Privacy policy | Nature Brain

1. Who we are and how to contact us

Nature Brain is an app for learning about animals, with a supporting website. This policy covers the mobile app, website, purchases, reminders and support. The operator named here is responsible for deciding how your personal data is used (the controller).

Nature Brain is operated by R.F. Rook, Staalmeesterslaan 181, Amsterdam, The Netherlands. For privacy questions, support or requests about your personal data, email naturebrain@ronnyrook.nl. Our website is https://naturebrain.app.

2. What data we use and where it comes from

We receive data from you, from your use of the service, from your device and from the sign-in, payment and delivery providers described below. A guest account has a unique identifier and is not anonymous to our systems.

Account and profile: your learner ID, guest status, username, display name or profile image if provided, email address and authentication information. Email sign-in uses a password handled by our authentication provider. Sign in with Apple supplies an Apple identifier, verification tokens and any email address or name Apple shares; this may be a private relay address. We do not receive your Apple password.
Learning activity: completed activities, questions, selected answers or countries, results and timestamps. We use these to show accuracy, discoveries, learning progress and streaks. The country you choose in a map question is a game answer, not your location.
Preferences and device storage: language, appearance, home timezone and reminder settings. The app stores sign-in session information, preferences and cached content or progress on your device. Your timezone may initially come from your device and can be changed.
Reminders, if enabled: a random installation ID, push token, device platform, language, reminder time, timezone, recent activity and notification delivery records. These help us send the reminder at the right time and avoid duplicates.
Subscriptions: the learner ID supplied to RevenueCat, store and product identifiers, purchase and transaction history, purchase tokens or receipts, renewal and expiry information, entitlement status and technical device/app information needed for billing. Apple or Google processes your payment details; Nature Brain does not receive full card details.
Feedback and support: question reports include your learner ID, guest status, email if available, the selected report reason and the relevant question, animal, image source and activity information. Support correspondence includes what you choose to send. Please do not include passwords or unnecessary sensitive information.
Usage analytics, when enabled: a randomly generated installation identifier, session identifier, screen names, game starts, load failures, completions and exits, a separate random play identifier, active time spent in games, game type and selected learning scope, question and correct-answer counts, question and animal identifiers, selected answer options or countries, and ranking choices and changes, animals viewed in Explore, focus-group choices and changes, navigation and achievement interactions, daily-fact expansions, and Explore searches and selected results. Search terms are normalized and limited to 80 characters; terms containing numbers or characters outside letters, spaces, apostrophes and hyphens are replaced with a redacted marker. This filter does not guarantee that a search contains no personal information, so please do not enter personal or sensitive information in search. PostHog also receives app version, operating system and event timestamps. We do not attach your learner ID, account name, email, passwords or sign-in callback parameters to PostHog events. These identifiers are pseudonymous, not proof of anonymisation.
Error reporting: Sentry receives crash reports, error messages, stack traces and technical app/device context. We do not deliberately attach your account ID, name or email. JavaScript reports filter common identifiers and authentication details. Session replay, performance tracing and console/network breadcrumbs are disabled.
Technical requests: our infrastructure and service providers process IP addresses, request times, requested resources, device/browser or app information and error or security records when providing the service.

3. Why we use data and our legal grounds

Under the GDPR, we rely on the following grounds. We do not treat reading this policy or accepting the terms as consent to every use of your data.

Performance of our agreement: creating and securing your account, saving completed learning activities, calculating progress, applying preferences, responding to service requests and providing, restoring and verifying paid access.
Consent: optional daily reminders and iOS usage analytics. You can switch these off in the app; iOS analytics also requires permission through Apple’s native tracking-permission dialog. Withdrawal does not affect earlier lawful processing or your ability to use other features.
Legitimate interests: keeping the service secure and reliable, preventing abuse and duplicate billing events, investigating errors, handling feedback, understanding subscription performance and, where permitted, understanding feature use through Android usage analytics. We limit this processing to what is proportionate to those purposes and consider your rights; you may object. Android usage analytics can be switched off in Profile.
Legal obligations: responding to valid legal requests and keeping any records that applicable tax, accounting or other law requires.

4. Your choices, permissions and the website

You can begin as a guest without providing an email address. Registration is optional for free guest features. Some account and activity data is necessary to save progress; we cannot provide account-based features without it. Purchases require the account and transaction information shown in the purchase flow. Reminders and feedback are optional.

Catalog uploads are optional and require a registered account with Premium. When you choose to take a photo or select one from your library, the app requests camera or photo-library permission for that action. Only the photo you choose to submit is uploaded; granting permission does not upload your library. You can decline or change these permissions in your device settings and continue using the other learning features.

The app does not request access to your precise GPS location, contacts or microphone. You may optionally enter a photo's capture date and country; these are visible only to you and authorised administrators. We remove embedded metadata, including GPS, when processing uploaded photos. Section 12 explains review, public use and deletion of photo contributions. We do not sell personal data or use it for targeted advertising or tracking across other companies' apps and websites.

The website sample questions run in your browser without creating an account or sending sample answers to the app's learning history. Reloading resets those answers. The public marketing pages do not set advertising or analytics cookies. Necessary hosting/security processing and any restricted administration sign-in are separate from the demo. The mobile app uses local storage to operate and cache content, not advertising cookies.

The website uses TransIP and Vercel for domain, hosting and delivery services. Our support mailbox and question-feedback email delivery use TransIP. The mobile app uses PostHog for usage analytics, Sentry for error reporting and RevenueCat for subscription reporting. The public website does not use the mobile analytics or error-reporting integrations.

On iOS, PostHog analytics requires Apple’s native tracking permission; denial or restriction leaves it off. On Android, it is enabled by default. Open Profile and switch off Share usage analytics to stop collection and discard queued events. iOS permission can also be changed in device Settings and is checked when the app returns to the foreground. Sentry error reporting is separate. Neither service is used for targeted advertising, cross-company tracking or session recording.

5. Who receives data

Access is limited to the operator and people or providers who need it for the purposes above. Providers acting for us must use data only on our instructions, under appropriate confidentiality, security and data-protection obligations that provide protection at least equivalent to this policy and applicable requirements.

Supabase: authentication, account and learning records, subscription access records, reminder delivery records, backend functions and animal media hosting. Our primary database is hosted in the European Union, in the eu-west region.
RevenueCat: purchase verification, subscription management, entitlement synchronisation and subscription reporting. Our integration identifies your account using its learner ID; it does not deliberately send your name or email address as subscriber attributes.
PostHog: product usage analytics using our EU-hosted project. We use a pseudonymous installation identifier without identifying your learner account, and disable geographic enrichment and session replay.
Sentry: error and crash reporting using our Germany/EU project endpoint. Diagnostic reports can include technical device identifiers and app/device context; we do not intentionally associate them with your learner account.
Expo, Apple Push Notification service and, on Android, Google Firebase Cloud Messaging: delivering optional notifications using device push identifiers and message content.
TransIP: domain/hosting services, sending question-feedback emails and hosting our support mailbox at naturebrain@ronnyrook.nl. Reports contain the account and question information described in section 2; a registered learner's available email address is used as Reply-To. Guest reports do not require an email address. Replies and other correspondence are handled through this mailbox.
Apple, or Google for Android purchases: sign-in where offered, store payments and platform services. They also process some data independently under their own privacy notices.
Vercel: hosting and delivering the website, including normal connection information, request logs and security processing. TransIP also provides the website/domain services described above. Neither provider receives the website demo answers as app learning records.
Authorities or professional advisers: only where required by law or necessary to handle a specific legal claim, with appropriate safeguards. Opening an external source, licence or store link takes you to a service with its own privacy notice. Externally hosted animal images, where used, also expose normal image-request information to that host.

6. International processing

Our primary Supabase database is hosted in the European Union (eu-west). Some service providers and their subprocessors operate internationally, including in the United States. Hosting the primary database in the EU does not mean all website delivery, support, subscription or notification processing stays in the EEA.

Where data is transferred outside the EEA, we must ensure a lawful transfer mechanism: an applicable European Commission adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses, with additional measures where needed. You can contact us for information about the safeguards applicable to your data and a copy, with confidential information redacted where necessary.

Supabase, Vercel and RevenueCat describe international-transfer safeguards in their data-processing terms. We require appropriate safeguards for providers acting on our behalf. The provider links below explain their arrangements; you can also ask Nature Brain for information about the safeguards applicable to your data.

7. How long we keep data

We keep operational records for no more than one calendar month. Active accounts and saved learning progress remain until account deletion, unless an earlier deletion is appropriate because the data is no longer needed. The category-specific periods below explain when each period starts.

Accounts, preferences and completed learning history: retained while your account exists, until you delete it or earlier deletion is appropriate. The one-month operational limit does not erase older learning progress. The same applies to guest identities. Uninstalling the app does not send an account-deletion request.
Photo collections and approved public contributions: section 12 explains their retention and deletion, including the continued use of approved public photos after a private entry or account is deleted.
Current reminder settings and push installations: retained while needed to provide enabled reminders and removed with the account. Historical notification-delivery records and feedback rate-limit records: no more than one calendar month after the record is created. Turning reminders off stops future reminders; any remaining operational history is subject to that limit.
Current subscription access information: retained while needed to provide and verify paid access and removed with your account. Historical billing-event records under our control: no more than one calendar month after receipt. Any copy of those events held by a processor on our behalf must also follow our instructions. Removing an account reference is not treated as proof of full anonymisation.
Support messages and question-feedback emails: no more than one calendar month after each message is received or sent, including copies in sent mail, trash or archives under our control. A new message does not restart the retention period of an older message. In-app account deletion does not automatically remove email copies; you may request earlier deletion where applicable.
Technical, website and security logs under our control: no more than one calendar month after the log entry is created, or a shorter provider period where applicable. We do not extend that period by exporting logs to another service.
Backup copies under our control: each backup is retained for no more than one calendar month after creation, or a shorter provider period. Data deleted from active systems may remain in restricted recovery backups for at most one further calendar month. Backups are not used for ordinary app access; if a backup is restored, applicable deletions must be reapplied.
Usage analytics and diagnostic records held by PostHog and Sentry on our behalf are subject to the same maximum of one calendar month after collection. Turning analytics off stops new analytics events and discards the local queue; it does not itself delete events already received by PostHog. Contact us to request deletion of retained records. Because analytics is not linked to your learner account, we may need additional information to locate your installation’s records.
If a specific legal obligation or binding preservation order requires longer retention, we retain only the necessary records for the required period, restrict their use and can explain the applicable exception on request. This is not a general extension for routine operational records. Apple, Google and other providers may separately keep records they control for their own legal or payment obligations; those independent records are governed by their privacy notices.

8. Delete your account or withdraw a choice

In the app, open Profile and choose Delete account. Email accounts confirm with their password. Guest accounts type DELETE. Apple accounts type DELETE and authenticate with Apple. Successful deletion removes the sign-in identity and linked profile, learning history, reminder records and subscription entitlement records. The process also revokes sessions and the Apple authorisation where applicable, and requests deletion of the RevenueCat customer record when that integration is configured.

Deletion cannot be undone. Limited exceptions are described in sections 7 and 12, including retained approved public photo contributions. Apple and Google may keep purchase records under their own obligations. Deleting your account or uninstalling the app does not cancel a store subscription: cancel it separately in the store subscription settings.

If you cannot use the app, contact us using section 1 to request deletion or exercise another privacy right. We may ask for proportionate information to verify that the data is yours. A lost guest identity may be impossible to identify securely; contact us before uninstalling if you want to remove guest records.

Account deletion help

9. Your privacy rights

Where applicable, you can ask to access or obtain a copy of your data, correct it, erase it, restrict its use or receive data you provided in a portable format. You may object to processing based on legitimate interests for reasons relating to your situation. If we rely on consent, you may withdraw it at any time. These rights have legal conditions and exceptions.

Contact us using section 1. We normally respond within one month; where a lawful extension is necessary, we will explain it within that month. You do not normally have to pay. You can complain to the Dutch Autoriteit Persoonsgegevens or the supervisory authority where you live, work or believe an infringement occurred. You do not need to contact us first.

Learning scores and subscription checks are automated, but we do not use your data for solely automated decisions producing legal or similarly significant effects.

Autoriteit Persoonsgegevens

10. Children and young people

Nature Brain is intended for people aged 13 and over. It is not intended for children under 13, and they must not use the service. We do not knowingly collect personal data from children under 13. If we learn that we have collected such data, we will take steps to delete it unless the law requires us to retain particular information.

If you are aged 13 to 17, read this policy with a parent or guardian and ask them to help if anything is unclear. Where processing relies on consent, the age at which you can give that consent independently depends on local law. In the Netherlands, parental authorisation is required for this consent-based processing if you are under 16. Where legally required, a parent or guardian must authorise the processing before it begins. The 13+ minimum and a store age rating do not replace those requirements.

Parents and guardians can contact naturebrain@ronnyrook.nl to report use by a child under 13, request access to or deletion of a child's information, withdraw applicable consent or ask us to stop further collection or use. We may take proportionate steps to verify parental authority and explain the effect on account-based features. Young people must not be required to provide more personal information than reasonably needed for the relevant activity.

11. Security and changes to this policy

We use measures appropriate to the data and risks, including encrypted network connections, authenticated access and controls intended to keep account records accessible only to authorised people. No system is completely secure. Protect your device and sign-in details, and contact us if you suspect misuse.

We update this policy when our processing changes. The date and version identify the current text. We will bring significant changes to your attention through the app, website or an appropriate direct notice before they take effect where required, and obtain fresh consent when required. Dutch and English versions are intended to have the same meaning.

12. Photo catalog and community contributions

Catalog stores the animal you select, your normalized photo, optional capture date and country, submission and review history, versioned contribution permission, reports, contributor hiding choices and your public username. Capture date and country are private to you and authorized administrators and do not change animal distribution data. We remove embedded metadata, including GPS, when processing uploads and retain normalized images rather than original camera files.

We process private collections to provide the service you request. Approved images and the chosen public @username are used in the public animal library and learning activities under the contribution permission you accept. Public credits follow username changes. Optional review push notifications have a separate preference from daily reminders and use the existing push delivery providers. We process reports and upload restrictions to moderate public content and protect the service.

Deleting an entry removes its private image and capture metadata. Deleting an approved private entry does not withdraw the approved public contribution. On account deletion we remove private entries, metadata and account links; retained approved images are credited to Former Nature Brain member. We retain the approved image and evidence of its contribution permission for continued use and handling rights complaints, rather than applying the one-month operational-record limit to that licensed content. Rights and removal requests can be sent to naturebrain@ronnyrook.nl.