WILDOT Privacy
WILDOT Privacy Policy
Effective: August 25, 2026 | Updated: August 25, 2026
This policy applies to the WILDOT iOS app provided by Beijing Yuanhuo Network Technology Co., Ltd. ("we", "us", or "our"). WILDOT lets users capture or import nature observations, review AI identification candidates, confirm them into a personal Catalog, and revisit a private map footprint. Please read this policy before using WILDOT.
1. Scope and age requirement
WILDOT's initial release is only for users who are at least 14 years old. On first entry, a user must expressly confirm that they are 14 years old or older before continuing. Children under 14 must not create an account, use WILDOT, or submit their personal information. If we learn that we collected personal information from a child under 14 by mistake, we will delete or anonymize it after verification as soon as reasonably possible.
2. Personal information we process
Account and identity information: the stable identifier returned by Sign in with Apple, name (if Apple provides it), Email Address or Apple's private relay address, email verification and private-email status, WILDOT account ID, and Apple's real-user security signal used for fraud prevention and account security. We do not receive an Apple ID password. Server-side session credentials are stored as digests or in encrypted form. Observation information: photos the user captures or selects, source method, observation time, species names entered or confirmed by the user, identification candidates and results, name revisions, and personal Catalog records. Location information: after permission, Precise and Coarse Location for an observation, including city and coarse grid. Operations and security information: identification job state, quota and cost-settlement state, request and receipt timestamps, and necessary security-audit and error information; we do not use this for advertising profiles or cross-app tracking.
3. Why and how we process information
We process the information above only to create and protect accounts; upload and sanitize private photos; generate AI identification candidates; save user-confirmed observations; display the Catalog and map; settle quotas; respond to deletion and rights requests; and keep the service secure and reliable. Before upload, photos are re-encoded and embedded EXIF, GPS, and similar metadata are removed. Any separately authorized observation location is handled as a separate field. AI results are reference candidates confirmed by the user and do not replace expert species identification, medical advice, or field-safety judgment.
4. Permissions and sensitive information
The camera is used only when the user chooses to take a photo. Photos are selected individually through the iOS system picker. WILDOT does not request continuous background location. Precise location and movement trails may be sensitive personal information. We process an observation's location only after the user selects the location feature and grants the separate iOS location permission, for private footprints, city assignment, identification-plausibility checks, and privacy-safe coarse display. Location is optional: refusing or withdrawing it does not block photo identification or saving. Permission can be withdrawn in iOS Settings at any time.
5. Service providers and recipients
Apple provides Sign in with Apple, token verification, and authorization revocation for account deletion, and receives the information required for that authentication. Alibaba Cloud provides Function Compute, database, and private object storage in Shanghai, China and processes account, session, observation, photo, and related operational data. Volcengine / Doubao processes a sanitized observation photo to return visual-identification candidates. A name-revision request sends only a normalized species name and city or regional text, not the original photo or precise coordinates. These providers act only to deliver necessary services under our instructions and their applicable terms. We do not sell personal information, provide it to advertisers or data brokers, or use advertising or tracking SDKs.
6. Processing region and international users
WILDOT's initial release uses a China-region backend. Account, photo, location, observation, and identification data is processed and stored through services in Shanghai, China, including for users located outside China. Sign in with Apple interacts with Apple's authentication infrastructure, whose processing locations are determined by Apple. Apart from that authentication interaction, we will not proactively migrate WILDOT business data to a new overseas region without completing applicable notice, assessment, or consent steps. If we add a data region, recipient, or cross-border path, we will first update this policy and provide any further notice or choice required by law.
7. Public sharing and automatic curation
Raw photos, the personal Catalog, and precise coordinates are private by default. A share card is generated only when the user initiates sharing and includes city-level or coarser location. Users can turn off “Publish new-species discoveries.” Even when enabled, only confirmed, trusted, non-sensitive observations that pass frequency and deduplication rules may enter automatic curation. Public content does not include precise coordinates, and sensitive-species locations are blurred, delayed, or hidden. Turning publication off does not delete private observations.
8. Retention
Account, private photo, observation, and Catalog data is generally kept until the user deletes the observation or account, or until it is no longer needed for the purpose described here. Access tokens normally last 15 minutes and refresh sessions normally last 30 days; they expire under the security flow after expiration, sign-out, revocation, or account deletion. A minimized completed account-deletion receipt is kept only to recover a lost response, for no more than 24 hours. Identification-cost, security, and operational records are kept for the shortest period needed for troubleshooting, settlement, replay protection, and legal obligations. Where a single period cannot be fixed in advance, we determine it using task completion, the end of a dispute window, backup replacement, and applicable legal requirements, then delete or anonymize the data. Providers apply necessary retention under contract and their applicable policies.
9. Your privacy rights
In the app, users can view their Catalog and observations, make a limited species-name revision, delete an observation, and use Profile to sign out, manage publication preferences, or initiate account deletion. Users may also contact us to request access, a copy, correction, supplementation, deletion, restriction, or an explanation of processing, and to withdraw consent-based processing. Withdrawal does not affect earlier lawful processing. After location permission is turned off, existing location can be removed by deleting the related observation or account. We verify the relationship between the requester and account and respond under applicable law without unreasonable conditions.
10. Delete Observation and Delete Account
Deleting one observation removes its associated private photo objects, database observation, and local record without affecting other observations. After the user chooses Delete Account in the app and confirms again, the service revokes available Apple authorization and deletes the account and associated photos, location, identification, sessions, and user-generated content. Cloud deletion may finish asynchronously so failures can be retried, and the app reports the result. If law requires retention or immediate deletion is technically unavailable, we stop all processing except storage and necessary security protection, then delete or anonymize the data when the condition ends. If Apple subscriptions are offered later, deleting a WILDOT account will not by itself cancel an Apple subscription; it must be managed in the App Store.
11. Security and incident response
We use controls including private object storage, encrypted transport, least-privilege service identities, token digests or encryption, photo-metadata removal, account-scoped access controls, idempotent deletion tasks, and monitoring. No internet service is absolutely secure. If an incident may affect personal rights, we will take remedial action, keep required records, and notify users and authorities where required by applicable law.
12. Policy changes and contact
If the purposes, data types, retention method, recipients, or cross-border arrangements materially change, we will update this page and, where required, provide a prominent in-app notice or obtain consent again. Beijing Yuanhuo Network Technology Co., Ltd. is the personal information handler and controller for this service. To exercise a right, submit a complaint, or ask a privacy question, contact:nemo.wangxx@gmail.com.