Privacy Policy
Last updated: June 5, 2026 · Version 1.0
Who we are
dobudex is operated by MulletIQ B.V., Schieweg 152D, Rotterdam, the Netherlands (registered with the Dutch Chamber of Commerce (KvK) under no. 97102555) ("we", "us"). We are the controller responsible for your personal data. You can reach us at support@dobudex.com.
dobudex is a mobile app that lets you scan real animals you encounter and collect them as pixel-art creatures. This policy explains what we collect, why, the legal bases we rely on, and the choices and rights you have.
Information we collect
- Account information. You can use dobudex as a guest (anonymous) or sign in with Apple or Google. Guest use does not require any sign-in details; we assign a random internal identifier to your session. If you sign in, we receive and store your email address and an account identifier; if you use Apple's "Hide My Email", we receive and store only Apple's relay address and treat it as your contact address. We also store a username you choose.
- Date of birth (age check). We ask for your birth month and year once, to confirm you meet our minimum age. We store only the month and year (never the day), and we do not store it at all if you are under the minimum age. We use it to recompute your age over time, so we never have to ask again.
- Scan photos. When you scan an animal, the photo is uploaded so we can identify the species and generate your creature. Before upload we remove GPS and other EXIF metadata and downscale the image to a maximum 1,024-pixel long edge; we do not upload or retain the original full-resolution capture. This downscaled copy is stored so you can see it in your Dex and Journal, and is kept until the scan is discarded or your account or guest data is deleted. We do not use your photos for advertising, and we do not use them to train AI models or sell them (see "Data we do not use or sell").
- Approximate location (optional). Only if you grant the location permission, a scan may be tagged with a coarse, approximate location (captured at reduced accuracy, roughly 1–5 km, and further truncated before storage). This is based on your consent; you can deny it, or withdraw it at any time in your device settings, and keep using every feature.
- Subscription and purchase information. If you buy a subscription, Apple's App Store and our subscription-management partner (RevenueCat) process the purchase and report your subscription status to us. We do not receive or store your full payment-card details.
- Limited diagnostic data. We keep minimized technical records of AI processing requests (timing, status codes, request shape, and the species name the AI returned) to operate, secure, and improve the service. These records do not include your photos or your username.
A photo and an internal identifier are necessary to perform and save a scan. Sign-in, location, and subscription data are optional; if you do not provide them, only the related feature is unavailable.
Legal bases for processing (EU/UK)
If you are in the EU or UK, we rely on these bases under the GDPR:
- Performance of a contract (Art. 6(1)(b)). Identifying your scan, generating your creature, building and syncing your Dex and Journal, and managing your account, subscription, and scan allowance.
- Consent (Art. 6(1)(a)). Collecting approximate location. You may withdraw consent at any time.
- Legitimate interests (Art. 6(1)(f)). Operating, securing, debugging, and protecting the service against abuse and fraud, keeping minimized diagnostic records, and verifying that you meet our minimum age. You may object to this processing (see "Your rights").
How we use your information
- To identify the species in your scan and generate your creature.
- To build and sync your personal Dex and Journal across your sessions.
- To manage your account, subscription, and scan allowance.
- To operate, secure, debug, and improve the service and prevent abuse.
AI processing of photos
To identify a species and create artwork, your scan photo is sent to our AI providers, currently Google (Gemini) and OpenAI, which process it to return an identification and a generated image to us. Identifications are generated automatically, may be inaccurate or incomplete, and are provided for entertainment, not as scientific determinations, and have no legal or similarly significant effect on you. We do not use your photos for advertising. These providers process the photo to provide the result to us and under their own API terms and privacy policies.
Who we share data with
We do not sell your personal data. We share it only with service providers ("processors") who help us run dobudex, under agreements that limit their use of it to providing their service to us:
- Supabase — hosting, database, storage, authentication.
- Apple and Google — sign-in.
- Google (Gemini) and OpenAI — AI species identification and image generation.
- RevenueCat and the App Store — subscription management and payments.
Providers acting as our processors are contractually required to follow our instructions and protect your data consistently with this policy. Apple and Google additionally process your sign-in and purchase data as independent controllers under their own privacy terms.
International data transfers
Some of these providers process data on servers in the United States. When we transfer personal data from the EU/UK to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and, where applicable, the providers' certification under the EU–US Data Privacy Framework and the UK extension). You can request more detail about these safeguards at support@dobudex.com.
Data we do not use or sell
We do not use third-party advertising or analytics trackers, and we do not track you across other apps or websites. We do not sell your personal data, and we do not share it for cross-context behavioural advertising; we disclose data only to the service providers listed above, to operate dobudex. We do not use your scans, photos, or location to train AI models. We may, in the future, offer an optional, opt-in programme that contributes anonymized or aggregated wildlife data to biodiversity research or partners. We do not do this today. If we ever introduce it, it will be off by default, require your explicit opt-in, be limited to adults, and we will update this policy before any such use begins.
Retention and deletion
- We keep your account information (including your birth month and year), scans, generated creatures, and the downscaled photos for as long as your account remains active.
- You can delete your account and your guest data from within the app (Profile → Delete Account, or Delete guest data). This removes your profile, scans, photos, generated creatures, and any stored locations, and deletes your account from our systems.
- We do not keep our own backups of your data. Once you delete your account or guest data, it is removed from our systems and is not retained in a backup by us.
- For abuse and fraud prevention, when an account is deleted we keep a one-way hashed identifier derived from your sign-in (not your email or name) for a limited period (up to about 90 days), after which it is removed.
- Minimized, de-identified operational logs (with no photos or usernames) are retained only as long as needed for diagnostics, security, and debugging.
Your rights
EU/UK (GDPR). You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on our legitimate interests, and to withdraw consent at any time (without affecting prior lawful processing). You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); in the UK, the ICO (ico.org.uk); or your local authority.
California (CCPA/CPRA). You have the right to know, access, delete, and correct your personal information, and to non-discrimination for exercising these rights. We do not sell or share your personal information (as those terms are defined under the CCPA/CPRA), so we do not offer a "Do Not Sell or Share My Personal Information" link; if that ever changes, we will provide one.
Other US states. Residents of states with comprehensive privacy laws have access, correction, deletion, and portability rights and may opt out of targeted advertising, sale, and certain profiling. We do not engage in any of those.
You can exercise account deletion in the app at any time. Guest users can use "Delete guest data". For any other request, contact support@dobudex.com; we respond within the time required by applicable law (generally one month under the GDPR, 45 days under the CCPA).
Children
dobudex is intended for users aged 13 and over. We ask for your birth month and year at sign-up and do not let anyone under 13 create an account or use the Service; an under-13 birthdate is not stored. If you are under 16, we do not ask for or store your location: location is optional and based on consent, and below 16 valid consent requires a parent or guardian. dobudex is not directed to children under 13, and we do not knowingly collect their personal data. If you believe someone under 13 has provided us personal data, contact support@dobudex.com and we will delete it.
Security
We protect your data with encryption in transit and at rest and with access controls that restrict who and what can read it. No method of storage or transmission is completely secure, but we work to protect your information and to limit what we collect.
Our website
Our website (dobudex.com), including this page, is served by Cloudflare, which processes standard server-log data such as your IP address to deliver and secure the site. These pages also load fonts from Google Fonts, which receives your IP address as part of serving the fonts. We do not use website cookies for advertising or cross-site tracking.
Changes to this policy
We may update this policy as the app evolves. We will post material changes here with a new "last updated" date and, where appropriate, notify you in the app before they take effect.
Contact
MulletIQ B.V., the Netherlands — support@dobudex.com