Privacy Policy
Your collection stays on your device unless you choose to back it up to your account. We never sell your data, and we never store your tooth photos.
Data Stored on Your Device
Profiles, find logs, tally counts, badges, report images, photos, preferences, saved locations and consent status are stored in your browser's localStorage and IndexedDB on this device. The optional Backup file you export contains this same data; treat it like the personal file it is.
Your Sharktoothify Account
Expert IDs, crews, reports and purchases use a Sharktoothify account. We keep: your email address, your name if you give one, a securely hashed password (or your Google account ID if you sign in with Google), your lookup balance, plan and purchase history, a short record of each lookup (time, how it was paid for, and the species returned), and whether you opted in to occasional email. Sign-in uses a secure, HttpOnly session cookie that exists only to keep you signed in. Accounts for Sharktoothify are separate from every other app we make.
Device Check
To keep the free lookup fair, the app sets a random identifier in a cookie on your device. We store only a one-way hash of it, together with which accounts have signed in on that device and when. If more than three accounts are used on one device, Expert IDs are turned off for that device. The identifier is not used for advertising and is deleted with your accounts.
Crews, Finds, Reports, Plans and Places
If you join or start a crew, the crew keeps the finds that are posted to it (count, species, place, notes, time, who posted and who decided), the guest hunter names the owner enters, and the decisions made on each find. Crew members see each other's display names. If you opt in to the public leaderboard, only your chosen nickname and your totals are shown. A report you make is stored as a snapshot on our server and opens for anyone who has its private link; comments on it show the name the commenter typed and a time, and we keep the commenter's account identifier if they were signed in, and a short-lived network address used only to limit abuse. Trip plans, checklists and notes you write in the planner stay on your device. A place you suggest is stored with your account identifier until a person reviews it; approved places show no information about you.
Data That Leaves Your Device (only when you use these features)
(1) Expert IDs: the tooth photos you choose (up to three), a place you type if you add one, and any observations you choose are sent over HTTPS to the Sharktoothify service and processed by our photo-analysis provider solely to produce your result. Photos are not stored on our servers. (2) Tides, weather, sun and planning: approximate coordinates or a ZIP code are sent to NOAA, the U.S. National Weather Service, and open geocoding services (Zippopotam; Nominatim, © OpenStreetMap contributors) to fetch conditions; sunrise and sunset are calculated on your device. (3) Purchases and plans: checkout and billing are handled entirely by Stripe under Stripe's own privacy policy; card details never touch Sharktoothify. Stripe tells us which pack or plan was paid for, its status and renewal dates so we can add lookups and remove ads. (4) Email: account emails (confirming your address, resetting your password, crew invitations you ask us to send, and notices about your crew) and, only if you opted in, occasional messages such as a free lookup after you've been away, are sent through Resend. Every marketing email has a one-click unsubscribe, and you can switch it off anytime in Settings. (5) Feedback: if you send a suggestion or issue report, its text, your email if you give it, and basic device information are emailed to the developer, and any screenshots or screen recording you attach are kept privately on our server for 90 days, so the developer can open them from a link in that email. (6) Content delivery: fonts are served from our own site, so no font provider receives your request. Map tiles, when you open the map, come from OpenFreeMap. (7) Sharing a party member: only if you choose to pass a member to their own account. The counts added to that member's tally (the number, a short note, the date and who added it) are stored on our server and shown to the two accounts on that link, using the first name or display name on each account and never an email address. The invite link works once and expires in 7 days. Either person can stop sharing at any time, and counts already on a phone stay on that phone. Photos, reports, lookups and your other profiles are never part of it. (8) Backup and sync (off until you turn it on): your party members' names and pictures, their tallies, and your identified finds (species, date, place, notes and a small copy of the photo) are stored in your account so they survive a lost phone and appear on every phone you sign in on. Full-size photos and report cards stay on the phone. Only your account can read it. You can turn it off or delete the whole backup in Settings. If you hand a member over to someone else's account, that member's records move to their account and are removed from yours. (9) Your device's maps and calendar: if you tap a map or calendar button, your coordinates or plan details are handed to that app or website.
Cookies, Ads & Analytics
We use first-party cookies to keep you signed in and for the device check described above. Unless you hold an active Sharktoothify Plus plan or a Vacation Pass, the app may show advertisements from Google AdSense, which may use cookies or similar technology to serve and measure ads as described in Google's policies (see how Google uses information from sites that use its services); visitors in the EEA, UK and Switzerland are asked for consent first. Ads are never shown inside a dialog or in the identification flow. We run no other advertising or profiling.
Children
Sharktoothify accounts are for people 13 and older, and we do not knowingly collect personal information from children under 13. A parent or guardian may add a child to their own crew as a "guest hunter" using only a first name or nickname they choose; guest hunters have no account, no public profile and no advertising personalization, and the parent can remove them at any time. Purchases require an adult (18+) or a parent or guardian.
Your Rights (including GDPR / CCPA)
Device data is in your control: view it in the app, export it via Settings → Backup, and erase it with Clear App Data or by clearing browser storage. For account data, sign in and use Settings → Account → Delete account to erase your account, balance, history and any backup in one step, or email us for a copy or a correction. We do not sell or share personal information as defined by the CCPA/CPRA, and we honor applicable GDPR rights of access, rectification, erasure, objection and portability.
Retention, International Transfers & Security
Device data persists until you delete it. Account data is kept while your account exists and deleted when you delete it; purchase records may also be kept by Stripe as required by law. Processing occurs in the United States. We protect data in transit with HTTPS, hash passwords, keep all API credentials server-side, never handle card numbers, and never store photo content. Report security concerns through Contact Us at the bottom of this page.
Changes & Contact
We will post any material changes here with a new effective date. Privacy questions and rights requests: use Contact Us at the bottom of this page (SharktoothifyUS).