The operator named here is responsible for deciding how your personal data is used (the controller).

Nature Brain is operated by R.F. Rook, Staalmeesterslaan 181, Amsterdam, The Netherlands. For privacy questions, support or requests about your personal data, email naturebrain@ronnyrook.nl. Our website is https://naturebrain.app.

2. What data we use and where it comes from

We receive data from you, from your use of the service, from your device and from the sign-in, payment and delivery providers described below. A guest account has a unique identifier and is not anonymous to our systems.

  • Account and profile: your learner ID, guest status, username, display name or profile image if provided, email address and authentication information. Email sign-in uses a password handled by our authentication provider. Sign in with Apple supplies an Apple identifier, verification tokens and any email address or name Apple shares; this may be a private relay address. We do not receive your Apple password.
  • Learning activity: completed activities, questions, selected answers or countries, results and timestamps. We use these to show accuracy, discoveries, learning progress and streaks. The country you choose in a map question is a game answer, not your location.
  • Preferences and device storage: language, appearance, home timezone and reminder settings. The app stores sign-in session information, preferences and cached content or progress on your device. Your timezone may initially come from your device and can be changed.
  • Reminders, if enabled: a random installation ID, push token, device platform, language, reminder time, timezone, recent activity and notification delivery records. These help us send the reminder at the right time and avoid duplicates.
  • Subscriptions: the learner ID supplied to RevenueCat, store and product identifiers, purchase and transaction history, purchase tokens or receipts, renewal and expiry information, entitlement status and technical device/app information needed for billing. Apple or Google processes your payment details; Nature Brain does not receive full card details.
  • Feedback and support: question reports include your learner ID, guest status, email if available, the selected report reason and the relevant question, animal, image source and activity information. Support correspondence includes what you choose to send. Please do not include passwords or unnecessary sensitive information.
  • Technical requests: our infrastructure and service providers process IP addresses, request times, requested resources, device/browser or app information and error or security records when providing the service.

3. Why we use data and our legal grounds

Under the GDPR, we rely on the following grounds. We do not treat reading this policy or accepting the terms as consent to every use of your data.

  • Performance of our agreement: creating and securing your account, saving completed learning activities, calculating progress, applying preferences, responding to service requests and providing, restoring and verifying paid access.
  • Consent: optional daily reminders. You can withdraw this at any time by switching reminders off in the app or disabling notifications in device settings. Withdrawal does not affect earlier lawful processing or your ability to use the other features.
  • Legitimate interests: keeping the service secure and reliable, preventing abuse and duplicate billing events, investigating errors, handling feedback and understanding subscription performance. We limit this processing to what is proportionate to those purposes and consider your rights; you may object.
  • Legal obligations: responding to valid legal requests and keeping any records that applicable tax, accounting or other law requires.

4. Your choices, permissions and the website

You can begin as a guest without providing an email address. Registration is optional for free guest features. Some account and activity data is necessary to save progress; we cannot provide account-based features without it. Purchases require the account and transaction information shown in the purchase flow. Reminders and feedback are optional.

The current app does not request access to your precise GPS location, contacts, camera, microphone or personal photo library. Animal photographs and observation locations are catalogue content. We do not sell personal data or use it for targeted advertising or tracking across other companies' apps and websites.

The website sample questions run in your browser without creating an account or sending sample answers to the app's learning history. Reloading resets those answers. The public marketing pages do not set advertising or analytics cookies. Necessary hosting/security processing and any restricted administration sign-in are separate from the demo. The mobile app uses local storage to operate and cache content, not advertising cookies.

The website uses TransIP and Vercel for domain, hosting and delivery services. Our support mailbox and question-feedback email delivery use TransIP. We currently use no additional advertising, behavioural analytics or standalone crash-reporting services. RevenueCat still processes subscription information and provides subscription reporting as described below.

5. Who receives data

Access is limited to the operator and people or providers who need it for the purposes above. Providers acting for us must use data only on our instructions, under appropriate confidentiality, security and data-protection obligations that provide protection at least equivalent to this policy and applicable requirements.

  • Supabase: authentication, account and learning records, subscription access records, reminder delivery records, backend functions and animal media hosting. Our primary database is hosted in the European Union, in the eu-west region.
  • RevenueCat: purchase verification, subscription management, entitlement synchronisation and subscription reporting. Our integration identifies your account using its learner ID; it does not deliberately send your name or email address as subscriber attributes.
  • Expo, Apple Push Notification service and, on Android, Google Firebase Cloud Messaging: delivering optional notifications using device push identifiers and message content.
  • TransIP: domain/hosting services, sending question-feedback emails and hosting our support mailbox at naturebrain@ronnyrook.nl. Reports contain the account and question information described in section 2; a registered learner's available email address is used as Reply-To. Guest reports do not require an email address. Replies and other correspondence are handled through this mailbox.
  • Apple, or Google for Android purchases: sign-in where offered, store payments and platform services. They also process some data independently under their own privacy notices.
  • Vercel: hosting and delivering the website, including normal connection information, request logs and security processing. TransIP also provides the website/domain services described above. Neither provider receives the website demo answers as app learning records.
  • Authorities or professional advisers: only where required by law or necessary to handle a specific legal claim, with appropriate safeguards. Opening an external source, licence or store link takes you to a service with its own privacy notice. Externally hosted animal images, where used, also expose normal image-request information to that host.

6. International processing

Our primary Supabase database is hosted in the European Union (eu-west). Some service providers and their subprocessors operate internationally, including in the United States. Hosting the primary database in the EU does not mean all website delivery, support, subscription or notification processing stays in the EEA.

Where data is transferred outside the EEA, we must ensure a lawful transfer mechanism: an applicable European Commission adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses, with additional measures where needed. You can contact us for information about the safeguards applicable to your data and a copy, with confidential information redacted where necessary.

Supabase, Vercel and RevenueCat describe international-transfer safeguards in their data-processing terms. We require appropriate safeguards for providers acting on our behalf. The provider links below explain their arrangements; you can also ask Nature Brain for information about the safeguards applicable to your data.

7. How long we keep data

We keep operational records for no more than one calendar month. Active accounts and saved learning progress remain until account deletion, unless an earlier deletion is appropriate because the data is no longer needed. The category-specific periods below explain when each period starts.

  • Accounts, preferences and completed learning history: retained while your account exists, until you delete it or earlier deletion is appropriate. The one-month operational limit does not erase older learning progress. The same applies to guest identities. Uninstalling the app does not send an account-deletion request.
  • Current reminder settings and push installations: retained while needed to provide enabled reminders and removed with the account. Historical notification-delivery records and feedback rate-limit records: no more than one calendar month after the record is created. Turning reminders off stops future reminders; any remaining operational history is subject to that limit.
  • Current subscription access information: retained while needed to provide and verify paid access and removed with your account. Historical billing-event records under our control: no more than one calendar month after receipt. Any copy of those events held by a processor on our behalf must also follow our instructions. Removing an account reference is not treated as proof of full anonymisation.
  • Support messages and question-feedback emails: no more than one calendar month after each message is received or sent, including copies in sent mail, trash or archives under our control. A new message does not restart the retention period of an older message. In-app account deletion does not automatically remove email copies; you may request earlier deletion where applicable.
  • Technical, website and security logs under our control: no more than one calendar month after the log entry is created, or a shorter provider period where applicable. We do not extend that period by exporting logs to another service.
  • Backup copies under our control: each backup is retained for no more than one calendar month after creation, or a shorter provider period. Data deleted from active systems may remain in restricted recovery backups for at most one further calendar month. Backups are not used for ordinary app access; if a backup is restored, applicable deletions must be reapplied.
  • If a specific legal obligation or binding preservation order requires longer retention, we retain only the necessary records for the required period, restrict their use and can explain the applicable exception on request. This is not a general extension for routine operational records. Apple, Google and other providers may separately keep records they control for their own legal or payment obligations; those independent records are governed by their privacy notices.

8. Delete your account or withdraw a choice

In the app, open Profile and choose Delete account. Email accounts confirm with their password. Guest accounts type DELETE. Apple accounts type DELETE and authenticate with Apple. Successful deletion removes the sign-in identity and linked profile, learning history, reminder records and subscription entitlement records. The process also revokes sessions and the Apple authorisation where applicable, and requests deletion of the RevenueCat customer record when that integration is configured.

Deletion cannot be undone. Limited exceptions are described in section 7. Apple and Google may keep purchase records under their own obligations. Deleting your account or uninstalling the app does not cancel a store subscription: cancel it separately in the store subscription settings.

If you cannot use the app, contact us using section 1 to request deletion or exercise another privacy right. We may ask for proportionate information to verify that the data is yours. A lost guest identity may be impossible to identify securely; contact us before uninstalling if you want to remove guest records.

9. Your privacy rights

Where applicable, you can ask to access or obtain a copy of your data, correct it, erase it, restrict its use or receive data you provided in a portable format. You may object to processing based on legitimate interests for reasons relating to your situation. If we rely on consent, you may withdraw it at any time. These rights have legal conditions and exceptions.

Contact us using section 1. We normally respond within one month; where a lawful extension is necessary, we will explain it within that month. You do not normally have to pay. You can complain to the Dutch Autoriteit Persoonsgegevens or the supervisory authority where you live, work or believe an infringement occurred. You do not need to contact us first.

Learning scores and subscription checks are automated, but we do not use your data for solely automated decisions producing legal or similarly significant effects.

10. Children and young people

Nature Brain is intended for people aged 13 and over. It is not intended for children under 13, and they must not use the service. We do not knowingly collect personal data from children under 13. If we learn that we have collected such data, we will take steps to delete it unless the law requires us to retain particular information.

If you are aged 13 to 17, read this policy with a parent or guardian and ask them to help if anything is unclear. Where processing relies on consent, the age at which you can give that consent independently depends on local law. In the Netherlands, parental authorisation is required for this consent-based processing if you are under 16. Where legally required, a parent or guardian must authorise the processing before it begins. The 13+ minimum and a store age rating do not replace those requirements.

Parents and guardians can contact naturebrain@ronnyrook.nl to report use by a child under 13, request access to or deletion of a child's information, withdraw applicable consent or ask us to stop further collection or use. We may take proportionate steps to verify parental authority and explain the effect on account-based features. Young people must not be required to provide more personal information than reasonably needed for the relevant activity.

11. Security and changes to this policy

We use measures appropriate to the data and risks, including encrypted network connections, authenticated access and controls intended to keep account records accessible only to authorised people. No system is completely secure. Protect your device and sign-in details, and contact us if you suspect misuse.

We update this policy when our processing changes. The date and version identify the current text. We will bring significant changes to your attention through the app, website or an appropriate direct notice before they take effect where required, and obtain fresh consent when required. Dutch and English versions are intended to have the same meaning.