Privacy Policy

WildDex is a gamified wildlife collection and biodiversity platform. We allow users to photograph real wild animals, identify species using AI, earn rarity points, and participate in a global leaderboard and community discovery feed.

Data Controller: WildDex Project, Philippines.

Privacy / DPO Contact: privacy@wilddex.app

2.1 Account Information

When you register, we collect:

• Username — your chosen display handle (alphanumeric, lowercase).
• Email address — used for account verification, password reset, and service communications.
• Password — stored as a one-way bcrypt hash (we never store plaintext passwords).
• Google Account data — if you sign in with Google, we receive your name, email, and profile picture from Google OAuth. We do not receive your Google password.

2.2 Wildlife Sighting Data

When you submit a sighting, we collect and store:

• Photographs — uploaded and stored via Cloudinary (image hosting service).
• GPS coordinates (latitude/longitude) — captured from your device to pin the sighting on the community wildlife map and to verify the sighting is not from a zoo or captive facility (anti-cheat geofencing).
• Species identification data — results from Google Cloud Vision API and on-device TensorFlow.js MobileNet model.
• Timestamp and rarity score.

2.3 Usage & Technical Data

We and our service providers automatically collect:

• Server access logs — IP address, browser type, pages visited, timestamps. Collected by our hosting provider (Vercel).
• Analytics — we use Vercel Analytics, a cookieless and privacy-first analytics product. It does not set cookies, does not fingerprint your device, and does not share individual user data. It only aggregates page view counts and performance metrics.
• Mapbox GL tile requests — when you view the Wildlife Map, your browser makes requests to Mapbox servers to load map tiles. Mapbox may log these requests per their own privacy policy.
• Session tokens — we store an authentication session token in your browser (cookie and/or localStorage) to keep you logged in.

2.4 Communications

If you provide your email in our newsletter form, we may send you product updates. We use Resend as our email delivery provider. You can unsubscribe at any time via the unsubscribe link in any email.

We use your personal information for the following purposes:

• Providing the service — account management, sighting processing, leaderboard ranking, community feed.
• Anti-cheat enforcement — GPS coordinates and perceptual hashing are used to detect and reject zoo/captive facility sightings and duplicate submissions.
• AI identification — photographs are sent to Google Cloud Vision API and processed by on-device TensorFlow models to classify species.
• Email communications — account verification, password reset, and (if subscribed) product updates.
• Platform safety and improvement — aggregated, anonymized usage analytics to improve the app.

Lawful basis (PH DPA / GDPR): Processing is based on (a) performance of the contract with you when you create an account; (b) your consent for optional communications; (c) legitimate interests in operating a fair, anti-cheat wildlife platform.

We do not sell your personal data. We share data only with the following service providers:

All providers are required to handle data in compliance with applicable privacy laws under data processing agreements.

WildDex uses browser storage to keep you signed in and deliver core features. See our full Cookie Policy for a detailed inventory.

• Authentication cookies — Better Auth session tokens keep you logged in. These are strictly necessary.
• localStorage — a legacy wilddex_token key stores your session token client-side for API requests. Cleared on logout.
• Vercel Analytics — cookieless. No cookies are set by our analytics provider.

WildDex requests GPS location permission from your device only when you submit a wildlife sighting. This is used to:

• Pin your sighting on the community wildlife map.
• Verify the sighting location is not within a zoo or captive facility (anti-cheat geofencing).

GPS coordinates are stored with each sighting and are visible to other users on the public wildlife map (shown as coordinates rounded to 4 decimal places). You can choose not to grant location permission, but sightings without GPS will not be eligible for leaderboard scoring.

We retain your data as follows:

• Account data — retained while your account is active. Upon deletion request, your account is removed within 30 days.
• Wildlife sightings and photos — retained with your account. Deleted when you delete a sighting or your account.
• Email communications — Resend logs are retained per Resend's data retention policy.
• Server access logs — retained per Vercel's log retention policy.

Under the Philippine Data Privacy Act of 2012 (RA 10173) and internationally recognised privacy standards, you have the following rights:

• Access — request a copy of personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure (“Right to be Forgotten”) — request deletion of your account and associated data.
• Restriction — request we limit processing of your data.
• Data Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw Consent — where processing is based on consent, you may withdraw at any time.

To exercise any right, email privacy@wilddex.app. We will respond within 15 working days.

You may also lodge a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.

WildDex is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact privacy@wilddex.app immediately and we will delete it.

We implement industry-standard technical and organisational measures to protect your personal data, including encrypted HTTPS connections (HSTS enforced), bcrypt password hashing, session token validation, CSRF protection, and access-controlled API routes. No transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this policy to reflect changes to our data practices or applicable law. We will notify you of material changes by updating the Effective Date above. Continued use of WildDex after a policy update constitutes acceptance.

For privacy questions or data requests:

• Email: privacy@wilddex.app
• Jurisdiction: Cauayan City, Isabela, Republic of the Philippines