Privacy Policy

Last updated: October 22, 2026 · Version 1.16

Who we are

dobudex is operated by MulletIQ B.V., Schieweg 152D, Rotterdam, the Netherlands (registered with the Dutch Chamber of Commerce (KvK) under no. 97102555) ("we", "us"). We are the controller responsible for your personal data. You can reach us at support@dobudex.com.

dobudex is a mobile app that lets you scan real animals you encounter and collect them as pixel-art creatures. This policy explains what we collect, why, the legal bases we rely on, and the choices and rights you have.

Information we collect

• Account information. You can use dobudex as a guest (anonymous) or sign in with Apple or Google. Guest use does not require any sign-in details; we assign a random internal identifier to your session. If you sign in, we receive and store your email address and an account identifier; if you use Apple's "Hide My Email", we receive and store only Apple's relay address and treat it as your contact address. We also store a username you choose.
• Friends and social data. If you use the friends feature, we store your friend connections and pending requests, the invite codes you create, the users you block, and any reports you file about other users (including the optional reason). We use this to run the friends list, the leaderboards, and our moderation of social features.
• Safaris. If you make or join a safari (a list of animals to find with other players), we store the safari's title, its animals, when it ends, who made it, who joined, when they joined, left or were removed, the players you block from a safari, and the reports you file about a safari or a player in it (with the reason you give). Your progress is worked out from your scans; we do not store it separately. When you find every animal, we keep a record that you finished, with the safari's title. When you print a sheet, we make a link that works for 10 minutes. If you type a wrong code in the app, we record the attempt against your account to stop people guessing codes, and remove records older than a day in a daily cleanup.
• Reports about creature pictures and text. If you report a creature picture, a mystery silhouette, or a creature's text, we store which one you reported (for a picture of your own creature, the scan it belongs to), the optional reason, what we decided (for example that we took the picture down or kept it) with our own note on why, and when the app showed you that decision. We use this to review generated content and to tell you the outcome.
• Date of birth (age check). We ask for your birth month and year once, to confirm you meet our minimum age. We store only the month and year (never the day), and we do not store it at all if you are under the minimum age. We use it to recompute your age over time, so we never have to ask again.
• Scan photos. When you scan an animal, the photo is uploaded so we can identify the species and generate your creature. Before upload we remove GPS and other EXIF metadata and downscale the image to a maximum 1,024-pixel long edge; we do not upload or retain the original full-resolution capture. This downscaled copy is stored so you can see it in your Dex and Journal, and is kept until the scan is discarded or your account or guest data is deleted. We do not use your photos for advertising, and we do not use them to train AI models or sell them (see "Data we do not use or sell").
• Approximate location (optional). Only if you grant the location permission, a scan may be tagged with a coarse, approximate location (captured at reduced accuracy, roughly 1–5 km, and further truncated before storage). We use it to help identify the species (a rough region helps tell apart similar-looking animals) and store it with the scan in your collection. This is based on your consent; you can deny it, or withdraw it at any time in your device settings, and keep using every feature.
• Animals near you (optional). When you open "Lives near you" in the Dex, the app reads your approximate location (at reduced accuracy) and sends us only the centre of the grid cell, about 25 km across, that it falls in. We use it once, to look up which animals' known ranges cover that area, and we do not store it or link it to your scans. It is never shown to other users. This uses the same location consent as above; without it, "Lives near you" stays empty and everything else works as before.
• Push notifications (optional). Only if you allow notifications, the app gets a push token from Google's push service (Firebase Cloud Messaging), which on iPhone works through Apple's. A push token is a random identifier that lets a notification reach your device. Until you allow notifications, the app creates no push token. We store the token with your account and use it to tell you when a creature is ready, when someone sends you a friend request or accepts yours, when a new weekly challenge starts or reaches its last day, when your daily streak is about to end, when someone finishes a safari you made, and when a friend catches a rare, epic, or legendary animal you do not have yet (without saying which animal), when we give you free scans, and when we have decided about something you reported. The text of each notification (for example the animal you caught, or a friend's username) passes through those push services to reach you. You can switch off each kind of notification in the app (Profile → Notifications), or all of them in your device settings. If you turn them off in your device settings, the app deletes the token and removes it from our servers the next time you open it while online. Signing out also removes the token for that device, and we delete tokens that the push service reports as no longer valid.
• Subscription and purchase information. If you buy a subscription, the store you bought it from (Apple's App Store or Google Play) and our subscription-management partner (RevenueCat) process the purchase and report your subscription status to us. We do not receive or store your full payment-card details.
• Whether an App Store ad brought you (iPhone, outside Europe). If your App Store account is in a country outside the EU, the EEA, the UK, and Switzerland, the app asks Apple's AdServices framework for a one-time token, valid for 24 hours, and passes it to RevenueCat. RevenueCat uses it to ask Apple whether the install came from one of our own ads on the App Store (Apple Ads): an ad you tapped in the 30 days before, or saw in the 24 hours before. If Apple can match the install, it returns the details of our ad that it makes available, such as identifiers of our campaign, ad group, keyword, and ad, the campaign's country, whether you tapped or only saw the ad, and whether it was a first download or a redownload. If Apple cannot match it, Apple returns only that. RevenueCat keeps the result with the subscription records it holds for us, and includes it in the purchase notices it sends us, so we can see whether our ads bring people who go on to subscribe. Apple does not give us your name, your Apple Account, or a device identifier. This is Apple's standard attribution, which uses no advertising identifier (IDFA) and does not require an App Tracking Transparency permission request, so the app never shows one. If your App Store account is in the EU, the EEA, the UK, or Switzerland, or you use Android, the app does none of this.
• Whether a Google ad brought you (Android, outside Europe, 16 and over). If you use Android, your Google Play account is in a country outside the EU, the EEA, the UK, and Switzerland, and the account you use in the app (a guest account included) is one we know is 16 or over, the app uses Google Analytics for Firebase while it is on your screen. Google Analytics then records that the app was opened for the first time, when and for how long you use it (sessions and engagement), and updates of the app and of your phone's operating system. For an account created in the app on that phone, it also records that you created it and that you finished your first scan. These two wait until the app has checked your age and country; if a check finds that you are under 16 or that your Google Play account is in those countries, the app drops them and does not report them later. With these events the app sends a random identifier that Google Analytics creates for this installation of the app, your device's model, operating-system version, language, and time zone, and Google works out an approximate location (such as your country or region) from your IP address. The app also reads what Google Play recorded about how it was installed (the install referrer) and passes it on: if you installed it from one of our Google ads, that includes the campaign and a click identifier with the time of the click. Google uses this to see whether the install came from a tap on one of our own Google ads, and then passes your sign-up and first scan to Google Ads as results of that ad. Once an installation has been measured, Google Analytics can also learn later, from Google Play, that the app's data was cleared or the app was removed. We use this to see whether those ads bring people who sign up and scan, and Google Ads uses it to decide where to show our ads. The app does not send your advertising identifier or your Android ID, we do not give Google Analytics your name, email address, username, or account identifier, and we have turned off ad personalisation, so this data is not used for personalised ads or remarketing to you. Google Analytics stays off until you have an account and we know your age, and it is never switched on if you are under 16. The app switches it off whenever it leaves your screen and checks again when you come back. The country check uses what Google Play reports, which can lag behind a change of Play account until the app is restarted. Signing out switches it off, and deleting your account in the app on that phone also gives that phone a new identifier; what Google already has keeps to the retention described under Retention and deletion. If you use an iPhone, or your Google Play account is in the EU, the EEA, the UK, or Switzerland, the app does none of this.
• Limited diagnostic data. We keep minimized technical records of AI processing requests (timing, status codes, request shape, and the species name the AI returned) to operate, secure, and improve the service. These records do not include your photos or your username.
• Which platform you use. We store the platform your account was created on, and the platform we most recently saw it on. It is a single word naming the kind of device the app was running on, such as "ios" or "android". We record it when your app signs in, and for accounts that bought a subscription before we started recording it, we filled it in from the app store the purchase went through. We use it to understand which platforms our users are on, to decide what to build and fix first, and to reproduce problems on the right platform. It is not an advertising identifier, it does not identify your particular device, and we do not collect your device model, operating-system version, or any hardware identifier with it. (Google Analytics on Android, described above, is separate.)
• Language and time zone. We store the language the app uses (your phone's language, or the one you pick in Profile → Language), so notifications reach you in that language. We also store your device's offset from UTC (for example "+2 hours", not your city or region), so your daily streak and its reminder follow your local day. The app sends both again when you open it, so a change reaches us on a later launch.

A photo and an internal identifier are necessary to perform and save a scan. Sign-in, scan location, notification, and subscription data are optional; if you do not provide them, only the related feature is unavailable.

Legal bases for processing (GDPR)

We are based in the Netherlands, so the GDPR applies to how we process your data wherever you are (and the UK GDPR as well if you are in the UK). We rely on these bases:

• Performance of a contract (Art. 6(1)(b)). Identifying your scan, generating your creature, building and syncing your Dex and Journal, managing your account, subscription, and scan allowance, and operating the social features you use (friend connections, invite codes, the leaderboard, safaris you make or join, and telling your friends about your rare finds), and keeping your daily streak on your local day.
• Consent (Art. 6(1)(a)). Collecting the approximate location of your scans, sending push notifications, and, while our launch waiting list was open, adding your email address to it. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)). Operating, securing, debugging, and protecting the service against abuse and fraud, keeping minimized diagnostic records, moderating social features (including blocks and the reports users file), reviewing the generated creature pictures and text that players report, verifying that you meet our minimum age, measuring how the service is used in aggregate (including which platform accounts are on) so we can decide what to build and fix, and learning whether an install came from one of our own ads, on the App Store (iPhone) or on Google (Android, 16 and over, including the approximate location Google works out from your IP address for it), so we can tell which ads are worth paying for and Google can decide where to show them (we do this only where your store account is outside the EU, the EEA, the UK, and Switzerland, and never to target ads at you). You may object to this processing (see "Your rights").

How we use your information

• To identify the species in your scan and generate your creature.
• To build and sync your personal Dex and Journal across your sessions.
• To manage your account, subscription, and scan allowance.
• To send the notifications you allowed: a creature is ready, a friend request, a weekly challenge that starts or ends, a streak about to end, a friend's rare find, a safari you made was finished, free scans we give you, and what we decided about something you reported.
• To operate, secure, debug, and improve the service and prevent abuse.
• To see whether our ads on the App Store bring people who go on to subscribe (iPhone, outside the EU, the EEA, the UK, and Switzerland).
• To see whether our ads on Google bring people who sign up and scan, and to let Google show our ads to more people like them (Android, 16 and over, outside the EU, the EEA, the UK, and Switzerland).
• To show your explorer profile (username, avatar creature, and collection counts) to other users on the leaderboard and to your friends, and to operate friend connections, blocks, and reports.

What other users can see

If you sign in, your username, your avatar creature, and your collection counts (such as how many species you have found and your rank) appear on the in-app leaderboard and are visible to friends you connect with, including in pending friend requests between you. When you catch a rare, epic, or legendary animal, friends who do not have it yet and who allow that notification may get one with your username and the animal's rarity, but not which animal it is. Your scan photos, your Journal, and any location data are never visible to other users. You can report or block another user from within the app; we review reports and may remove content or restrict accounts as described in our Terms of Use. Guest (anonymous) sessions do not appear on the leaderboard and cannot use the friends feature.

Safaris. Anyone with a safari's link or code can see its title, its animals (as shapes, or with names if the maker chose that) and when it ends, on dobudex.com, until it closes to new players. That page never shows who made it, who joined, or anyone's progress. For a friends-only safari, the page shows only that it exists; its title and animals are shown only to its members, in the app and on sheets they print. Inside the app, members see how many animals each member has found. Names follow the leaderboard rule: friends see each other's usernames; other members see a username only when both have chosen to appear on the leaderboard and both are 16 or older; everyone else shows as “Anonymous”. Guests never see or show a username. Members never see each other's photos, cards, locations, or which animals someone has found. You can block or report a member from the safari.

AI processing of photos

To identify a species and create artwork, your scan photo is sent to our AI providers, currently Google (Gemini) and OpenAI, which process it to return an identification and a generated image to us. Identifications are generated automatically, may be inaccurate or incomplete, and are provided for entertainment, not as scientific determinations, and have no legal or similarly significant effect on you. We do not use your photos for advertising. These providers process the photo to provide the result to us and under their own API terms and privacy policies.

Who we share data with

We do not sell your personal data. We share it only with the service providers ("processors") below, who help us run dobudex under agreements that limit their use of it to providing their service to us, and with Apple and Google where they act for themselves, as explained after the list:

• Supabase — hosting, database, storage, authentication.
• Apple and Google — sign-in.
• Google (Gemini) and OpenAI — AI species identification and image generation.
• RevenueCat and the store you bought from (App Store or Google Play) — subscription management and payments.
• RevenueCat — on iPhone, outside the EU, the EEA, the UK, and Switzerland, asking Apple whether your install came from one of our App Store ads, and keeping the answer for us.
• Google (Google Analytics for Firebase and Google Ads) — on Android, 16 and over, outside the EU, the EEA, the UK, and Switzerland, measuring whether our Google ads bring people who sign up and scan.
• Google (Firebase Cloud Messaging) and, on iPhone, Apple (Apple Push Notification service) — delivering push notifications, if you allow them.

Providers acting as our processors are contractually required to follow our instructions and protect your data consistently with this policy. Apple and Google additionally process your sign-in and purchase data as independent controllers under their own privacy terms. Apple also acts as an independent controller for the App Store ad data it uses to answer whether an install came from one of our ads; see Apple Advertising & Privacy. Google processes Google Analytics data for us as our processor. Google Ads, which matches an install to a tap on one of our ads and receives the sign-up and first-scan results for it, uses that data as an independent controller under Google's Privacy Policy and keeps it under its own retention rules.

International data transfers

Some of these providers process data on servers in the United States. When we transfer personal data from the EU/UK to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and, where applicable, the providers' certification under the EU–US Data Privacy Framework and the UK extension). You can request more detail about these safeguards at support@dobudex.com.

Data we do not use or sell

The app shows no ads. The advertising-related things we do are the two ad checks described under Information we collect, both only outside the EU, the EEA, the UK, and Switzerland: the App Store check on iPhone, and on Android (16 and over) Google Analytics for Firebase, the only ad measurement tool in the app. Both match your install, and on Android your sign-up and first scan, to an earlier tap on (or, on the App Store, view of) one of our own ads, which Apple or Google showed you in another app or on a website. Apart from that matching, we do not track you across other apps or websites. Neither uses your advertising identifier, neither is combined by us with data from other companies' apps or websites, and we use them only to measure and improve our own ads, never to target ads at you. We do keep our own daily counts of how the service is used, but those are totals, not records about you; see Retention and deletion. Our website counts page views with a cookieless tool that cannot identify you; see Our website below. We do not sell your personal data, and we do not share it for cross-context behavioural advertising; we disclose data only to the recipients listed above, to operate dobudex. We do not use your scans, photos, or location to train AI models. We may, in the future, offer an optional, opt-in programme that contributes anonymized or aggregated wildlife data to biodiversity research or partners. We do not do this today. If we ever introduce it, it will be off by default, require your explicit opt-in, be limited to adults, and we will update this policy before any such use begins.

Retention and deletion

• We keep your account information (including your birth month and year), scans, generated creatures, the downscaled photos, and your friends and social data (connections, invite codes, blocks, and reports, including reports about creature pictures and text) for as long as your account remains active.
• Safaris. A safari stays playable until two hours after it ends (without an end date, until it expires), and stays in its members' lists until it expires (90 days after it ends, or after it was made if it has no end date). After that it is hidden and kept for 12 months, then deleted. If the maker or we take a safari down, it disappears at once and is deleted on the same schedule. The safari's pictures are copies of the shared animal silhouettes every player sees in their Dex, not your photos; they are kept, and stay reachable at their web address. Your “finished” records stay with your account until you delete it. Print links expire after 10 minutes and are deleted daily. Reports are kept until a year after we have handled them, or until the account of the person who filed them is deleted; a report about a player is also deleted with that player's account. When a safari is deleted, reports about it lose its title. If you ask us to delete your account, you disappear from every safari's member list at once (and come back if you restore your account within 30 days). Safaris you made stay playable for their members without your name. When the deletion completes, the title you wrote is removed from the safari, from members' “finished” records and from reports, and reports you filed or that were filed about you as a player are deleted, as with other reports.
• Daily totals are kept indefinitely, and they are not about you. Once a day we record counts such as how many accounts were created that day, how many of those were on each platform, and how many scans were made. These are numbers only: no names, no identifiers, nothing that can be traced back to a person or turned back into one. They are what let us see whether the app is growing, so we keep them after individual accounts are deleted. Deleting your account removes your data as described below; it does not subtract you from a total that was already counted, because there is nothing left in that total to identify.
• You can delete your account and your guest data from within the app (Profile → Delete Account, or Delete guest data); the steps are also on our account deletion page. This removes your profile, scans, photos, generated creatures, any stored locations, and your friends and social data (your connections, invite codes, the blocks you placed, and reports involving you), the reports you filed about creature pictures and text, and deletes your account from our systems. For guest data this happens immediately; for a signed-in account it happens after the 30-day window described next. Purchase records, and any App Store ad answer kept with them, follow their own rule, described below.
• A 30-day window to change your mind. When you delete a signed-in account, we end your access straight away: you are signed out, your account can no longer be used, and you disappear from the leaderboard and from other people's friends lists immediately. Your data is then permanently erased after 30 days, automatically. We do this because an accidental deletion is otherwise impossible to undo.
• To change your mind, sign in again within those 30 days. In the latest version of the app we will show you the date your account is due to be erased and offer to restore it, with your scans and creatures intact; on older versions, email us at support@dobudex.com within the window and we will restore it for you. Some things do not come back: your friends and social connections, your invite codes, and your leaderboard opt-in, all of which were removed when you asked us to delete the account. Blocks that other people placed on you are kept.
• You can ask us to erase sooner. The 30-day window exists for your benefit, not ours. If you would rather your data were erased immediately, email support@dobudex.com and we will erase it without undue delay. Guest (not signed-in) data is always deleted immediately and cannot be restored, because a guest session cannot be recovered once you sign out of it.
• Deleting your account does not cancel a dobudex Explorer subscription. Subscriptions are billed by the store you bought from and are cancelled through that store's subscription settings (App Store account settings, or Google Play → Payments & subscriptions); cancel there as well if you no longer want to be charged.
• Purchase records and the App Store ad answer. RevenueCat keeps the records of your purchases, and the App Store ad answer if there is one, under an internal identifier, and sends both to us with each purchase notice; we keep those notices with our purchase records. We keep purchase records for as long as we must for tax and accounting, so deleting your account in the app does not delete them, at RevenueCat or with us. The App Store ad answer is kept with them, because it only has meaning next to a purchase. If you email support@dobudex.com, we will delete the App Store ad answer in both places, and the purchase records once we no longer have to keep them.
• Google Analytics data (Android). We have set Google Analytics to keep the event records described under Information we collect, and the identifier they carry, for 2 months, counted from when they were recorded rather than from your last use. Google deletes expired records in a monthly process, so a record can last a few weeks longer. The reports built from them are totals, not records about you. The sign-up and first-scan results that Google Ads receives are kept by Google Ads under its own rules. Because we never link this data to your account, we cannot find it to delete it sooner. Deleting your account in the app on a phone gives that phone a new identifier from then on; records Google already has are not changed by that.
• We keep encrypted backups for disaster recovery only. Database backups held by our hosting provider are retained for up to 7 days on a rolling basis, and we keep our own off-site copy of the database and of stored photos and creatures, retained for up to 30 days on a rolling basis. When your data is erased it is removed from our live systems at that point, and any residual copies in these backups expire automatically within 30 days of our next daily backup run. We do not restore individual accounts from backups except to recover from a fault on our side, and if we ever have to restore to recover from data loss, we re-apply pending deletions so that data you asked us to erase is not brought back.
• For abuse and fraud prevention, when an account is deleted we keep a one-way hashed identifier derived from your sign-in (not your email or name) for a limited period (up to about 90 days), after which it is removed.
• Minimized, de-identified operational logs (with no photos or usernames) are retained only as long as needed for diagnostics, security, and debugging.

Your rights

Everyone (GDPR). You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on our legitimate interests, and to withdraw consent at any time (without affecting prior lawful processing). You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); in the UK, the ICO (ico.org.uk); or your local authority.

California (CCPA/CPRA). You have the right to know, access, delete, and correct your personal information, and to non-discrimination for exercising these rights. We do not sell or share your personal information (as those terms are defined under the CCPA/CPRA), so we do not offer a "Do Not Sell or Share My Personal Information" link; if that ever changes, we will provide one.

Other US states. Residents of states with comprehensive privacy laws have access, correction, deletion, and portability rights and may opt out of targeted advertising, sale, and certain profiling. We do not engage in any of those.

You can exercise account deletion in the app at any time. Guest users can use "Delete guest data". For any other request, contact support@dobudex.com; we respond within the time required by applicable law (generally one month under the GDPR, 45 days under the CCPA).

Children

dobudex is intended for users aged 13 and over. We ask for your birth month and year at sign-up and do not let anyone under 13 create an account or use the Service; an under-13 birthdate is not stored. If you are under 16, we do not ask for or store your location: location is optional and based on consent, and below 16 valid consent requires a parent or guardian. For the same reason, the app sends nothing to Google Analytics if you are under 16. dobudex is not directed to children under 13, and we do not knowingly collect their personal data. If you believe someone under 13 has provided us personal data, contact support@dobudex.com and we will delete it.

Security

We protect your data with encryption in transit and at rest and with access controls that restrict who and what can read it. No method of storage or transmission is completely secure, but we work to protect your information and to limit what we collect.

Our website

Our website (dobudex.com), including this page, is served by Cloudflare, which processes standard server-log data such as your IP address to deliver and secure the site. These pages also load Cloudflare Web Analytics, which counts page views and where visitors came from. It sets no cookies, stores nothing in your browser and cannot recognise you between visits; we only ever see totals. We do not use website cookies for advertising or cross-site tracking.

Demo video. Our home page shows a short demo video that is hosted on YouTube. Nothing is loaded from YouTube until you press play, so simply visiting the page sends YouTube no data at all. If you do press play, YouTube (Google) receives your IP address and may store data on your device in order to play the video. We use YouTube’s privacy-enhanced (no-cookie) embed domain.

Launch waiting list (closed). Our website used to offer a launch waiting list: you could submit your email address to be told once, when dobudex became available. That form has been removed from our website. Any addresses we still hold are used for that one announcement and for nothing else, and the list is deleted once the announcement has been sent — or sooner on request. We relied on your consent, and you can withdraw it at any time by emailing support@dobudex.com, which removes you from the list. The list is held by Supabase, our hosting provider.

Changes to this policy

We may update this policy as the app evolves. We will post material changes here with a new "last updated" date and, where appropriate, notify you in the app before they take effect.

Contact

MulletIQ B.V., the Netherlands — support@dobudex.com