Privacy Policy

1. Who operates the service

Don’t Get Eaten by a Bear is operated by Emmanuel Adhoute, an individual based in Israel (“we”, “us”). This policy covers the iOS app, its report services, and this legal website. Contact us at support@dontgeteatenbyabear.com about privacy or support.

The app is offered only to invited testers aged 18 or older in Israel in this controlled TestFlight. This is not a worldwide public release. A tester’s country does not determine where service providers process information.

2. Information we process

Location and map activity

With your permission, the app uses your device’s location while in use. You can enter coordinates manually instead. The app can collect and transmit precise latitude and longitude. Coordinates may be precise even though the app requests approximately 100-metre accuracy. Apple’s map services provide the map. The visible map bounds are sent to Supabase to retrieve nearby sightings. When you submit a sighting or request a report, the selected latitude and longitude are sent to the backend and stored with that submission.

Sign-in information

Sign in with Apple is handled through Supabase authentication. Apple supplies an identity token and, when available, an email address and name; the app requests those details and can save your name in your Supabase account. Supabase maintains your account identifier and authentication session. The app stores its session through the Supabase SDK’s Keychain storage and refreshes it to keep you signed in. You can use Apple’s Hide My Email option when offered. This version does not offer Google or Rork sign-in.

Community wildlife sightings

A submitted sighting includes the animal name and identifier, coordinates, date and time, optional note, and your account identifier. Sighting details—including coordinates and notes—are available to other app users, including people browsing without signing in, and can be included in generated reports. The community read fields exclude your account identifier, name, and email, but coordinates and notes can still identify you or someone else. The backend adds nearby community observations to completed reports; it does not send these app submissions to Tavily for synthesis in this version. Do not put personal, confidential, or sensitive information in a sighting note.

Wildlife reports and email

A report request includes its identifier, selected coordinates, optional place name, search radius, recipient email if provided, and purchase-verification identifiers. Signed-in requests can be associated with your account; requests without sign-in use a report access token. Supabase stores request status, research results, generated report content, delivery status, and related identifiers. Reports and checklist progress are also saved on your device. If you request email delivery, the report and recipient address are sent to the email service.

Purchases and technical information

Apple handles payment. RevenueCat processes purchase information. When you sign in, the app sends your Supabase account identifier to RevenueCat to associate purchases with that account; signed-out use relies on a RevenueCat anonymous identifier. Purchase-verification identifiers are sent to the backend. A transaction-redemption ledger retains transaction identifiers, a report identifier, product information, and redemption time to prevent reuse of a purchase, including after account deletion. The app’s report service does not receive your full payment-card details. Service requests expose technical information such as IP addresses to the providers handling them. The backend uses IP addresses and identifiers for rate limits and records operational and error logs.

3. How information is used

Information is processed to sign you in, show nearby community sightings, publish sightings you submit, research and generate reports, deliver report emails, verify purchases, save and retrieve reports, and operate and protect the service. Location permission is optional; manual coordinates are available. Avoid submitting someone else’s personal information in notes, place names, or email fields without authorization.

4. Services that receive information

• Supabase: authentication, account and session information, database storage, and backend functions for sightings, reports, research-task records, purchase verification, account deletion, and access controls. App records use its database; this version does not upload photos or files to Supabase Storage buckets.
• Apple sign-in: identity verification and the information you authorize Apple to share. Apple may also receive a reauthorization and access-revocation request during account deletion.
• Apple Maps / MapKit: map presentation and related map requests.
• Apple App Store and RevenueCat: payment processing and purchase verification, including transaction information and the Supabase account identifier or RevenueCat anonymous identifier used for the purchase. RevenueCat also uses purchase history for its customer-history and purchase-analytics features. See RevenueCat’s data-use documentation.
• Tavily: web research and AI-generated report synthesis. Requests contain the selected location, place label, radius, date/season context, and an internal report identifier. The backend rounds numeric latitude and longitude to three decimal places in the research prompt, including the season context. Exact selected coordinates remain in backend report records. Rounding does not make the research request anonymous, and a supplied place label can be more specific. The app does not add your sign-in identity, recipient email, or community sighting notes to this research request. Place labels can contain identifying information, so avoid personal details. Tavily returns research sources and structured report content, which the backend checks and formats. No separate Rork AI writer or direct OpenAI, Anthropic, or Google model call is used by this version.
• Resend: report email delivery, including the recipient address, report email content with location information, and a report identifier used to prevent duplicate sending. Resend’s security documentation describes AI-based trust-and-safety screening of a small sample of emails on infrastructure operated by Resend through RunPod. It states that customer content is not used to train or fine-tune models and that normal Emails API delivery does not send content to Anthropic. This is a provider statement, not a service-wide no-training or zero-retention guarantee.
• GitHub Pages: hosting this legal website and handling ordinary web requests.

Tavily’s published privacy policy states that, unless a customer contract provides otherwise, portions of query data may be used to improve future responses and queries may be passed to third-party search indexes when needed. We have not verified a contract exception for this service; we do not promise zero retention or that research inputs cannot be used for service improvement.

The app uses Supabase for authentication and database/functions, Tavily for research and synthesis, Resend for report emails, and Apple and RevenueCat for purchases. RevenueCat receives an account identifier or anonymous purchase identifier and supports purchase analytics. The backend does not include the recipient email, Apple identity or appended community notes in its Tavily research prompt, but location and place labels can identify a person. Production Tavily query-reuse and Resend tracking settings and account-specific provider retention agreements have not been verified. Do not assume that queries or emails are never stored or used for documented provider purposes. No zero-retention or no-training assurance is given. Apple also provides TestFlight diagnostics and feedback as described above. The product has no advertising or sale of personal data as its stated policy; that is not a claim that providers collect no operational information.

External sources linked in reports and these documents operate their own websites. Following their links sends your browser to those services, where their policies apply.

Advertising and sale of personal data

Our product policy for this release is no advertising and no sale of personal data. Purchase analytics used to operate the service are described above. The settings for optional Resend email open/click tracking and Tavily query reuse have not been verified for the production credentials. We therefore do not claim that these features are disabled. This is not a claim that providers collect no operational information or never use data for any other documented purpose.

5. Storage, retention, and security

The app keeps saved reports and checklist state in its local documents storage; it keeps authentication and report access tokens in the Keychain and certain preferences in device settings storage. Server records are stored through Supabase. Recent, unshared sightings saved by older builds may be retried for upload after sign-in, subject to backend ownership checks. Previous Rork identities are not automatically migrated into new Supabase accounts; deleting a new account does not by itself erase records held under an older identity. Contact us about older account records.

The seven-day community sightings window limits what the app displays; it is not a promise to erase sightings after seven days. Removing a saved report from the device does not delete its server copy; an account-linked report can be downloaded again during account synchronization.

The agreed targets are 90 days from first completion or terminal failure for signed-in and guest reports, seven days for terminal research payloads and duplicated location, and 12 months from the sighting time for community sightings. These are not currently automatic deletion periods: no retention routine is installed or scheduled in the live service. The operator is responsible for a daily manual review of records due against these targets and for privacy/deletion requests. Cleanup requires the operator’s separate approval of the specific action; a review does not itself delete records. Records can remain beyond the targets while cleanup is awaiting approval or active work is being reconciled. No completed cleanup is asserted here. Account-linked deletion works as described below; guest server records require a separately verified support request. Account information remains until account deletion; no inactivity expiry is configured. Device copies remain until removed, including by successful account deletion on that device. Purchase-redemption records survive report and account deletion to prevent replay; no automatic ledger expiry is configured. No fixed expiry has been verified for provider-held logs, backups, email or research and purchase records. Deleting app records does not itself erase those provider copies.

Access controls and tokens are used to restrict account-linked and anonymous report access. No service or storage method can guarantee absolute security. Protect your device, email account, and sign-in credentials.

International processing

Our Supabase project’s primary region is Singapore. Supabase’s residency documentation explains that some operational processing can occur outside the selected region. Resend’s data-processing documentation states that email content and delivery logs are stored in the United States, regardless of the sending region. Your information may therefore be processed outside your country, where privacy laws may differ. Other providers and their subprocessors may also process information internationally.

The operator is based in Israel and the Supabase project uses the Singapore primary region. That region does not confine every provider operation to Singapore. Resend documents United States storage for emails and logs; RevenueCat describes United States hosting in its privacy policy. Apple, Tavily, GitHub and other provider operations may process information in other countries. No account-specific promise of regional confinement, universal deletion timing, or a particular international-transfer safeguard is made here. Participation is limited to the invited adult testing group in Israel; wider distribution requires a separate review.

6. Your choices and account deletion

• Location: change the app’s location permission in iOS Settings, or enter coordinates manually.
• Local reports: remove saved reports from the Profile screen. This removes the device copy and its local access token, not the server record.
• Account-linked data: in Profile, choose Delete account and confirm. The app requires sign-in and asks you to wait while reports are in progress. On successful completion, the backend removes your account-linked reports, related research tasks, and shared sightings, then deletes your Supabase authentication identity. The app signs you out and clears all saved reports and their access tokens on that device, including local guest reports. Database cleanup and identity removal are separate steps: deletion can be incomplete if a step fails. Follow the error message and retry; contact support if a report remains stuck in progress or deletion cannot finish.

Limits of in-app deletion: reports created without an account remain on the server even when their local copies and access tokens are cleared. Deletion does not remove the purchase-redemption ledger, RevenueCat or Apple purchase records, your Apple Account, older Rork identity records, previously delivered emails, or copies already included in other users’ reports. It does not send a deletion request to Tavily or Resend. Provider logs, backups, and other retention are subject to the retention details above. Apple sign-in revocation is attempted after reauthorization. If it cannot be completed, account deletion can still succeed and the app displays instructions to remove the app’s access under Settings → Apple Account → Sign in with Apple. Cancelling the Apple confirmation sheet stops the deletion attempt.

For anonymous server reports, retained authentication information, or other data requests, contact support@dontgeteatenbyabear.com. Describe the request and provide only the identifiers needed to locate the record; do not send passwords, authentication tokens, or payment-card details. We may need to verify your connection to the data.

Privacy rights

Your rights depend on the law that applies to you and to the processing. They may include access to information about your data and a copy of it, correction, deletion, restriction of processing, portability, objection to certain processing, and withdrawal of consent where processing relies on consent. Withdrawal does not change the lawfulness of earlier processing. You may also have a right to complain to the relevant privacy authority.

Where applicable, California law provides rights to know, correct and delete personal information, opt out of sale or sharing, limit specified uses of sensitive personal information, and exercise rights without unlawful discrimination. These rights are subject to statutory scope and exceptions; this limited beta does not make every jurisdiction’s rights apply identically to every request.

Send privacy requests to support@dontgeteatenbyabear.com. We may need to verify your identity or authority to act for someone else before disclosing or deleting information. In-app deletion has the scope described above; it does not replace other rights you may have under applicable law.

Use the published privacy/support email for requests concerning this beta, including guest reports or older identities. Include the type of request and non-secret report identifiers when available. Do not email passwords, session tokens, guest access tokens, full receipts or identity documents. Account deletion is available in Profile with the limits described above. Other access, correction, export and provider-side requests require individual handling and verification of the requester’s connection to the records; the app does not provide automated tools for all these requests. This notice does not set a voluntary response deadline or claim that all records can be erased; applicable legal deadlines and rights still apply. Rights and required responses depend on the circumstances and applicable law.

7. Children and eligibility

You must be at least 18 years old to use the service. It is intended for adults and is not offered to anyone under 18. Parental or guardian permission does not make someone under 18 eligible.

If you believe someone under 18 has provided personal information through the service, contact support@dontgeteatenbyabear.com. Do not send identity documents or other sensitive information unless a secure verification process has been arranged.

8. This legal website

These pages do not require sign-in and contain no forms, analytics scripts, advertising pixels, or app SDKs. The site itself does not set cookies or use browser storage. GitHub, as the hosting provider, can process request information such as IP addresses and browser details. See GitHub’s Privacy Statement.

9. Changes and contact

Updates to this policy will appear on this page with a revised effective date. Review it when deciding which features to use. For privacy questions, contact support@dontgeteatenbyabear.com.