Antique ID

Privacy policy

Antique ID · Last updated: 2026-10-16

This policy explains which personal data the Antique ID app for iPhone, iPad and Android, and this website, process, why, and what rights you have. We collect as little as we can. The app has no accounts, shows no ads and does not track you across other apps or websites.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is Nikolay Strikhar. Email: nikolaystrikhar@gmail.com.

What stays on your device

Your collection (photos, results, notes and values) is stored on your device only. If you delete the app, this data is deleted with it. We cannot read it.

The app asks for camera access to take photos and photo library access to pick existing ones. Both are optional; you can identify an object with either.

Identification

When you ask for an identification, the app sends the photos you take or choose for an identification to an AI model so it can identify the object and estimate its age, maker, materials and value. The request goes through AIProxy (AIProxy, Inc., USA), a service that keeps our API key off your device and checks that the request comes from a genuine copy of the app (on iPhone and iPad with Apple's DeviceCheck). AIProxy passes the request to OpenAI (OpenAI, L.L.C., USA), whose model produces the answer. The request carries no name, email or advertising ID of yours. Photos are reduced in size before they are sent. Please avoid photos that show people or documents; the identification does not need them.

We do not store the photos on any server of ours. AIProxy handles the request only to forward it. OpenAI processes API requests under its API data terms: it does not use them to train its models and may keep them for up to 30 days to detect abuse, after which they are deleted. Legal basis: providing the feature you asked for (Art. 6(1)(b) GDPR).

Purchases

Apple (App Store) or Google (Google Play) handles payment for Antique ID Pro. We never see your name or payment details. We use RevenueCat, Inc. (USA) as our processor to check which purchases belong to your copy of the app. RevenueCat receives a random user ID it creates for the app, your store transaction data (product, price, currency, dates, storefront country; on Android the Google Play purchase token), your device model, system and app version, and the IP address of the connection. Legal basis: providing what you bought (Art. 6(1)(b) GDPR). RevenueCat keeps this while you use the app, and we keep records of purchases as long as tax and accounting law requires.

Ad attribution

If you found the app through an Apple Ads ad on the App Store, the app passes Apple's attribution token (AdServices) to RevenueCat, which tells us which campaign led to the download. Apple provides it without tracking permission, and it does not identify you. Legal basis: our legitimate interest in knowing which ads work (Art. 6(1)(f) GDPR). This applies to iPhone and iPad only.

Usage analytics

The app sends usage events to Amplitude, Inc. (USA), our processor, so we can see which features are used and where people get stuck. Examples: app opened, photo taken, identification requested or failed, result saved to the collection, paywall shown, purchase started or completed. Events never contain your photos or the results. Each event carries a random ID created by the app, your device model, system version, app version, language, and an approximate location (country and region) that Amplitude may derive from the connection. The app tells Amplitude not to store your IP address. Events contain no name, email address, contacts or advertising ID. Legal basis: our legitimate interest in improving the app (Art. 6(1)(f) GDPR). You can object at any time by writing to us. We keep events for at most 24 months.

Crash reports

If you have chosen in your device settings to share analytics with app developers, Apple or Google passes us crash reports and usage statistics that do not identify you.

This website

The website sets no cookies and runs no advertising. We count visits with GoatCounter, which uses no cookies and stores no personal data. Cloudflare, Inc. (USA) delivers the pages and Beget LLC (Russia) hosts them; both record technical logs (IP address, time, page, browser) to deliver the site and stop attacks, under our legitimate interest in running the site safely (Art. 6(1)(f) GDPR). The logs are deleted after a short period.

Who receives data

  • AIProxy, Inc. (USA) and OpenAI, L.L.C. (USA): identification, as described above.
  • RevenueCat, Inc. (USA): checks purchases.
  • Amplitude, Inc. (USA): usage analytics.
  • Apple and Google: the App Store and Google Play, under their own privacy policies.
  • Cloudflare, Inc. (USA) and Beget LLC (Russia): deliver and host this website.

We do not sell your data or share it with anyone else, unless the law obliges us to.

Transfers outside the EU

The services above are mostly in the USA. Amplitude and Cloudflare are certified under the EU-U.S. Data Privacy Framework; for RevenueCat, AIProxy and OpenAI the transfer is covered by the European Commission's standard contractual clauses in their data processing terms. Beget's servers are in Russia, for which no adequacy decision exists; only website logs are created there.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Write to nikolaystrikhar@gmail.com. Because the app has no accounts, tell us what you want and we will do our best to find the data that belongs to you. You also have the right to complain to a data protection supervisory authority, in particular the one where you live or work.

California residents: we do not sell or share personal information as those terms are defined in the CCPA.

Children

The app is not directed at children under 13, and we do not knowingly collect personal data from them.

Changes

If this policy changes, we will update this page and the date above.