What Underfoot knows, and what it doesn't

Who this app is for

Underfoot is a general-audience nature app for adults and families. A parent should set up and supervise a child's use. There is no public collector profile, messaging, or user-facing login. The app uses an anonymous Firebase account in the background to authorize requests.

Your collection

Your nickname, chosen collector's mark, collection photos, find dates, and field-activity progress are stored on your device. Underfoot does not send your nickname or collector's mark with identification requests. Device backups may include your local app data according to your Apple settings.

Photos & identification

After you agree in the app, a photo you choose for identification is sent through Underfoot's Firebase server to Google Gemini. The server uses an anonymous account ID to authorize the request and enforce usage limits. The request forwarded to Gemini includes the photo and identification instructions, without your nickname, location, or Firebase account ID.

Underfoot does not add submitted photos to a server photo library. The photo saved in your collection remains on your device. An identification retry sends the photo again. Optional wild-find illustrations and facts are generated from species names; that step does not upload your photo again.

Google processes requests under its Gemini API terms. Its abuse-monitoring policy describes retention of prompts, context, and responses for 55 days for safety and policy enforcement, including possible review of flagged content. Underfoot cannot delete those provider records through the app's local deletion control. Please submit photos of nature rather than people or private documents.

Service data

Firebase Authentication stores an anonymous account identifier. Firebase installation and app-attestation identifiers help deliver configuration and protect requests. Daily counts of identification and illustration requests are stored under the anonymous account ID to enforce usage limits. These identifiers are not names or email addresses, but they distinguish an account or installation.

Daily request counters are assigned an expiry three days after their last update. Automatic deletion is enabled for expired counters; deletion is asynchronous and typically occurs within 24 hours after expiry. This cleanup does not delete your local collection, photos, or purchases.

We also retain aggregate daily and minute-level operational statistics for photo identification: completed requests, successful server responses, errors, response time totals, and the number of anonymous accounts making these requests each day. An account is counted once per day using its existing short-lived request counter. Minute counts let us compare service activity with aggregate website traffic, without linking a website visitor to an app account. These totals contain no account identifiers, photos, species names, locations, or individual activity histories. They help us understand service use and reliability; they do not measure offline browsing or saved collections.

Our infrastructure and Firebase SDKs also process technical information such as app and OS versions, request metadata, and IP addresses for service operation, security, and diagnostics. Firebase uses unlinked technical diagnostics to understand SDK performance and adoption. See Firebase's privacy information for provider handling and retention.

When you save a wild find, its species names, group, count, and latest submission time may be added to an aggregate catalog queue so we can improve the shared guide. That record contains no collector nickname, photo, location, or account ID. Aggregate catalog counts may remain after you delete your local collection.

Reference-photo and species-information requests go to iNaturalist and its image hosts. Those services receive ordinary network request information, including your IP address; Underfoot does not attach your collector profile or saved photos. Apple handles purchases through the App Store; Underfoot reads subscription entitlement status and does not receive payment-card details.

Location

Location is optional, and Underfoot only asks for it to do two things: figure out which bugs are likely nearby, and suggest parks or trails worth exploring.

The location Underfoot uses is coarse and infrequent — roughly city or county grain, not a street address or a precise coordinate. The exact position of a device is never stored. A family can decline location access entirely and still use the full field guide; the app simply won't be able to tailor suggestions to the area.

Advertising & tracking

Underfoot has no advertising SDKs or cross-app tracking. We do not sell collector data or use it for targeted advertising. Operational request counts, aggregate catalog counts, and technical diagnostics are described above; they are not advertising profiles.

On our app-download webpage, we count page visits, automatic App Store redirect attempts, and visits that include a tap on an App Store button. Fixed campaign tags distinguish our Facebook ad link from other traffic. A random code exists only for the loaded page, so repeat taps count once; it is not saved in cookies or browser storage or linked to your app account. Our server keeps a hashed copy with the visit's day, source category and whether a redirect was attempted or the button was tapped. It expires after 24 hours using automatic asynchronous cleanup, typically within a further 24 hours. Daily and minute-level aggregate totals remain. Minute totals record when events reach our server, without keeping individual visitor histories. We do not send these events to Meta, store full referral URLs or Facebook click IDs in these statistics, or infer an installation or confirmed App Store opening from a redirect attempt or button tap. We honor browser Do Not Track and Global Privacy Control signals for this measurement. Our hosting provider still processes ordinary network metadata as described above.

Deleting your data

Settings → For grown-ups → Delete all data removes your local collection, saved photos, profile, pending captures, and field-activity progress. The app also requests deletion of its anonymous Firebase account when connected; that network request can fail if you are offline. A new anonymous account can be created when you use online features again. Local deletion does not erase Apple backups, App Store purchase records, aggregate catalog counts, or provider security logs. For help with server-side data or a failed account-deletion request, contact us below.

Contact

Questions about this policy, or about how Underfoot handles a specific piece of information? Reach out any time.