Privacy Policy

1. Data We Collect

When you create an account, we collect your name, email address, and a hashed password. When you upload images, we store the original files, generated thumbnails, and extracted metadata (EXIF data, timestamps). We also generate AI-based classifications (species, sex, movement direction) and fetch weather data for your camera locations.

2. How We Use Your Data

Your data is used exclusively to provide the Spoorcraft service: organizing trail camera images, generating wildlife classifications, tracking observation patterns, and building statistical insights. We do not sell your data or use it for advertising.

3. AI Processing

Images are processed by third-party AI services (currently Google Gemini) for classification. The specific AI providers may change; see the Sub-Processors section below for the current list. These services process your images via their API endpoints and do not use API data for model training. AI results are stored as editable suggestions that you can override.

4. Data Storage

All data — images, database records, and backups — is stored in the European Union (Frankfurt, Germany).

5. Gmail Integration

If you connect a Gmail account, we access only image attachments from messages matching your configured camera sender addresses. We never read, store, or send email content. You can disconnect Gmail at any time from your settings.

Two connection methods are offered: OAuth (legacy) and IMAP + Google App Password (recommended). For IMAP we hold a 16-character Google App Password that you generate yourself — it is not your real Gmail password and you can revoke it from your Google account at any time. We store this App Password encrypted at rest (AES-256-GCM) and use it only to read incoming messages with image attachments. On authentication failure we automatically clear the stored credentials and notify you.

6. Your Rights (GDPR)

You have the right to access and delete your data at any time. We provide an "Export My Data" feature in Settings to help you download your data, though we do not guarantee the completeness or format of exports. Use "Delete My Account" to request permanent deletion (30-day grace period). We record your consent at registration with timestamp and IP address.

7. Cookies and Analytics

We use only essential cookies for authentication (your session token). We also operate a self-hosted Umami analytics instance on our own EU-located server to measure which pages and features get used. Umami runs entirely on our infrastructure — no data is shared with third parties — and is configured so that we cannot identify individual users or follow them across other sites. There are no third-party tracking scripts, advertising pixels, or cross-site trackers anywhere on Spoorcraft.

8. Sub-Processors

We use the following third-party service providers (sub-processors) to operate the Spoorcraft service. Each provider is engaged under a data processing agreement and is only permitted to use your data to provide the service described.

• Digital Ocean — Cloud infrastructure (compute, database, object storage). Data location: Frankfurt, Germany (EU).
• Google Cloud (Gemini API) — AI image classification. Images are processed via the API and are not used for model training.
• Mollie — Payment processing. Handles subscription billing and payment data.
• Resend — Transactional email delivery. Sends account notifications, invitations, and password resets.
• Yr.no (Norwegian Meteorological Institute) — Weather forecast data. No personal data is shared; only geographic coordinates are sent.
• Open-Meteo — Historical weather data. No personal data is shared; only geographic coordinates and timestamps are sent.

9. Controller

See the Imprint for the operator's identity and contact details. For routine data-subject requests (access, rectification, deletion, portability), use the "Export My Data" or "Delete My Account" buttons in your account settings.