Privacy Policy

Last updated: 31 August 2026

Who the controller is

The controller of your data is Top App, Rynek Główny 28, 31-010 Kraków, Poland, VAT ID PL6762666433 (“we”). For anything concerning your data, write to hello@topapp.pl — we answer within one month.

The short version

• You never create an account and never tell us anything about yourself. The app is issued an anonymous identifier, and that identifier is your account.
• The photos you scan are not stored on our server. They pass through it on the way to the AI model; only the ones you choose to save to your collection stay with us.
• We do not track you, profile you, or show ads.
• We do not collect your location. The app sends only the name of the current month, so the model knows what season it is.
• One button in Settings erases everything.

What we process

Account identifier

On first launch our server generates a random identifier (a UUID) and the app stores it in the system Keychain. Your collection hangs off it. The identifier survives deleting the app, which is how your discoveries come back after a reinstall. It contains nothing about you and does not let us identify you.

Photos

A photo taken or picked for identification is forwarded by our server to the AI model and is not saved on our side. If you tap “Save to Collection”, that particular photo is stored on our server and linked to your identifier — without which a collection would not be a collection.

Technical data

• Platform and language (“ios”, e.g. “en”) — so species descriptions come back in your language.
• The current month — seasonal context for identification. It is not a location and we do not store it.
• A count of free identifications — so we know when the free allowance runs out.
• IP address — visible to our server on every request and written to server logs. We use it only to protect the service from abuse and to diagnose failures.

Subscription

Payment is handled by Apple, and it is Apple — not us — that processes your payment details. We never see your card number. To check whether a subscription is active we use RevenueCat, which receives your anonymous identifier and the purchase record. All we store is the product identifier and the date the subscription runs until.

Why, and on what legal basis

• Identification, collection, subscription — performance of the contract you enter into by using the app (Art. 6(1)(b) GDPR).
• Security, rate limiting, server logs — our legitimate interest in keeping the service running and resistant to abuse (Art. 6(1)(f) GDPR).

Who we share it with

We use three processors:

• OpenAI (USA) — species identification. It receives the photo and the month; it does not receive your identifier or anything that would link a photo to a particular user. OpenAI states that API data is not used to train its models and is retained for up to 30 days for abuse monitoring. The transfer to the USA relies on Standard Contractual Clauses.
• RevenueCat (USA) — subscription management. It receives the anonymous account identifier and the App Store purchase record.
• Amazon Web Services — our server and database sit in Frankfurt, that is inside the European Union.

We do not sell data, do not share it with advertisers or data brokers, and use no analytics or advertising SDKs of any kind.

How long we keep it

We keep your collection and saved photos for as long as you want to use them — we do not delete them automatically after a period of inactivity, because your collection is the point of the app. When you delete your account we erase everything: the database rows and the photo files on disk. Server logs rotate out within days. Database backups are kept for 14 days and then overwritten.

How to erase your data

In the app: Settings → Delete account and all data. That removes the account, the whole collection and every saved photo from our server. It is immediate and irreversible — and the app only reports success once the server has actually confirmed the deletion. You can also write to hello@topapp.pl.

Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interest. Write to hello@topapp.pl — bear in mind that we do not know who you are, so to act on a request we will need the account identifier shown in the app’s settings.

You may also lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland — or with the authority in your own country of residence.

Children

BugLens is not directed at children under 16 and we do not knowingly collect their data. If you are a parent and believe your child has given us data, write to us and we will erase it.

Changes

We will announce material changes in the app before they take effect. The date of the last update is at the top of this page.

See also: BugLens Terms of Use.