Privacy Policy

1.Data controller

The data controller is Jeremy Lasne, individual entrepreneur (entreprise individuelle), France. For any question relating to your data, contact: hello@kaught.app. Given the scale of processing, no Data Protection Officer is required; data requests are handled at the same address.

2.Data we collect

3.Purposes and legal bases

4.Identification by artificial intelligence

To identify the species, the photograph you take is transmitted to our AI provider, Google LLC (Gemini API, United States). Together with the photograph we send an approximate location (coarsened to roughly 11 km) to help identification. Google processes the image to return an identification and, under the paid-tier terms of that API, does not use your photographs or the results to train or improve its models; it retains them for a limited period only, solely to detect and prevent abuse. A compressed copy of each Capture is also saved to your private cloud space so your Collection can sync across your devices and be restored if you reinstall (see §7 and §9). We do not use your photographs for any other purpose without your separate consent (see Terms §7.3).

Until 11 August 2026 this identification was performed by Anthropic, PBC (United States) under equivalent terms. We may change AI provider again; this policy is updated when we do, and the provider in force is always the one named above.

5.Geolocation

Geolocation is optional and is only enabled with your consent (device system permission). You can disable it at any time in your device settings. When enabled, an approximate (coarsened) location is sent with your photo to the AI provider to aid identification (see §4) and is stored with the corresponding Capture.

The location kept with a Capture stays in your own Collection and in your private cloud space. It is never published and is never shown to another collector (see §6). Only the coarsened location described above ever leaves your device, and only to the AI provider, for identification.

6.Your Captures are not published

Nothing you capture is shown to anybody else. Your Captures — the photograph, the species and the location — are visible only to you, in your own Collection and on your own map. They are not sold, not shared with data brokers, and never used for advertising or to track you across other apps or websites.

Earlier versions of the Application included a community map: a pin for each Capture, and optionally your photograph, was published to a publicly readable part of our database. That feature was withdrawn on 5 August 2026, and the pins and public photograph copies it had published were deleted. The three settings that governed it — “Share my catch photos”, “New catches are private” and “Location precision” — were removed at the same time, because there is no longer anything for them to control.

7.Recipients and processors

Your data is accessible to the Publisher’s authorised staff and to the following providers (processors), acting on instruction and under a contract compliant with Article 28 GDPR:

Your Captures (photographs and Collection metadata) are stored in your private cloud space on Firebase (Google) to enable sync and restore, and each photograph is transmitted to our AI provider for identification. Product analytics and crash reporting in the mobile Application use PostHog, hosted in the European Union, and both can be switched off at any time (see §14). This website is not measured with PostHog: we rely on the aggregate reports our search engines and SEO tools produce from their own crawling, which set nothing on your device. The only exception is our store link at kaught.app, which counts taps anonymously and never identifies you (see §13). If you're a Creator Partner paid by bank transfer, your bank details are processed by our bank solely to send that payout. We do not sell your personal data.

8.Transfers outside the European Union

Some processors (notably Google — the Gemini API, to which your photos are sent for identification, and Firebase / Google Cloud — Resend, Convex, Apple and RevenueCat) are located in the United States. These transfers are governed by appropriate safeguards: the European Commission’s standard contractual clauses and/or adherence to the EU–U.S. Data Privacy Framework where applicable, together with additional measures. A copy of the safeguards can be requested at hello@kaught.app.

9.Retention periods

10.Security

We implement appropriate technical and organisational measures (encryption in transit, access control, per-user data isolation, logging). Sign-in is handled through Google or Apple, so we never see or store a password. As no system is infallible, we cannot guarantee absolute security.

11.Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw your consent at any time (without retroactive effect). You can exercise these rights at hello@kaught.app. You also have the right to lodge a complaint with the CNIL, the French data protection authority (cnil.fr). You can also delete your account at any time from within the app.

12.Minors

The Service is not intended for children under 15 without parental authorisation (see Terms §4.4). We do not knowingly collect data from minors in violation of applicable law. Participation in the Creator Partner Programme by a minor requires prior approval and co-signature by a parent or legal guardian (see Terms Part 3, §1.4).

13.Cookies and trackers

The mobile Application does not use web browsing cookies or advertising trackers, and we do not use your data for cross-context behavioural advertising. It does use PostHog (EU-hosted) for first-party product analytics and crash reporting — recording in-app events, technical crash reports and a randomly-generated device identifier to help us understand, fix and improve the Service (see §14) — together with the technical identifiers needed to operate (session, security, push token). You can switch both off at any time in the Application, object to this processing, or request more information at hello@kaught.app (see §11).

Our marketing website (www.kaught.app) sets no analytics cookies at all and loads no analytics script. It used to offer PostHog behind a consent banner; that was removed, along with the banner. How the site performs in search is now measured only by our search engines and SEO tools, from their own crawling of public pages — nothing is stored on your device and nothing identifies you.

Our store link (kaught.app) is the one exception, and it is deliberately small. When you open it, it records the tap — which store you were sent to, which platform you are on, and where the link was shared — and stores a single randomly-generated identifier in your browser's local storage so that opening the same link three times counts as one person rather than three. It is not a cookie, it is never sent anywhere else, no profile is built from it, and it cannot follow you to this website or into the Application. Clearing this site's data in your browser removes it.

14.Product analytics and crash reports in the Application

The mobile Application uses PostHog for product analytics and crash reporting. PostHog is hosted in the European Union (eu.i.posthog.com) and acts as our processor, on instruction and under a contract compliant with Article 28 GDPR (see §7).

What we record:

• which screens you open and which buttons you tap;
• the app version and build number, your operating system and device model, and a randomly-generated device identifier;
• once you sign in, these events are linked to your account identifier;
• the answers you give during onboarding — which habitats you explore, what brought you to Kaught, and where you heard about us — so we can understand which kinds of collectors get the most out of the app;
• that a Capture happened, including the species, its rarity, and whether a location was attached — but not the photograph and not the coordinates.

Analytics never receives your Capture photographs, your name, your email address, your search terms, or any location coordinates.

Crash reports. When the Application crashes, or a background task fails, we send PostHog a technical error report so we can find and fix the problem. It contains:

• the error type, its message and the stack trace (the list of code locations the error passed through);
• the app version and build number, your operating system and device model, and the same randomly-generated device identifier — so, once you are signed in, a crash report is linked to your account identifier like any other event.

Crash reports contain no photographs, no location coordinates and nothing you have typed. We collect crashes and errors only — we do not collect performance measurements such as launch times, frame rates or battery use.

This data is not used for advertising, is never sold, and is not combined with data from other companies' apps or websites. We do not use an advertising identifier and we do not track you across other apps.

You can switch analytics and crash reports off at any time in the Application: Settings → Privacy → “Share usage analytics”. The same switch covers both; turning it off stops collection immediately.

15.Changes to this policy

We may modify this Privacy Policy. In the event of a substantial change, you will be informed by appropriate means. The last-updated date appears at the top of this document.

16.Contact

For any question: hello@kaught.app.