Privacy Notice

Last updated: July 8, 2026

This Privacy Notice explains how Emyrrhs ("we", "us") collects, uses, and shares personal data when you use our Service. We act as the data controller of your personal data.

1. What We Collect

Account data: email address, display name, avatar URL, and login credentials.
Content you upload: photos of nature you submit for AI identification, plus any notes or journal entries.
Service data: badges earned, tiers reached, star balances, mini town customizations, friend connections, and messages.
Technical data: IP address, device and browser identifiers, timestamps, and usage/telemetry.
Support data: messages you send us and their contents.

2. How We Use Your Data

Provide, operate, and improve the Service (contract performance).
Run AI species identification on photos you upload.
Prevent fraud, abuse, and security incidents (legitimate interests).
Respond to customer support requests.
Comply with legal obligations, including tax and accounting.

3. Legal Bases

We rely on contract performance to provide the Service to you, legitimate interests for security and product improvement, consent where required (e.g. optional communications), and legal obligation where the law requires processing.

4. Who We Share Data With

Payment / Merchant of Record — Paddle.com Market Ltd. Paddle processes purchases, handles tax compliance, invoicing, and refunds. Paddle receives the personal data required to complete your transaction. See Paddle's Privacy Notice.
Infrastructure & subprocessors: our hosting provider, our authentication and database provider, and our AI inference provider, each acting under contractual data-protection terms and processing data solely on our behalf.
Species reference data: the iNaturalist public API is queried for taxonomy lookups — no personal data is sent.
Professional advisers: legal and accounting advisers when strictly necessary.
Authorities: where required by law or valid legal process.

5. International Transfers

Your data may be processed in countries outside your own. Where personal data is transferred out of the UK or EEA, we rely on approved safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We keep account and content data for as long as you have an active account. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we are required to retain it for legal, tax, or accounting purposes.

7. Your Rights

Subject to your local laws, you may have the right to:

access your personal data;
request correction or deletion;
restrict or object to processing;
data portability;
withdraw consent where processing is consent-based;
lodge a complaint with your local data-protection authority.

We will respond to verified requests within one month.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and audited infrastructure providers. No system is perfectly secure — please use a strong, unique password.

9. Cookies

We use only essential cookies and local-storage entries required to keep you signed in and to remember your preferences. We do not use third-party advertising cookies.