Privacy Policy

Last updated: July 19, 2026 · Version 1.2

Who we are

dobudex is operated by MulletIQ B.V., Schieweg 152D, Rotterdam, the Netherlands (registered with the Dutch Chamber of Commerce (KvK) under no. 97102555) ("we", "us"). We are the controller responsible for your personal data. You can reach us at support@dobudex.com.

dobudex is a mobile app that lets you scan real animals you encounter and collect them as pixel-art creatures. This policy explains what we collect, why, the legal bases we rely on, and the choices and rights you have.

Information we collect

• Account information. You can use dobudex as a guest (anonymous) or sign in with Apple or Google. Guest use does not require any sign-in details; we assign a random internal identifier to your session. If you sign in, we receive and store your email address and an account identifier; if you use Apple's "Hide My Email", we receive and store only Apple's relay address and treat it as your contact address. We also store a username you choose.
• Friends and social data. If you use the friends feature, we store your friend connections and pending requests, the invite codes you create, the users you block, and any reports you file about other users (including the optional reason). We use this to run the friends list, the leaderboards, and our moderation of social features.
• Date of birth (age check). We ask for your birth month and year once, to confirm you meet our minimum age. We store only the month and year (never the day), and we do not store it at all if you are under the minimum age. We use it to recompute your age over time, so we never have to ask again.
• Scan photos. When you scan an animal, the photo is uploaded so we can identify the species and generate your creature. Before upload we remove GPS and other EXIF metadata and downscale the image to a maximum 1,024-pixel long edge; we do not upload or retain the original full-resolution capture. This downscaled copy is stored so you can see it in your Dex and Journal, and is kept until the scan is discarded or your account or guest data is deleted. We do not use your photos for advertising, and we do not use them to train AI models or sell them (see "Data we do not use or sell").
• Approximate location (optional). Only if you grant the location permission, a scan may be tagged with a coarse, approximate location (captured at reduced accuracy, roughly 1–5 km, and further truncated before storage). We use it to help identify the species (a rough region helps tell apart similar-looking animals) and store it with the scan in your collection. This is based on your consent; you can deny it, or withdraw it at any time in your device settings, and keep using every feature.
• Subscription and purchase information. If you buy a subscription, Apple's App Store and our subscription-management partner (RevenueCat) process the purchase and report your subscription status to us. We do not receive or store your full payment-card details.
• Limited diagnostic data. We keep minimized technical records of AI processing requests (timing, status codes, request shape, and the species name the AI returned) to operate, secure, and improve the service. These records do not include your photos or your username.

A photo and an internal identifier are necessary to perform and save a scan. Sign-in, location, and subscription data are optional; if you do not provide them, only the related feature is unavailable.

Legal bases for processing (EU/UK)

If you are in the EU or UK, we rely on these bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)). Identifying your scan, generating your creature, building and syncing your Dex and Journal, managing your account, subscription, and scan allowance, and operating the social features you use (friend connections, invite codes, and the leaderboard).
• Consent (Art. 6(1)(a)). Collecting approximate location, and adding your email to our launch waiting list if you ask us to. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)). Operating, securing, debugging, and protecting the service against abuse and fraud, keeping minimized diagnostic records, moderating social features (including blocks and the reports users file), and verifying that you meet our minimum age. You may object to this processing (see "Your rights").

How we use your information

• To identify the species in your scan and generate your creature.
• To build and sync your personal Dex and Journal across your sessions.
• To manage your account, subscription, and scan allowance.
• To operate, secure, debug, and improve the service and prevent abuse.
• To show your explorer profile (username, avatar creature, and collection counts) to other users on the leaderboard and to your friends, and to operate friend connections, blocks, and reports.

What other users can see

If you sign in, your username, your avatar creature, and your collection counts (such as how many species you have found and your rank) appear on the in-app leaderboard and are visible to friends you connect with, including in pending friend requests between you. Your scan photos, your Journal, and any location data are never visible to other users. You can report or block another user from within the app; we review reports and may remove content or restrict accounts as described in our Terms of Use. Guest (anonymous) sessions do not appear on the leaderboard and cannot use the friends feature.

AI processing of photos

To identify a species and create artwork, your scan photo is sent to our AI providers, currently Google (Gemini) and OpenAI, which process it to return an identification and a generated image to us. Identifications are generated automatically, may be inaccurate or incomplete, and are provided for entertainment, not as scientific determinations, and have no legal or similarly significant effect on you. We do not use your photos for advertising. These providers process the photo to provide the result to us and under their own API terms and privacy policies.

Who we share data with

We do not sell your personal data. We share it only with service providers ("processors") who help us run dobudex, under agreements that limit their use of it to providing their service to us:

• Supabase — hosting, database, storage, authentication.
• Apple and Google — sign-in.
• Google (Gemini) and OpenAI — AI species identification and image generation.
• RevenueCat and the App Store — subscription management and payments.

Providers acting as our processors are contractually required to follow our instructions and protect your data consistently with this policy. Apple and Google additionally process your sign-in and purchase data as independent controllers under their own privacy terms.

International data transfers

Some of these providers process data on servers in the United States. When we transfer personal data from the EU/UK to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and, where applicable, the providers' certification under the EU–US Data Privacy Framework and the UK extension). You can request more detail about these safeguards at support@dobudex.com.

Data we do not use or sell

We do not use third-party advertising or analytics trackers, and we do not track you across other apps or websites. We do not sell your personal data, and we do not share it for cross-context behavioural advertising; we disclose data only to the service providers listed above, to operate dobudex. We do not use your scans, photos, or location to train AI models. We may, in the future, offer an optional, opt-in programme that contributes anonymized or aggregated wildlife data to biodiversity research or partners. We do not do this today. If we ever introduce it, it will be off by default, require your explicit opt-in, be limited to adults, and we will update this policy before any such use begins.

Retention and deletion

• We keep your account information (including your birth month and year), scans, generated creatures, the downscaled photos, and your friends and social data (connections, invite codes, blocks, and reports) for as long as your account remains active.
• You can delete your account and your guest data from within the app (Profile → Delete Account, or Delete guest data). This removes your profile, scans, photos, generated creatures, any stored locations, and your friends and social data (your connections, invite codes, blocks, and reports involving you), and deletes your account from our systems.
• We keep encrypted backups of our database for disaster recovery only, retained for up to 7 days on a rolling basis. When you delete your account or guest data, it is removed from our live systems immediately; any residual copies in these backups expire automatically within 7 days. We do not restore individual accounts from backups, and if we ever have to restore the database to recover from data loss, we re-apply pending deletions so that data you asked us to erase is not brought back.
• For abuse and fraud prevention, when an account is deleted we keep a one-way hashed identifier derived from your sign-in (not your email or name) for a limited period (up to about 90 days), after which it is removed.
• Minimized, de-identified operational logs (with no photos or usernames) are retained only as long as needed for diagnostics, security, and debugging.

Your rights

EU/UK (GDPR). You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on our legitimate interests, and to withdraw consent at any time (without affecting prior lawful processing). You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); in the UK, the ICO (ico.org.uk); or your local authority.

California (CCPA/CPRA). You have the right to know, access, delete, and correct your personal information, and to non-discrimination for exercising these rights. We do not sell or share your personal information (as those terms are defined under the CCPA/CPRA), so we do not offer a "Do Not Sell or Share My Personal Information" link; if that ever changes, we will provide one.

Other US states. Residents of states with comprehensive privacy laws have access, correction, deletion, and portability rights and may opt out of targeted advertising, sale, and certain profiling. We do not engage in any of those.

You can exercise account deletion in the app at any time. Guest users can use "Delete guest data". For any other request, contact support@dobudex.com; we respond within the time required by applicable law (generally one month under the GDPR, 45 days under the CCPA).

Children

dobudex is intended for users aged 13 and over. We ask for your birth month and year at sign-up and do not let anyone under 13 create an account or use the Service; an under-13 birthdate is not stored. If you are under 16, we do not ask for or store your location: location is optional and based on consent, and below 16 valid consent requires a parent or guardian. dobudex is not directed to children under 13, and we do not knowingly collect their personal data. If you believe someone under 13 has provided us personal data, contact support@dobudex.com and we will delete it.

Security

We protect your data with encryption in transit and at rest and with access controls that restrict who and what can read it. No method of storage or transmission is completely secure, but we work to protect your information and to limit what we collect.

Our website

Our website (dobudex.com), including this page, is served by Cloudflare, which processes standard server-log data such as your IP address to deliver and secure the site. These pages also load fonts from Google Fonts, which receives your IP address as part of serving the fonts. We do not use website cookies for advertising or cross-site tracking.

Launch waiting list. If you submit your email address on our website to join the launch waiting list, we store that address for the sole purpose of emailing you once, when dobudex launches. We rely on your consent for this, and you can withdraw it at any time by emailing support@dobudex.com, which removes you from the list. We delete the list after the launch announcement (or sooner on request), and we do not use these addresses for any other purpose. The list is held by Supabase, our hosting provider.

Changes to this policy

We may update this policy as the app evolves. We will post material changes here with a new "last updated" date and, where appropriate, notify you in the app before they take effect.

Contact

MulletIQ B.V., the Netherlands — support@dobudex.com