Privacy Policy

Last updated: 25 October 2026

Rock ID (the app is named Rock Identifier • Stone ID in the App Store) is an independent iPhone app published by Orkhan Alizada. It identifies rocks, minerals, crystals, gems and fossils from photos. This page explains what the app does with your data.

In short

Photos you identify

When you take or pick a photo and ask the app to identify it, the app shrinks the photo (longest side about 1280 pixels) and sends it over HTTPS to an identification service that I run on Cloudflare. That service passes the photo to the OpenAI API to get the result, and sends the result back to the app.

The service is built to read the photo, forward it and return the answer. It is not built to store the photo or the result. It keeps only a daily identification counter for each anonymous user ID, to apply the daily limit. As a host, Cloudflare handles the connection, including your IP address.

OpenAI processes the photo under its API terms. According to OpenAI's published documentation, data sent to its API is not used to train its models unless the customer opts in, and OpenAI keeps abuse monitoring logs, which can include inputs and outputs, for up to 30 days unless the law or the need to protect its services requires longer.

Photos are not sent to Firebase Analytics, Mixpanel or RevenueCat. The app asks for camera access only to take a photo, and for photo library access only when you choose a photo. You can change both in iOS Settings.

Anonymous sign-in and app check (Firebase)

The app signs in to Firebase Authentication anonymously. This creates a random user ID, with no name, email or password. The ID lets the identification service apply the daily limit, and it is also the ID RevenueCat and Mixpanel use (see below). The app also uses Firebase App Check, which relies on Apple's App Attest, so that the service only answers the genuine app. These services are provided by Google.

Usage analytics (Firebase Analytics and Mixpanel)

The app records events about how it is used, to see which screens work and where people stop. Events go to Firebase Analytics (Google), tied to the random Firebase user ID and a Firebase app instance ID, and to Mixpanel, tied to the same random ID. Our Mixpanel project is in Mixpanel's EU region, and the app sends events to Mixpanel's EU endpoint. The app tells Mixpanel not to use your IP address to work out your location. Free text such as error messages, search text and notes is not sent.

In summary, events cover: opening and closing the app; onboarding steps and your two onboarding answers (where you find rocks and what matters most, picked from fixed choices); the camera permission result; starting an identification and whether the photo came from the camera or the library; success or failure, how long it took, the rock name the app identified and its confidence score; viewing, saving, sharing and deleting results and collection items; opening the rock card, locked sections, lookalikes and the collecting rules links (the state you pick is not sent); logging a find (only whether size and weight were filled in and how it was found, never the place); opening the app from a link, with the link's screen and event name; opening tabs, guides and settings; viewing the paywall and its source; choosing, starting, completing, cancelling or failing a purchase, with the plan, price and currency; and opening the Terms and Privacy pages.

Events also carry basic details: app version and build, whether it is a test or a released build, iOS version, device model, whether you are subscribed and which plan, how many identifications you have done, days since install, whether you finished onboarding, how many bought identifications you have left and, for an Apple Ads install, the Apple Ads campaign, ad group and keyword IDs (see below). Photos, notes, places, names and email are never part of these events.

Purchases (RevenueCat and Apple)

Apple processes all payments. I never see your card or Apple ID details. RevenueCat checks and restores your subscription using the random user ID and your purchase history. It can also pass purchase events, such as a new subscription or a renewal, to Mixpanel under that same ID. The app also sends RevenueCat a few attributes: how many times the paywall was shown and where it was first and last shown, the Firebase app instance ID and the Mixpanel ID, and, for an Apple Ads install, the Apple Ads campaign, ad group and keyword IDs.

Find log and reminders

The find log (place, date, size, weight and how you found the rock) and your notes stay on your device. They are not sent to me or to any analytics service. The weekend reminder is a local notification scheduled on your device, only if you allow notifications.

Apple Ads attribution

If you installed the app after tapping an Apple Ads ad, the app reads Apple's attribution token (AdServices), passes it to RevenueCat and sends it to Apple to get back the numeric IDs of the campaign, ad group and keyword. The app adds these three IDs, the install date and whether you used the app before this version to the usage events sent to Mixpanel, and to your profile in RevenueCat. The token does not contain the advertising identifier (IDFA), reading it does not need your tracking permission, and the IDs identify an ad, not you.

No tracking across apps

The app does not track you. It does not link your data with data from other companies' apps and websites for advertising, does not share your data with data brokers, does not read the advertising identifier (IDFA) and shows no tracking prompt.

Data stored on your device

Your saved collection (photos, results, rock cards, notes), your find log, the state you pick for collecting rules, and small counters such as how many identifications you used are stored on your iPhone. The app does not upload them to my servers. Deleting the app removes this data from the device.

Collecting rules links

The "Can I collect here?" links open official websites run by others, with their own privacy practices.

Children

Rock ID is not directed at children under 13, and I do not knowingly collect data from them.

Retention and your requests

Because IDs are random and I cannot tell who you are from them, I may not be able to find the data that belongs to one device. If you want me to look for it or delete it, email me and I will do what I can. Data held by Google, Mixpanel, OpenAI, RevenueCat and Cloudflare is kept under their own policies. Some of these services process data outside your country.

Changes

If the app changes what it does with data, I will update this page and the date above.

Contact

Orkhan Alizada · orkhanalizada@hotmail.com