Legal

Privacy Policy

Last updated: 22 July 2026

Protecting your personal data matters to us. ANILEX is built to use as little data as possible: there is no user account, and your collection, your photos and your location data stay on your device. Data is transferred to third parties mainly for two purposes: for AI-assisted species recognition (section 4) and for the advertising that funds the free version (section 11). Below we explain which data is processed when you use the app and what rights you have.

1.Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

If you have questions about data protection or wish to exercise your rights, you can contact the address above at any time. There is no legal obligation to appoint a data protection officer, and none has been appointed.

2.Basic principle: no account, largely local

ANILEX requires no user account, no login and no registration. You can use the app without telling us your name, e-mail address or a password.

The nickname you enter during onboarding is stored exclusively locally on your device. No server account and no user profile is created with us. The nickname serves solely to address you personally within the app on your device.

Personal data leaves your device only in the cases described in section 4 (species recognition), section 11 (advertising) and section 12 (in-app purchases). Species recognition does not transmit your name, your location or any identifiers.

3.Data stored locally on your device

Your progress and your settings are stored locally in the device storage (via the operating system storage “AsyncStorage”) and in the app’s own documents folder. This includes in particular:

• nickname and selected avatar
• your catches (recognized species) including the locally stored coordinates of the places where you found them
• your expeditions – the recorded route is kept as a list of points on your device
• experience points (XP), streaks, achievements and titles
• quiz progress
• app settings (e.g. language, notifications)

This data resides exclusively on your device. We have no access to it. The legal basis for the local storage is Art. 6(1)(b) GDPR (provision of the app functions you requested).

4.Species recognition from a photo

The central function of the app is the AI-assisted recognition of the animal species in a photo you have taken. This process works as follows:

• When you photograph an animal, a downscaled copy of the photo (scaled down to 768 pixels wide and compressed as a JPEG) is sent to our own server function. It is operated at Supabase Inc.; the server location is in the EU (Frankfurt, AWS region eu-central-1).
• Our server function forwards the image to the AI interface Google Gemini API (provider: Google Ireland Ltd., Ireland, or Google LLC, USA) purely for species recognition.
• The image is used only temporarily for processing and is not stored permanently on our servers.
• The only things transmitted are the downscaled image, the file type and your language setting (“de” or “en”). No name, no location and no device or user identifier is transmitted.

The legal basis for this processing is Art. 6(1)(b) GDPR (provision of the core function of the app that you requested) and, in the alternative, Art. 6(1)(f) GDPR (our legitimate interest in providing a working, reliable species recognition). Depending on the subject, the transmitted photo may contain personal data; we therefore recommend that you do not photograph other people.

Further information on the data processing by our service providers can be found in their privacy notices:

• Supabase: supabase.com/privacy
• Google: policies.google.com/privacy

5.Data transfers to the USA (Google)

As part of the species recognition described in section 4, the downscaled photo may also be processed by Google outside the European Union, in particular in the USA. Under data protection law, the USA is regarded as a third country without a generally equivalent level of data protection.

Appropriate safeguards within the meaning of Art. 44 et seq. GDPR are in place for this transfer: Google is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission), and in addition the Standard Contractual Clauses (SCC) adopted by the EU Commission apply. Despite these safeguards, it cannot be entirely ruled out that US authorities may access transmitted data. Since we deliberately transmit neither name, location nor identifiers, the transfer is limited to the downscaled image.

6.Photos and stickers stay local

The original photo and the photo sticker created from it are stored exclusively in the local app storage of your device. There is no upload to a cloud photo gallery and no synchronization with our servers or those of third parties. The only image that leaves your device is the downscaled copy used for species recognition (section 4).

Cutting the animal out of the background happens directly on your device, using the image analysis functions of the operating system (Apple Vision, from iOS 17). No data is transmitted to us or to third parties in the process.

7.Location data (optional)

Only if you expressly allow it does the app use your location, and only while the app is open (“when in use”); there is no background tracking. It is used for three things:

• to record and name the place where you found an animal and to show your catches on a personal map (a coarse position is enough for this);
• to measure the route and distance of an expedition while the expedition screen is open. This uses a more precise position and is stored as a list of points on your device.

Converting the coordinates into a place name is done via the system service of the operating system (Apple).

Location data is stored only locally on your device and is not transmitted to our servers and not to Google. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time in your device settings. The app also works without location access – the map view of your finds and the expedition distance are then unavailable.

8.Device permissions

The app requests only those permissions that are necessary for the respective function:

• Camera: for photographing (“catching”) an animal.
• Photo library: only for the optional export of a catch to the Photos app on your device.
• Location: optional, see section 7.

You can grant or withdraw each of these permissions at any time in your device settings.

9.Notifications

If you enable notifications, these are exclusively local reminders generated on your device. No push server is used, and no push token is collected or transmitted to us.

10.Species catalog from the server

On startup, the app loads the public species list (the species catalog) from our server (Supabase, server location EU). No personal data is transmitted in the process; this is purely a retrieval of public catalog data. Technically, the server must process your IP address in order to deliver the response. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technical provision of the app content).

11.Advertising (Google AdMob)

ANILEX can be used free of charge, and the free version is funded by advertising – it is not ad-free. We use Google AdMob as our advertising network. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; depending on your location, the processing may also be carried out by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Two ad formats are shown:

• Full-screen ads (interstitial): these appear automatically after you have caught a certain number of animals.
• Rewarded video ads (rewarded): these start only if you expressly select them yourself, and in return they unlock additional catches for the current week.

If you have made one of the purchases described in section 12 (“Anilex GOLD”), no ads are shown to you. In that case, Google’s advertising SDK is not even started when the app launches; no ads are then requested and no data is transmitted to Google.

Which data is processed

For the delivery, fraud prevention and billing of the ads, Google processes, according to its own information, in particular:

• device and advertising identifiers – on iOS in particular the advertising identifier (“IDFA”), if you have allowed it, as well as identifiers assigned by Google itself;
• your IP address and the approximate location information derived from it (usually at country, region or city level). The GPS coordinates collected by the app (section 7) are not transmitted to Google;
• technical information about the device, operating system, language setting and app version;
• your interaction with the ads – whether an ad was delivered and seen, whether you tapped it and whether a rewarded video ad was watched to the end.

We ourselves do not receive this information in personally identifiable form, but only aggregated reports from Google (such as the number of ads delivered and the revenue generated from them). Google selects the ad content; we have no direct influence on it. In the app, the ad content is restricted to the “G” content rating (suitable for all ages), matching the app’s own age rating.

Consent dialog and App Tracking Transparency (ATT)

Before any ad is loaded, the app asks for your decision in two steps, in this order:

• 1. Consent dialog: the app shows you Google’s consent dialog (the “User Messaging Platform”, UMP), in which the purposes are named and which you can decline. It appears where the law requires it – in particular in the EU, the EEA and the UK – and only until you have answered it.
• 2. ATT prompt: after that, the app displays the App Tracking Transparency prompt required by Apple on iOS. There you decide whether ANILEX may track your activity across other companies’ apps and websites.

Only then is the advertising SDK started. The result of the two decisions:

• If you agree: Google may use your device’s advertising identifier and show you personalized advertising. In doing so, Google can combine data from various apps and websites and use it to build interest profiles for advertising purposes.
• If you decline or do not respond: the advertising identifier is not made available. You will then see non-personalized advertising, which is based essentially on the current context. In this case, too, technical data such as IP address, device data and ad interactions is processed for delivery, fraud prevention and billing – delivering ads entirely without data processing is technically impossible.

Declining does not switch off advertising; it affects only the personalization of the ads. Ads are switched off only by an “Anilex GOLD” purchase (section 12).

Legal bases

• Personalized advertising as well as the storing of information on your device and access to it for this purpose: your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act), which you give in the consent dialog and in the ATT prompt.
• Non-personalized advertising as well as the technical delivery, ad-level measurement, fraud prevention and billing: our legitimate interest in funding the app provided free of charge pursuant to Art. 6(1)(f) GDPR.

Withdrawal and choices

You can withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected. You have the following options:

• In the app: open Settings in ANILEX and tap Change ad settings. This reopens Google’s consent dialog, where you can change or withdraw your decision. The entry is shown whenever Google requires such an option for you; if you have GOLD, no ads are loaded anyway and the entry is therefore not shown.
• Change the permission for ANILEX: iOS Settings → Privacy & Security → Tracking → toggle next to “Anilex”. If you switch it off, you will only see non-personalized advertising.
• Prevent tracking for all apps: in the same menu via the option “Allow Apps to Request to Track”.
• Adjust your ad settings at Google: adssettings.google.com.
• Object to the processing based on Art. 6(1)(f) GDPR pursuant to Art. 21 GDPR – see section 15.
• Switch off advertising completely: with one of the purchases described in section 12, no more ads will be shown to you.

Details of the processing by Google can be found in Google’s privacy policy and in the information on advertising at Google. Section 5 applies accordingly to processing outside the European Union.

12.In-app purchases (Anilex GOLD)

In the app you can optionally purchase paid additional features under the name “Anilex GOLD”: two auto-renewing subscriptions (one week and six months) and a one-time purchase. The contractual details are governed by our Terms of Use.

The purchase and the entire payment processing run exclusively through Apple (App Store / StoreKit). The following applies:

• We receive no payment data – neither your name nor your address, your Apple ID or your bank and credit card details.
• Apple processes the payment and customer data as a controller in its own right under its own privacy policy. We have no influence on this.
• From Apple we receive only aggregated sales and billing statistics that do not allow any conclusions to be drawn about individual persons.
• The app asks Apple only whether a valid purchase exists – including when you use “Restore purchases”. The result, a simple yes or no, is stored only locally on your device. No account and no purchase profile is created with us, and no purchase data is transmitted to our servers.

The legal basis for querying the purchase status and unlocking the purchased features is Art. 6(1)(b) GDPR (performance of the contract for the paid features).

Apple’s privacy policy is available at apple.com/legal/privacy.

13.No analytics of our own, no sale of data

Beyond the advertising described in section 11, we use no analytics, statistics or crash reporting SDKs of our own. We do not measure which screens you open, how long you play or which animals you catch – that information stays on your device (section 3).

We do not sell data, do not pass on personal data to third parties for our own advertising purposes and do not build user profiles. Cross-app and cross-website tracking by our advertising partner Google takes place only if you have consented to it in the consent dialog and the ATT prompt (section 11).

14.Storage period and deletion

The downscaled images transmitted for species recognition are used only for the duration of the processing and are not stored permanently by us (see section 4).

All other data (progress, catches, photos, location information, settings) resides locally on your device and remains there until you delete it. You can remove this data yourself at any time by deleting individual catches in the app or by uninstalling the app completely. Uninstalling the app removes the locally stored data from your device.

We have no influence on the storage period of the data arising from the delivery of advertising (section 11) and from purchases (section 12); it is governed by the rules of Google and Apple respectively. Both companies are also legally obliged to retain certain billing data.

15.Your rights as a data subject

Under the GDPR you have in particular the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Objection to the processing (Art. 21 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Please note: because we do not maintain a user account and the vast majority of your data resides exclusively locally on your device, we generally have no access to this data and, lacking any means of attribution, cannot assign it to you or hand it over directly. For the local data you effectively exercise these rights yourself – by viewing, changing or deleting data in the app or by uninstalling it. For questions about the processing described in sections 4, 5, 10, 11 and 12, please contact the address given in section 1. Insofar as your request concerns data that Google (section 11) or Apple (section 12) processes under its own responsibility, please address it directly to those companies.

16.Right to lodge a complaint with a supervisory authority

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). The competent authorities include the supervisory authority at our place of business:

You may also contact the supervisory authority of your habitual residence or place of work.

17.Children and families

ANILEX is designed to be family-friendly and works without a user account. However, the free version contains advertising (section 11) and offers paid in-app purchases (section 12). We therefore ask parents and guardians to accompany children when they use the app.

Consent to personalized advertising is valid only if it is given by a person capable of consenting; in the case of children, the consent of the guardians is required (Art. 8 GDPR). If children use the app, we recommend declining both the consent dialog and the ATT prompt, or preventing tracking entirely in the device settings (see section 11).

In-app purchases can be blocked in the iOS settings under Screen Time → Content & Privacy Restrictions, or made subject to approval by the guardians via Family Sharing with “Ask to Buy”.

Please also point children to the safety and nature conservation notes for taking photos outdoors. Since a photo is transmitted for species recognition (see section 4), children should be told not to photograph other people.

18.Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always meets the current legal requirements or to reflect changes to our features. The version in force at the time then applies to your renewed visit or continued use of the app. You can identify the version by the date at the top of this page.

---

If you have questions about data protection, you can reach us at gurillaztv@googlemail.com.