Privacy Policy
Last updated: October 30, 2026
AI Rock ID (the “App”) is operated by Mindtastik (“we”, “us”, “our”), a company based in the European Union, which is the data controller. This policy explains what happens to your data when you use the AI Rock ID mobile app and the website airockid.com (together, the “Service”).
- You don’t need an account. We don’t ask for your name, email, phone number or location.
- To identify a rock, value it or answer a chat question, your photo or message is sent over an encrypted connection to our server and then to a third-party AI service provider. The App asks for your permission before the first time this happens.
- Your photos and chat messages are not stored on our servers. They are used only to give you an answer.
- Your collection, saved photos, history and chats stay on your device.
- No ads, no advertising tracking, no analytics or crash-reporting tools, and we never sell your data.
1. What we process and why
Photos you scan or value
When you identify or value a specimen, the App resizes the photo (to at most 1024 pixels) and sends it over HTTPS to our server at airockid.com. Our server forwards it to a third-party AI service provider to get the answer, then returns the result to the App. The photo is held in memory only while the request is processed. It is not written to disk, saved in a database or kept after the answer is returned.
If you choose to add details before a scan (where you found it, its size, your own guess, a country or region), these are sent together with the photo to improve the answer, and are not stored either.
AI chat messages
When you use the AI chat, your messages (and a photo, if you attach one or start the chat from a result) are sent the same way to get a reply. They are not stored on our server. Your conversation is kept on your device.
Encyclopedia profiles
When the AI identifies a specimen that isn’t in the App’s built-in encyclopedia, our server asks the AI to write a general profile for that specimen (for example “Granite”). We keep these general profiles so that they can be added to the encyclopedia. They contain only the specimen’s name and general information, never your photo or anything about you.
“Wrong? Correct it”
If you correct an identification, we receive: the name the AI gave and its other suggestions, its confidence, the name you chose, how you chose it (suggestion, search or typed), your guess if you entered one, the App language and the App version. No photo, no device identifier and no IP address are included. We use these to find and fix identification mistakes.
Security and fair use
To stop abuse and keep the free tier available, each request carries a random identifier that the App creates on your device (not linked to you, your Apple ID or your device’s advertising identifier). Our server uses it and your IP address only to verify that the request comes from the App and to count requests per hour. These counters are stored as one-way hashes and deleted automatically within about two hours. Like any website, our hosting provider may keep standard server logs (such as IP address and time of request) for a short period for security and reliability.
Subscriptions
Payments are handled by Apple. We never see your payment details. To know whether you have AI Rock ID PRO, the App uses RevenueCat, a subscription service. RevenueCat receives an anonymous app user ID, your purchase and subscription status, and basic device and App information (such as country, App version and OS version).
Usage counters
We record only aggregate usage counts on our server (for example how many AI requests were made and how many AI tokens they used), with no photo, message or personal data, to monitor costs and reliability.
On your device
Your collection, wishlist, scan history, saved photos, chat history, achievements, settings and free-use counters are stored only on your device. They are not uploaded to us. Deleting the App deletes them.
Notifications
If you allow notifications, the App schedules reminders locally on your device. We don’t run a push server and don’t receive a push token.
Camera and photo library
The camera is used only when you take a photo to scan. When you pick from your library, iOS shows its own photo picker and the App receives only the photos you select.
Sharing
When you share a card or invite a friend, the App opens the iOS share sheet. You choose what is shared and with whom. Share cards contain a link and a QR code to airockid.com.
2. Who we share data with
We share data only with the providers below, only for the purpose described, and they are bound by their own terms to protect it at least as well as this policy does.
| Provider | What it receives | Why |
|---|---|---|
| AI service providers (a main provider and a backup used only if the main one is unavailable) | Your photo, optional scan details, chat messages | To identify specimens, estimate value and answer chat questions |
| RevenueCat | Anonymous app user ID, subscription status, basic device and App info | Managing your subscription |
| Apple | Payment and subscription data | In-app purchases (under Apple’s own privacy policy) |
| Our hosting provider | Requests passing through our server, standard server logs | Running the Service |
We use these AI providers under business (API) terms that do not allow them to use the photos and messages we send to train their AI models. They may keep them for a limited time solely to detect and prevent abuse, as described in their terms. You can ask us at the address below which providers we currently use. We may also disclose information if required by law.
We do not sell or rent your data, we do not share it with advertisers or data brokers, and the App does not track you across other companies’ apps or websites.
3. Your choice: AI processing
Before the first photo or message is sent to an AI provider, the App explains this and asks for your permission. If you don’t agree, nothing is sent; you can still browse the encyclopedia, guides and your collection. You can change your choice at any time in Settings → AI processing. Turning it off stops all future sending; identification, valuation and AI chat then require you to turn it back on.
4. How long we keep data
- Photos, scan details and chat messages: not kept on our server after the answer is returned.
- Request counters: deleted automatically within about two hours.
- Corrections and general encyclopedia profiles: kept to improve identification. They contain no personal data.
- Aggregate usage counts: kept for cost and reliability monitoring.
- Emails you send us: kept as long as needed to answer you and for a reasonable period afterwards.
- Data on your device: kept until you delete it or the App.
5. Your rights
Depending on where you live (for example under the GDPR in the EEA and UK, or the CCPA/CPRA in California), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. Because the App has no accounts and we don’t store your photos or messages, we generally hold no data that can be linked to you. To exercise any right or ask a question, email hello@mindtastik.com; we will answer within 30 days. You can also withdraw consent for AI processing in Settings, and delete everything stored on your device by deleting the App. You may also lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you live or work.
Where the GDPR applies, we rely on your consent to send photos and messages to AI providers, on the performance of our service to you for identification and subscriptions, and on our legitimate interest in security, fair use and improving identification.
6. International processing
We are based in the EU. Our server and our providers may process data outside the European Economic Area, including in the United States. Such transfers rely on appropriate safeguards, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
7. Security
All data is sent over encrypted connections (HTTPS/TLS). Requests to our server are signed by the App and rate-limited, and our private files are not publicly accessible. No system is perfectly secure, but we take reasonable measures to protect your data.
8. Children
The Service is not directed to children under 13, and we don’t knowingly collect personal information from them. If you believe a child has sent us personal information, contact us and we will delete it.
9. Website
airockid.com does not use analytics, advertising or tracking cookies. Our hosting provider may keep standard server logs as described above.
10. Changes
We may update this policy. We will post the new version on this page with a new “Last updated” date and, for significant changes, tell you in the App.
11. Contact
Mindtastik · hello@mindtastik.com