GeoCrystal Privacy Policy

1. Data Controller

The data controller is Starlyware di Gianluca Grasso, Chieti (CH), Italy. For any privacy question or to exercise your rights, write to info@starlyware.com.

2. At a Glance

• You can browse the catalogue of minerals and places and use the geology tools without an account: in that case we do not ask for your name or email.
• The minerals you catalogue stay private. They appear in the community showcase only if you allow it and our team approves them.
• Your location is never sent to our servers: only the field notebook and the compass use it, on your phone.
• The field notebook stays on your phone only.
• The app is free and shows ads through Google AdMob. Personalized ads are shown only with your consent.
• We do not sell your data.
• You can delete your account and all the data linked to it at any time, in the app or by email (instructions).

3. Data We Process

3.1 Using the app without an account

The catalogue of minerals and places, the community showcase and the geology tools (compass-clinometer, Mohs scale, geologic time scale, rock cycle, earthquakes, field notebook) work without an account. The catalogue is downloaded and stored on your phone. Advertising and the statistics described in sections 3.9 and 3.10 still apply.

3.2 Account

If you create an account we process:

• your email address and password (the password is handled by Google Firebase Authentication and we never see it), or the data we receive from Google or Facebook if you sign in with one of them (name, email, profile photo);
• the name you choose and your profile photo, if you add one, which are visible to other signed-in users and in the showcase next to the minerals you publish;
• a unique account identifier (UID).

3.3 Catalogued minerals and community showcase

• Catalogued minerals: for each mineral we store the mineral you choose, up to 4 photos, the description and the locality you write, the date and the progressive number in your collection. Photos are resized and recompressed on your phone before upload: EXIF data, including any GPS position of the shot, is not uploaded.
• Moderation: every mineral you catalogue or edit is checked by our team, which can see it even if it is private, to prevent inappropriate content. The team can approve it, keep it private with a note or remove it, and may tell you the outcome by email.
• Showcase: if you tick "Show in the community showcase" and the team approves the mineral, its first photo, the mineral, the locality, your name and your profile photo become visible to all users of the app. You can withdraw your consent at any time: the mineral leaves the showcase immediately.

3.4 Other content you create

• Wishlist and explored places: the minerals you save and the places you mark as explored.
• Suggestions and rating: the messages you send to the team and the rating you give the app.

Your wishlist and explored places are not visible to other users.

3.5 Location and field notebook

• Field notebook: samples, notes, photos, measurements and GPS positions are stored only on your phone and are not sent to our servers. They are deleted if you uninstall the app. You can export them yourself (CSV or GPX) and share them with whoever you want.
• Compass-clinometer: your location is used only to calculate true north, on your phone.
• Earthquakes: the app downloads the public earthquake lists of the Italian National Institute of Geophysics and Volcanology (INGV) and of the U.S. Geological Survey (USGS), without sending your location or any account data.

You can refuse or withdraw the location permission at any time in the Android settings. The rest of the app keeps working.

3.6 Mineral identification

When you use "Identify a mineral", the photo you take or choose is resized on your phone and sent to our servers, which have it analyzed by Google's Gemini artificial intelligence model (Google Cloud Vertex AI). The photo is used only to answer your request and is not stored by us. Google processes it on our behalf as a cloud service provider. We only keep the number of identifications you use each day, to apply the daily limit, and an overall anonymous monthly count. To get extra identifications you can watch a rewarded ad (see section 3.9).

If you use "Report" on an answer, we receive the text of the answer, the reason you choose, the note you write (optional), the language of the app and your account identifier, so that we can check the answer and improve the service. The photo is not sent.

3.7 "Supporter" purchase and donations

The "Support the developer" purchase is handled entirely by Google Play: we never receive your card or payment method details. To verify the purchase and show the supporter recognition, we receive from Google Play the order ID, the date, the product and a purchase token, which we store in hashed form. We periodically check with Google Play whether a purchase has been refunded.

Earlier versions of the app linked to a PayPal donation page. Donations made on PayPal are processed by PayPal under its own privacy policy: we only receive what PayPal shares with the recipient of a payment.

3.8 External content

External links (for example "See more images" on Google, the position of a place on Google Maps, INGV earthquake pages, links shared through starlyware.com) open in your browser or in the related app. In these cases your device connects directly to those services, which receive your IP address under their own privacy policies. Catalogue photos taken from Wikimedia Commons show their author and licence.

3.9 Advertising

The app shows ads through Google AdMob, including rewarded ads that you can choose to watch to get extra identifications. AdMob collects your device's advertising ID, your IP address (from which it derives an approximate location), your interactions with the ads and diagnostic data, in order to show and measure ads and to prevent fraud. In the European Economic Area, the United Kingdom and Switzerland we ask for your consent through Google's consent form (UMP): without consent, only non-personalized ads are shown. You can change your choice at any time in Settings → Ad preferences, and you can reset or delete your advertising ID in the Android settings. More information: how Google uses information from partner apps.

3.10 Statistics, security and technical data

• Google Analytics for Firebase: aggregated statistics on how the app is used (screens opened, session length, device model, Android version, country or approximate area derived from the IP address), through an installation identifier.
• App updates: the app asks Google Play whether a new version is available.
• Server technical logs: IP address, date and time of requests and any errors, kept for security and troubleshooting.

4. Purposes and Legal Bases

• Performance of the service you request (Art. 6(1)(b)): account, cataloguing of minerals, wishlist, explored places, mineral identification and reports of its answers, purchase verification, replies to suggestions.
• Consent (Art. 6(1)(a)): publication in the community showcase, device location permission, personalized ads. You can withdraw it at any time.
• Legitimate interest (Art. 6(1)(f)): content moderation, security of the services and prevention of abuse, aggregated statistics to improve the app, non-personalized ads that allow us to offer the app for free. You can object by writing to info@starlyware.com.
• Legal obligations (Art. 6(1)(c)): tax obligations and requests from authorities.

5. Recipients and Service Providers

We do not sell or transfer your data. For the purposes above, your data may be processed by:

• Google (Google Ireland Ltd and Google LLC): Firebase (authentication, database, file storage, server functions, Analytics), Google Cloud Vertex AI, Google Play (payments, distribution and updates), Sign in with Google. Google acts as a processor on our behalf.
• Google AdMob, for advertising. For personalized ads Google acts as an independent controller.
• Meta Platforms Ireland Ltd, only if you sign in with Facebook, for authentication.
• Aruba S.p.A., which hosts the website and the management panel used by the controller to moderate and administer the app, and which sends the moderation emails.
• Other users of the app, only for the content you publish in the showcase and for your name and profile photo.
• Public authorities, only when required by law.

6. Where Your Data Is Stored

The GeoCrystal database, photo storage and server functions are located in the European Union (europe-west1 region, Belgium). Some Google services (for example Analytics, AdMob and the artificial intelligence model) and Meta may also process data outside the European Union, in particular in the United States. Such transfers are based on the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses approved by the European Commission.

7. Retention

• Account and content: as long as the account exists. When you delete your account we immediately delete your profile, profile photo, catalogued minerals with all their photos (also from the showcase), wishlist, explored places, suggestions, rating, identification counter and purchase data.
• Identification photos: not stored.
• Reports of identification answers: kept as long as needed to review them. When you delete your account, the link to your account is removed and the report stays without any identifier.
• Content removed by moderation: a copy may be kept in an archive that users cannot access, to handle disputes, for the period chosen at removal (from 30 days to 12 months, normally 90 days), and is then deleted automatically.
• Accounts suspended for violations: email, name, date and reason of the suspension may be kept after deletion, to prevent further abuse.
• Log of administrative operations: up to 24 months, for security and accountability.
• Internal moderation notes: kept as long as needed to protect the community and to handle disputes, and deleted when no longer needed.
• Server technical logs: normally 30 days.
• Analytics statistics: according to the retention period set in Google Analytics, at most 14 months.
• Google Play orders: kept by Google according to its legal obligations.
• Field notebook: only on your phone, until you delete it or uninstall the app.

8. Account Deletion and Your Choices

• Delete your account in the app from Profile → Settings → Delete account, or follow the account deletion instructions.
• You can delete single catalogued minerals, remove a mineral from the showcase by withdrawing your consent, remove minerals from your wishlist and places from your explored list, and change your profile name and photo, without deleting your account.
• You can withdraw the location permission in the Android settings.
• You can change your ad consent in Settings → Ad preferences.

The use of the app is also governed by the GeoCrystal Terms of Use.

9. Your Rights

Under Articles 15-22 of the GDPR you have the right to:

• access your data and receive a copy;
• ask for its rectification or erasure;
• ask for the restriction of processing or object to it;
• receive the data you provided in a structured format (portability);
• withdraw your consent at any time, without affecting processing already carried out;
• lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country.

To exercise your rights, write to info@starlyware.com from the email address of your account. We reply within one month.

10. Children

GeoCrystal is not intended for children under 14, who may create an account only with the consent of a parent or guardian. If you believe a child has given us data without consent, write to us and we will delete it.

11. Security

All communication between the app and the servers is encrypted (HTTPS/TLS). Access to data is protected by rules that let each user read only their own private data, and sensitive operations (moderation, publication in the showcase, identification, purchases, account deletion) are performed and verified only by the server. The management panel is accessible only to authorised staff.

12. Changes

We may update this policy for new features of the app or changes in the law. The date of the last update is shown at the top. In case of important changes we will let you know in advance, by email (if you have an account) and in the notes of the app update on Google Play.