Rockbud

Privacy Policy

Effective 15 October 2026 · Applies to the Rockbud iOS app and this website

The short version

  • No account, no sign-in, no ads, no tracking. We don't use analytics, advertising or tracking SDKs, and we never ask to track you across other apps. The app sends only anonymous counts (like "the plans screen was opened"), never linked to you.
  • Your collection is yours. Photos, notes and favourites in your collection are stored on your device and, if you're signed in to iCloud, sync between your devices through your own iCloud. We never see it.
  • Photos you scan are sent to identify them, then discarded by us. Our server passes each photo to an AI service to identify the rock and doesn't keep it.
  • We don't sell or share your data for advertising, and your photos are not used by us or our AI providers to train AI models.
  • Apple handles payments. We never see your name, email or card details.

1. Who we are

Rockbud is published by Little Finders Club ("we", "us"). We are responsible for the data described in this policy. You can reach us at support@littlefindersclub.com.

2. What happens when you scan a rock

Identifying a rock needs more computing power than a phone has, so each scan works like this:

  1. Rockbud resizes your photo and sends it over an encrypted (HTTPS) connection to our server, which runs on Cloudflare Workers.
  2. Our server forwards the photo to an AI provider: Google (the paid Gemini API). If one Gemini model is unavailable we retry with another Gemini model; your photo never goes to any other AI company.
  3. The AI provider returns the identification, our server sends it back to your phone, and the result is saved in your on-device collection.

Before your first scan, the app asks for your permission to send photos to our server and to these AI providers. If you say no, nothing is sent; you can still browse the app and your collection.

3. Data that leaves your device

WhatWhyWho receives itHow long it's kept
The photo you scan To identify the rock, crystal or mineral in it. Our server (Cloudflare), then Google. Our server doesn't store it; it's discarded once the result is returned. The AI provider may keep it for a limited time for safety and abuse monitoring (see section 5), then deletes it.
Your onboarding answers and language setting (for example "I collect crystals", "Total beginner", "en_US") So the explanation matches your interests, level and language. Same as the photo, as part of the same request. Same as the photo.
A random install ID Sent with each scan for basic abuse protection. It's a random code created by the app when it's installed, not your Apple ID, advertising ID or any hardware ID, and it isn't linked to your identity. Our server only. We don't pass it to the AI provider. Not stored by us when you're subscribed (see the next row). Deleting the app resets it.
Apple's signed proof of your subscription So only subscribers can run scans, and to apply the fair daily limit (40 scans a day). Apple signs it; it contains a transaction number and your plan, never your name, email or payment details. Our server only. We don't pass it to the AI provider. We keep only a daily scan count under the transaction number. It is deleted automatically 48 hours after your most recent scan.
The identification result (the text answer, never the photo) So scanning the exact same photo again gives the same answer instantly, without another AI call. Our server's cache (Cloudflare). Up to 30 days, stored under a one-way fingerprint (hash) of the photo. The photo itself can't be recovered from it.
Your IP address and basic connection data Any internet request reveals these. They're needed to deliver the response and protect the server. Cloudflare, which hosts our server. We don't forward them to the AI providers. We don't store them: request logging is switched off on our server. Cloudflare may process them briefly under its own security practices.
Anonymous app counts: that the app was installed, the plans screen was opened, a trial or subscription started, or purchases were restored, with the app's name, the plan's name and a test-version label; and, if you answer it, where you heard about the app (for example "TikTok") To count how many people see the plans and subscribe, so we can keep the app worth paying for. Our server (Cloudflare). Never your device ID, IP address, name, photos or answers: none of these is stored with a count. Up to 13 months.
Subscription updates from Apple: when a subscription starts, renews, is cancelled, expires or is refunded, with Apple's anonymous transaction number, the plan, its price, the dates and, if you told us, where you heard about the app (a label shared by everyone who gave that answer) So a refunded subscription stops working, and so we know how many subscribers stay. Apple sends these to us directly; they don't come from your phone and don't include your name or Apple ID. Apple, then our server (Cloudflare). Up to 3 years (accounting).

That is everything the app sends. We do not collect your name, email address, phone number, contacts, location, browsing history or advertising identifier.

4. Data that stays on your device

  • Your collection: the photos of your finds, their results, your notes and favourites. These are stored in the app on your iPhone and are never sent to us. Like most app data, they may be included in your own iPhone backups (iCloud Backup or your computer), which Apple or you control.
  • iCloud sync: if you're signed in to iCloud, your collection also syncs between your own devices through your private iCloud database, using Apple's CloudKit. That copy lives in your iCloud account, counts toward your iCloud storage and is protected by Apple; we can't see, read or access it. Apple's handling is covered by Apple's Privacy Policy. Sync only covers devices signed in to the same Apple Account; it doesn't share your collection with anyone else. To keep your collection on one device only, turn off Back up finds to iCloud in the app's Settings; that never deletes the finds on your phone.
  • Your onboarding answers and settings.
  • The trial reminder: if you start a free trial and allow notifications, the app schedules one local notification on your phone two days before the trial ends. It's created on your device; we don't use push notification servers and don't receive a notification token. (iCloud sync uses Apple's silent notifications to tell your other devices about changes; those go between Apple and your devices, not through us.)

Deleting Rockbud deletes your collection from that device. If iCloud sync was on, a copy stays in your iCloud until you delete it (see section 9). We can't recover your collection for you, because we never had a copy.

5. Our service providers

We use a small number of providers, only to run the app. None of them may use your data for advertising.

  • Google LLC (the Gemini API, on a paid plan) processes scan photos to produce identifications. Under the Gemini API terms for paid services, Google doesn't use prompts or responses to improve its products, and logs them for a limited period only to detect and prevent abuse and to comply with law. See the Gemini API Additional Terms of Service and Google's Privacy Policy.
  • Cloudflare, Inc. hosts our server (Cloudflare Workers) and this website. See Cloudflare's Privacy Policy.
  • Apple processes subscriptions and payments through the App Store. We receive no payment details or personal information from Apple: only confirmation, on your device, that your subscription is active, and the anonymous subscription updates described in section 3. Apple's handling is covered by Apple's Privacy Policy.

These providers may process data in the United States and other countries where they operate. Where the law requires it, these transfers rely on the providers' standard safeguards, such as the EU Standard Contractual Clauses in their data processing terms.

6. What we don't do

  • No accounts, logins, or profiles.
  • No ads, and no advertising or analytics SDKs.
  • No tracking across other companies' apps and websites, and no use of the advertising identifier (IDFA).
  • No selling or "sharing" of personal information, as those terms are defined in US state privacy laws.
  • No storing of your scan photos on our server, and no using them to train AI.
  • No location tracking. Location is used only if you turn on map pins: the app reads your location when you scan and saves it with that find in your collection (on your devices and, with iCloud sync, your own iCloud). It is never sent to us. "Where it forms" on a result card is general geology, not your location.

7. Children

Rockbud is a general-audience app. It is not directed at children under 13, and we do not knowingly collect personal information from children. Many families use Rockbud together; we recommend that a parent or guardian handles the subscription and scanning for younger children. Rockbud has no accounts, chat or social features, and the only data it sends is described in section 3. If you believe a child has sent us personal information (for example, by emailing support), contact us and we will delete it.

8. Legal bases (EEA, UK and Switzerland)

Where data protection law such as the GDPR applies, we process the data in section 3 to provide the service you asked for (performance of a contract), with your consent for sending photos to our AI providers (which you can withdraw at any time in the app's Settings), and for our legitimate interest in keeping the service secure and fair (rate limiting).

9. Your choices and rights

  • Don't want a photo analysed? Simply don't scan it. Nothing leaves your device until you take or choose a photo to identify.
  • Withdraw consent for AI processing at any time in the app's Settings. Scanning will stop until you allow it again.
  • Notifications: turn the trial reminder off in iPhone Settings › Notifications › Rockbud.
  • Delete your data: delete items in the app (with iCloud sync on, that removes them from your other devices too), or delete the app to remove your whole collection from that device and reset the install ID. To remove the iCloud copy, go to iPhone Settings › [your name] › iCloud › Manage Account Storage › Rockbud › Delete Data.
  • iCloud backup: turn off Back up finds to iCloud in the app's Settings, or iCloud for all apps in iPhone Settings › [your name] › iCloud.
  • Access, correction, deletion, objection and portability: depending on where you live, you may have these rights. Because we don't keep scan photos or have accounts, we usually hold no data that can be tied to you. If you have a request, email us and we'll respond within the time the law requires. You may also complain to your local data protection authority.

10. Security

All data the app sends travels over HTTPS. Our server holds no scan photos, and the AI provider keys are kept on the server, never in the app. No system is perfectly secure, but collecting as little as possible is the best protection we can offer.

11. This website

This site uses no cookies, analytics or third-party scripts. Our host, Cloudflare, processes basic request data (like your IP address) to deliver pages and protect against attacks.

12. Changes

If we change how Rockbud handles data, we'll update this page and the effective date above, and for significant changes we'll tell you in the app before the change applies.

13. Contact

Questions or requests: support@littlefindersclub.com
Little Finders Club