Privacy Policy

1. Data We Collect

When you create an account, we collect your name, email address, and a hashed password. When you upload images, we store the original files, generated thumbnails, and extracted metadata (EXIF data, timestamps). We also generate AI-based classifications (species, sex, movement direction) and fetch weather data for your camera locations.

2. How We Use Your Data

Your data is used exclusively to provide the Spoorcraft service: organizing trail camera images, generating wildlife classifications, tracking observation patterns, and building statistical insights. We do not sell your data or use it for advertising.

3. AI Processing

Images are processed by third-party AI services (currently Google Gemini) for classification. The specific AI providers may change; see the Sub-Processors section below for the current list. These services process your images via their API endpoints and do not use API data for model training. AI results are stored as editable suggestions that you can override.

4. Data Storage

All data — images, database records, and backups — is stored in the European Union (Frankfurt, Germany).

5. Gmail Integration

If you connect a Gmail account, we read image attachments from messages that match your configured camera sender addresses, and we add and remove a Spoorcraft label on those messages to keep track of what has been processed. Managing that label is why Google asks you to grant permission to modify your mailbox. We never send email, delete messages, or read mail that does not match your cameras, and we do not store email content. You can disconnect Gmail at any time from your settings.

Two connection methods are offered: OAuth (legacy) and IMAP + Google App Password (recommended). For IMAP we hold a 16-character Google App Password that you generate yourself — it is not your real Gmail password and you can revoke it from your Google account at any time. We store this App Password encrypted at rest (AES-256-GCM) and use it only to read incoming messages with image attachments and to mark those messages as read once processed. If authentication fails five times in a row — which almost always means the App Password was revoked — we clear the stored password, keep your address so that reconnecting needs only a new App Password, and notify you.

6. Your Rights (GDPR)

You have the right to access and delete your data at any time. We provide an "Export My Data" feature in Settings to help you download your data, though we do not guarantee the completeness or format of exports. Use "Delete My Account" to request deletion, either with a 30-day grace period or immediately. We keep your data for as long as you hold an account; if your trial or subscription has ended and you have not used Spoorcraft for six months, we warn you twice by email and then delete the account. We record your consent at registration with timestamp and IP address.

7. Cookies and Analytics

We use only essential cookies for authentication (your session token). We also operate a self-hosted Umami analytics instance on our own EU-located server to measure which pages and features get used. Umami runs entirely on our infrastructure — no data is shared with third parties — and is configured so that we cannot identify individual users or follow them across other sites. There are no third-party tracking scripts, advertising pixels, or cross-site trackers anywhere on Spoorcraft.

8. Sub-Processors and Independent Controllers

We use the following third-party service providers to operate the Spoorcraft service. Each sub-processor is engaged under a data processing agreement and is only permitted to use your data to provide the service described. Link (Stripe), which handles paid subscriptions as merchant of record, is not our sub-processor: it acts as an independent controller of the payment data it collects, under its own privacy policy (link.com/privacy).

• Digital Ocean — Cloud infrastructure (compute, database, object storage). Data location: Frankfurt, Germany (EU).
• Google Cloud (Gemini API) — AI image classification. Images are processed via the API and are not used for model training.
• Stripe (Stripe Payments Europe, Limited, Ireland; and its affiliate Sold through Link, LLC, United States, as merchant of record) — Payment processing and checkout. Stripe Payments Europe, Limited processes the payment. Sold through Link, LLC (“Link”) is the merchant of record for the subscription it sells and an independent controller (not our processor) of the payment and order data it collects, under its own privacy policy (link.com/privacy). Your card or bank details go to Stripe and Link, never to us; we receive the payment status and the references we need to manage your subscription. Stripe’s affiliates, including Sold through Link, LLC, are listed at stripe.com/legal/service-providers. Stripe may transfer this data to Stripe, LLC in the United States; for those transfers Stripe relies primarily on the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework), with the EU Standard Contractual Clauses (controller to controller) as the fallback.
• Resend — Transactional email delivery. Sends account notifications, invitations, and password resets.
• Yr.no (Norwegian Meteorological Institute) — Weather forecast data. No personal data is shared; only geographic coordinates are sent.
• Open-Meteo — Historical weather data. No personal data is shared; only geographic coordinates and timestamps are sent.

9. Controller

See the Imprint for the operator's identity and contact details. For routine data-subject requests (access, rectification, deletion, portability), use the "Export My Data" or "Delete My Account" buttons in your account settings.