Privacy Policy

This summary provides key points from our Privacy Notice. You can find more detail on any topic in the sections below.

Account Information

In Short: We collect the information you provide when creating or signing into your account.

When you create a Spotter account, we collect:

• Email address — collected when you register with email/password via Firebase Authentication.
• Google account name and email — collected when you sign in with Google.
• Username — auto-generated from your display name or email address on first sign-in.

Photos

When you submit an identification request, Spotter uploads the photo you take or select to Google Cloud Storage. Photos are stored permanently and linked to your identification history. They are processed by Google Vertex AI / Gemini for species identification.

Location Data

Spotter may request access to your device's GPS coordinates (latitude and longitude) to improve identification accuracy through iNaturalist regional species hints. Providing your location is optional. Location data is sent with the identification request and is not stored permanently — it is used only during the request and then discarded.

Identification History and Garden List

Spotter stores the following usage data associated with your account:

• Identification history — species name, confidence score, category, date, result details, and whether the identification has been added to your garden.
• Garden list — the identifications you have saved to your personal garden.

Automatically Collected Information

In Short: Some information is collected automatically by Firebase when you use the app.

Spotter uses Firebase Analytics and Firebase Crashlytics, which automatically collect certain information:

• Firebase Analytics — app usage data, session information, device type, operating system version, and feature engagement. This helps us understand how the app is used and improve it over time.
• Firebase Crashlytics — crash reports, device identifiers, and app state at the time of a crash. This helps us identify and fix stability issues.

Sensitive Information

We do not process sensitive personal information such as racial or ethnic origins, religious beliefs, or financial data. Precise GPS coordinates — which California law (CPRA) may classify as sensitive personal information — are collected optionally and transiently as described above and are not stored permanently.

Google API

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In Short: We process your information to provide and improve Spotter's features, manage your account, and maintain app stability.

We process your personal information for the following purposes:

• Account creation and authentication — to create and manage your Spotter account via Firebase Authentication.
• AI-based species identification — to send your photos (and optionally GPS coordinates) to Google Vertex AI / Gemini for plant, bird, and wildlife identification.
• Regional species hints — to send optional GPS coordinates and/or a species name to iNaturalist to improve identification accuracy and retrieve reference photos.
• Bird call audio — to send the scientific name of an identified bird to xeno-canto to retrieve audio samples.
• Reference photos — to send the identified species name to Google Custom Search to retrieve reference images.
• Storing your identification history and garden list — to persist your results so you can review them later.
• App analytics — to understand how users interact with the app and improve the user experience via Firebase Analytics.
• Crash reporting and stability — to identify and fix bugs via Firebase Crashlytics.

In Short: We share data with third-party service providers that power Spotter's core features. We do not sell your data or share it for advertising.

To provide Spotter's features, we send certain data to the following third-party service providers:

Each of these service providers processes your data subject to their own privacy policies. We encourage you to review Google's Privacy Policy, iNaturalist's Privacy Policy, and xeno-canto's Privacy Policy for more information.

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

In Short: We use Firebase SDKs that collect device identifiers and usage data to provide analytics and crash reporting.

Spotter is a mobile application and does not use browser cookies. However, we use Firebase Analytics and Firebase Crashlytics SDKs provided by Google, which collect device identifiers and usage data to help us understand how the app is used and to improve its stability.

You may be able to limit data collection by Firebase Analytics through your device's privacy settings — for example, by enabling "Limit Ad Tracking" on iOS or resetting your Advertising ID on Android. For more information, see Google's Firebase privacy documentation.

In Short: We keep your information for as long as your account exists, except for location data which is never stored permanently.

• Account data (email, username) — retained for as long as your account is active.
• Photos — stored permanently in Google Cloud Storage, linked to your identification history, until you delete your account or submit a deletion request.
• Identification history and garden list — retained for as long as your account is active.
• Location (GPS coordinates) — never stored; used only during an identification request and then immediately discarded.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it. If deletion is not immediately possible (for example, data stored in backup archives), we will securely isolate it from further processing until deletion is possible.

In Short: We aim to protect your personal information through organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In Short: We do not knowingly collect data from children under 13 years of age.

We do not knowingly collect, solicit data from, or market to children under 13 years of age. Users between the ages of 13 and 17 should have parental or guardian consent before using Spotter. If we learn that personal information from users less than 13 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 13, please contact us at dgauger@realbluesoftware.com.

In Short: You may review, change, or delete your account data at any time.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us at dgauger@realbluesoftware.com. Please note that this will not affect the lawfulness of processing that occurred before withdrawal.

Account Information

If you would like to review, update, or delete your account data, you may:

• Submit a data deletion request on our data deletion page.
• Contact us directly at dgauger@realbluesoftware.com.

Upon your request to delete your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, or comply with applicable legal requirements.

Most mobile operating systems include privacy settings you can use to limit data collection by apps and advertising networks. Because there is currently no uniform standard for honoring Do-Not-Track signals in mobile applications, we do not respond to such signals at this time. If a standard for mobile tracking preferences is adopted that we must follow in the future, we will inform you in a revised version of this Privacy Notice.

In Short: If you are a resident of California, Colorado, Connecticut, or other states with comprehensive privacy laws, you may have the right to request access to, correct, or delete the personal information we maintain about you.

Categories of Personal Information We Collect

The table below shows the categories of personal information Spotter collects. For full details, see Section 1.

How We Use and Share Personal Information

We use your personal information to provide Spotter's features as described in Section 2. We share your data with the third-party service providers listed in Section 3 only for the specific purposes stated. We do not sell your personal information or use it for targeted advertising.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months other than as required to provide the Services described in this notice. We will not sell or share personal information for advertising purposes.

Your Rights

You have rights under certain US state data protection laws. These rights include:

• Right to know whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request the deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to non-discrimination for exercising your rights.
• Right to opt out of the processing of your personal data if it is used for targeted advertising or the sale of personal data (we do neither).
• Right to limit use and disclosure of sensitive personal data, including precise geolocation (as permitted by applicable law, including California).

How to Exercise Your Rights

To exercise these rights, you can submit a data request on our data deletion page, email us at dgauger@realbluesoftware.com, or refer to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof of valid authorization to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to confirm you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity. If we cannot verify your identity from information already maintained by us, we may request additional information for security or fraud-prevention purposes.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at dgauger@realbluesoftware.com. We will inform you in writing of any action taken or not taken in response to the appeal. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about personal information (if any) we disclosed to third parties for direct marketing purposes. We do not share personal information with third parties for direct marketing purposes.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

If you have questions or comments about this notice, you may email us at dgauger@realbluesoftware.com or contact us by post at:

You have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete your personal information. These rights may be limited in some circumstances by applicable law. To submit a data deletion or access request, please visit our data deletion page or email us at dgauger@realbluesoftware.com.