Snake Identifier

Privacy policy

Snake Identifier · Last updated: 2026-10-16

This policy explains which personal data the Snake Identifier app for iPhone and iPad, and this website, process, why, and what rights you have. We collect as little as we can. The app has no accounts, shows no ads and does not track you across other apps or websites.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is Nikolay Strikhar. Email: nikolaystrikhar@gmail.com.

What stays on your device

Your identification history (photos and results) is stored on your device only. If you delete the app, this data is deleted with it. We cannot read it.

The app asks for camera access to take a photo and photo library access to pick one. If you allow location access when you use the camera, the app uses your approximate location. Notifications are optional.

Identification

Before your first scan the app asks for your agreement. When you ask for an identification, the app sends the photo you took or chose to an AI model so it can suggest the species. The photo is re-encoded as a reduced-size JPEG first, which removes its metadata (including any location stored in the photo). The request goes through AIProxy (AIProxy, Inc., USA), a service that keeps our API key off your device and checks that the request comes from a genuine copy of the app. AIProxy passes the request to OpenAI (OpenAI, L.L.C., USA), whose model produces the answer. The request carries no name, email or advertising ID of yours.

Together with the photo, the app sends a line of text with the town and country where the photo was taken (for example, "Narrikup, Western Australia, Australia"), so the answer can favour species that live there. That place comes from the location stored in the photo; for photos taken with the in-app camera, if you allow location access, from your phone's approximate location; and otherwise the app sends only the region setting of your phone (for example, Australia). The place name is worked out on your phone with Apple's location services. Exact coordinates are never sent to us, AIProxy or OpenAI. You can refuse location access in your phone settings and still identify snakes.

We do not store your photos or locations on any server of ours. AIProxy handles the request only to forward it. OpenAI processes API requests under its API data terms: it does not use them to train its models and may keep them for up to 30 days to detect abuse, after which they are deleted. Legal basis: providing the feature you asked for and the agreement you give before the first scan (Art. 6(1)(b) and (a) GDPR). You can withdraw it in the app's Settings; without it the app cannot identify snakes. Please avoid photos that show people.

App configuration and notifications

The app uses Firebase from Google (Google Ireland Limited and Google LLC), our processor, in two ways. Firebase Remote Config delivers settings to the app, such as the instructions for the AI model, and receives technical data such as an installation ID, device model, system and app version, and the IP address of the connection. Firebase Cloud Messaging handles notifications if you allow them; it uses a device token. We do not use Firebase Analytics or Crashlytics. Legal basis: running the app (Art. 6(1)(b) GDPR) and, for notifications, your permission (Art. 6(1)(a) GDPR).

Purchases

Apple handles payment for Snake Identifier Premium. We never see your name or payment details. We use RevenueCat, Inc. (USA) as our processor to check which purchases belong to your copy of the app. RevenueCat receives a random user ID it creates for the app, your store transaction data (product, price, currency, dates, storefront country), your device model, system and app version, and the IP address of the connection. Legal basis: providing what you bought (Art. 6(1)(b) GDPR). RevenueCat keeps this while you use the app, and we keep records of purchases as long as tax and accounting law requires.

Ad attribution

If you found the app through an Apple Ads ad on the App Store, the app passes Apple's attribution token (AdServices) to RevenueCat, which tells us which campaign led to the download. Apple provides it without tracking permission, and it does not identify you. The app shows no ads and does not use your advertising ID. Legal basis: our legitimate interest in knowing which ads work (Art. 6(1)(f) GDPR).

Crash reports

If you have chosen in your device settings to share analytics with app developers, Apple passes us crash reports and usage statistics that do not identify you.

This website

The website sets no cookies and runs no advertising. We count visits with GoatCounter, which uses no cookies and stores no personal data. Cloudflare, Inc. (USA) delivers the pages and Beget LLC (Russia) hosts them; both record technical logs (IP address, time, page, browser) to deliver the site and stop attacks, under our legitimate interest in running the site safely (Art. 6(1)(f) GDPR). The logs are deleted after a short period.

Who receives data

  • AIProxy, Inc. (USA) and OpenAI, L.L.C. (USA): identification, as described above.
  • Google (Firebase): app configuration and notifications.
  • RevenueCat, Inc. (USA): checks purchases and ad attribution.
  • Apple: the App Store, under its own privacy policy.
  • Cloudflare, Inc. (USA) and Beget LLC (Russia): deliver and host this website.

We do not sell your data or share it with anyone else, unless the law obliges us to.

Transfers outside the EU

The services above are mostly in the USA. Google and Cloudflare are certified under the EU-U.S. Data Privacy Framework; for RevenueCat, AIProxy and OpenAI the transfer is covered by the European Commission's standard contractual clauses in their data processing terms. Beget's servers are in Russia, for which no adequacy decision exists; only website logs are created there.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to withdraw consent, and to object to processing based on our legitimate interest. Write to nikolaystrikhar@gmail.com. Because the app has no accounts, tell us what you want and we will do our best to find the data that belongs to you. You also have the right to complain to a data protection supervisory authority, in particular the one where you live or work.

California residents: we do not sell or share personal information as those terms are defined in the CCPA.

Children

The app is not directed at children under 13, and we do not knowingly collect personal data from them.

Changes

If this policy changes, we will update this page and the date above.