Privacy Policy

Last updated 16 August 2026

RockyDoo is made for children, so this policy is written to be read rather than survived. It describes exactly what the app does with information — including the parts that involve other companies.

RockyDoo is published by Md Asif Kabir ("we"), an individual developer. Contact: hello@rockydoo.com.

There are no accounts. We never ask for an email address, a password, a phone number, a birthday or a location. We cannot identify your child, and we hold nothing on a server that is tied to them.

What stays on the device

All of this is stored only on your iPhone or iPad, and we never receive it:

• Your child's first name, or whatever name you type
• The age range you pick (4–5, 6–8 or 9–12) and the colour theme
• Every photo taken or chosen in the app
• Every identification saved to the collection
• How many free scans are left

Because it lives on the device, it is included in your normal iPhone or iCloud backup — that backup is between you and Apple, and we have no access to it.

What leaves the device

Identifying a rock

When your child scans a rock, two things are sent to our identification service: the photo of the rock, and the age range so the answer is written at the right reading level.

The name is not sent. The identification is written with a placeholder where the name goes, and your device swaps the real name in after the answer arrives. This is deliberate: it means no personal information about your child is ever disclosed to an AI provider.

We do not store the photo. It is passed through to produce the answer and is not written to any database of ours.

Please point the camera at the rock rather than at your child. RockyDoo has no use for a photo of a person, and a photo of a rock tells nobody anything about who took it.

Related rocks

When the app shows "cousins" to hunt for, it asks Wikipedia for a short summary and a photograph of each one. Only the rock's name is sent — nothing about your child.

Proving the app is genuine

So that our identification service can't be abused by anyone who finds its address, each device proves it is a real Apple device running the real app, using Apple's App Attest. This produces a random cryptographic key that identifies the installation, not the person. It cannot be linked to you, your child or any other app.

Exactly who receives what

The amended Children's Online Privacy Protection Rule requires that recipients be named rather than described vaguely. These are all of them:

Company	What they receive	Why
Cloudflare, Inc.	The rock photo, the age range, the installation key, and the device's IP address	Hosts the service that forwards identification requests
OpenRouter, Inc.	The rock photo and the age range	Routes the request to the AI model
Anthropic PBC	The rock photo and the age range	The AI model that identifies the rock
Wikimedia Foundation	The name of a rock, and the device's IP address	Supplies the summaries and photos of related rocks
Apple Inc.	Purchase and subscription details	Processes all payments. We never see a card number

None of them receive your child's name. None of them are sent information for advertising, and none of them are permitted to use what they receive to build a profile of your child.

We do not allow the rock photos to be used to train AI models.

What we never do

• No advertising of any kind, and no ad networks
• No analytics, telemetry, crash reporting or usage tracking
• No third-party tracking SDKs — there are none in the app at all
• No selling or sharing of personal information, ever, to anyone
• No behavioural profiling, and no targeted content
• No social features, no chat, no user-generated content visible to others
• No links out of the app without a parental gate in front of them

Children's privacy

RockyDoo is designed for children and takes part in Apple's Kids Category, so it follows the stricter rules that come with that.

We do not knowingly collect personal information from a child. The name and age range you enter are treated as personal information and are therefore kept on the device and never transmitted — which is why RockyDoo does not need to ask for verifiable parental consent to share information with a third party: it doesn't share any.

Anything in the app that costs money, and any link that leaves the app, sits behind a parental gate that a young child cannot pass.

If you are a parent or guardian

You can review everything the app holds by opening it — that is all of it, on the device, in front of you. You can erase all of it with Grown-Ups → Delete all explorers and rocks, or by deleting the app.

If you would like us to confirm what we hold or to delete anything, email hello@rockydoo.com with "Privacy" in the subject. We will reply within 30 days. In practice the answer is usually "nothing, and here's why".

How long things are kept

On your device

Until you delete it. We never expire your child's collection.

Rock photos sent for identification

Not stored by us. They exist only for as long as it takes to produce an answer.

The installation key and its counter

Up to one year, then automatically deleted. It identifies an app installation, not a person.

A daily count of identifications per installation

48 hours. This exists to stop abuse of the service, nothing else.

Purchases

All purchases go through Apple's In-App Purchase system. We never see or handle payment details. Because purchases attach to your Apple Account rather than to an account with us, Restore Purchases and Family Sharing work without us storing a single record about you.

Changes to this policy

If this policy changes in a way that affects what leaves the device, we will update the date at the top and describe the change in the app's release notes. We will not start collecting something new and quietly reword this page.