Privacy policy
In short
- There is no account, no sign-in and no user identifier.
- No analytics, no crash reporting, no advertising, no tracking, no third-party SDKs.
- Your location and compass heading are processed on the device only and are never transmitted.
- Camera and photo access exist for one purpose: reading your own membership card. The card stays encrypted on the device and is deleted the moment you delete it.
- The app makes network requests only to fetch content updates for the zoo bundle — and the Apple base map on the map screen loads map data from Apple. See What leaves the device.
- The developer runs no server on which data about you could sit.
Data controller
The controller under the General Data Protection Regulation (GDPR) is the developer of the Your Zoo app.
TODO Fill in the full legal name, postal address and contact email of the controller. Apple requires both the address and the email in App Store Connect and on this page.
Name: TODO: name / company
Address: TODO: street, postcode, city, country
Email: TODO: contact-address@domain.tld
There is no data protection officer; the app does not process personal data in a way that would require one.
Location, compass and motion
The audio guide has to know which enclosure you are facing. The app therefore asks for location access (“While Using the App”) on first launch. If you refuse, the app keeps working — it then only tells you about enclosures you tap yourself on the map or in the list.
What is processed, at most twice a second:
- the coordinate and its accuracy,
- the compass heading and its accuracy,
- course and speed from the location fix,
- the timestamp.
These values are scored against the enclosure geometry shipped inside the app in memory only. They are not stored, not logged and not transmitted — the one exception being the voluntary recordings described below. The app never looks up an address for your position and contacts no geocoding service.
While audio is playing the app keeps location updates running with the screen off, so the story continues while the phone is in your pocket; iOS shows its blue location indicator while it does. After 90 seconds of standing still the app drops to coarser accuracy and switches the compass off to save battery. On devices with a motion coprocessor it uses the iOS motion classification (“walking, running, cycling”) for one thing only: leaving that battery-saving state when you move on. Motion data is not stored.
Your membership card
In the “Your Zoo” section you can photograph your physical zoo card once, or pick an existing photo from your photo library. Camera and photo access are used for nothing else.
The image is analysed entirely on the device (Apple Vision, no network connection). What is read: the QR code, the card type, salutation and name, the card number, and the start and end of validity. You see every recognised field before saving and can correct it.
What is then stored in the app's private container: those fields as a small file and, if one was found, a crop
of the portrait photo. Both are written with iOS file protection at the “complete” level
(FileProtectionType.complete): the files are encrypted and readable only while the device is
unlocked. The original photo of the card is not kept, and the app does not add any photo to your photo library.
The card data never leaves the device. It is sent to nobody — not to the zoo either. At the turnstile you hold up the QR code on the screen; the zoo's reader reads it exactly as it reads the plastic card.
“Delete card” removes the file and the portrait from the device immediately. Deleting the app removes them too. Like every file in the app container they are included in an iCloud or computer backup of your device if you have backups enabled; that backup sits with Apple or on your computer, not with the developer.
Ground-truth recordings (opt-in)
Settings contain a function that records location fixes in order to improve the recognition. It is off by default and starts only when you explicitly switch it on.
- What is recorded: one line per fix with coordinate, accuracy, compass, speed, timestamp and the enclosure you marked as the correct one.
- The recordings are plain text files in the app's private container.
- They are never transmitted automatically. A file leaves the device only if you hand it on yourself via “Share” — and then it goes wherever you send it.
- Every recording can be deleted individually in Settings.
A recording contains your path through the zoo and is therefore personal data. Switch the function on only if you want to, and delete the files when you no longer need them.
Settings and progress on the device
The app remembers locally (in the app's own preferences, with no identifier and no iCloud sync): the chosen language, the playback speed, the location source, which enclosures you marked as favourites, which of the five facts per species came last, whether offline mode is forced, the address of the update server and the time of the last update check. None of this identifies you, and none of it is sent anywhere.
What leaves the device
The app contains exactly one network client of its own and additionally uses Apple's map component. These are all the cases:
1. Content updates for the zoo bundle
At most once an hour — and whenever you tap “Check for updates” in Settings — the app queries a plain file
store, by default raw.githubusercontent.com/andreseloysv/zoo. It fetches the zoo index, the
manifest file and, only if a newer version exists, the changed content files.
Nothing is sent but the request itself: the address of the wanted file and a marker of the
app version (User-Agent: Your Zoo/0.1.0). No identifiers, no cookies (the
connection uses an ephemeral session with no cookie or cache storage), no location and no card data are
included. Technically unavoidable: the operator of the file store — GitHub, Inc. (USA) with the default setting
— sees your device's IP address and may log it under its own rules. Every downloaded file is verified against
its SHA-256 checksum before it is used.
The “Force offline mode” switch in Settings stops this request entirely. The app keeps working exactly as before, because the zoo bundle ships inside the app.
2. The base map on the map screen
Your Zoo draws its enclosures, paths and symbols on top of Apple's map (MapKit). While the map screen is open, MapKit loads map data for the visible region from Apple. That means the information that a device is currently looking at this region does leave the phone. These requests are made by the operating system, not by the app; according to Apple they are not tied to your Apple Account. The “Force offline mode” switch covers only the content updates and does not stop these map requests. If you want to avoid them, put the device in airplane mode — location, audio guide and the digital card keep working, only the grey base map under the enclosures stays empty or shows just the regions already cached.
3. Links you tap yourself
In “Credits & licences” and on the zoo link, a tap opens the page in Safari. From that moment the privacy policy of the site you visit applies.
Not on the network: the speech
The stories are read out by the iOS speech synthesiser on the device. No text is sent to a speech service. Additional, better-sounding voices are downloaded through iOS Settings if you want them, not through this app.
What the app does not do
- No accounts, no registration, no email address, no login.
- No analytics, no usage statistics, no crash or telemetry services.
- No advertising, no advertising identifier (IDFA), no App Tracking Transparency prompt, no tracking across apps, devices or companies.
- No third-party SDKs, libraries or services. The only dependency is the app's own code library.
- No push notifications, no contacts, calendar or health access, no audio recording.
- No selling, sharing or exchanging of data — there is no data to pass on.
Accordingly, the app's privacy manifest (PrivacyInfo.xcprivacy) lists no collected
data type and no tracking domain; the only declared protected APIs are the app's own preferences and the
modification date of the content files.
Permissions at a glance
| Permission | Used for | Leaves the device? |
|---|---|---|
| Location (while using; in the background during playback) | Working out which enclosure you are facing | No |
| Camera | Photographing your membership card | No |
| Photos | Choosing an existing photo of the card. The app asks for no permission to do this: iOS shows the picker outside the app and hands over only the one picture you chose. The app never sees your library. | No |
| Motion & Fitness | Waking from battery-saving mode when you walk on | No |
| Microphone | Never requested. The app records no audio. | — |
Every permission you grant can be withdrawn at any time in iOS Settings. Without location you only lose the automatic recognition; without the camera, only photographing the card.
Children
Your Zoo is made for families; children are part of the audience. The app collects data from nobody — children included. There is no account, no profile, no advertising, no chat or comment function, no user-generated content and no in-app purchase. Because no personal data reaches the developer or any third party, no consent mechanics arise under the US COPPA rules or under Article 8 GDPR. The digital card belongs to the person using the device; a child should import an adult's card only with that adult's agreement.
Legal bases
Where processing happens exclusively on your device, the developer has no access to it whatsoever and holds no personal data. For the remaining points:
- Location and compass: processed locally on the basis of the permission you grant in iOS and necessary to provide the app's function (Art. 6(1)(b) GDPR). You can end it at any time in iOS Settings.
- Membership card: processed locally at your explicit request in order to provide you with the digital card (Art. 6(1)(b) GDPR). The data on a membership card can include a name and a salutation; it stays on your device.
- Content updates: legitimate interest in current and correct zoo content (Art. 6(1)(f) GDPR). The unavoidable transmission of your IP address to the operator of the file store can be switched off with “Force offline mode”.
- Recordings: your consent alone (Art. 6(1)(a) GDPR), which you withdraw by switching the recording off and deleting the files.
Transfers outside the EU: update checks are addressed to GitHub, Inc. (USA) and base map requests to Apple Inc. (USA); each transmits your device's IP address. Both companies are certified under the EU-US Data Privacy Framework. No content data from the app is transmitted.
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21).
Because the developer stores no data about you — there is no server, no account and no identifier — an access request can only be answered with: no data about you is held. The data in question sits solely on your device, and you exercise the rights there directly:
- Access and portability: the card is shown in full in “Your Zoo”; recordings can be viewed in Settings and shared as a file.
- Rectification: card fields can be corrected while importing and when you scan again.
- Erasure: “Delete card” removes the card and the portrait, “Delete” on a recording removes that file, deleting the app removes everything.
- Withdrawal: location, camera and photo permissions can be revoked in iOS Settings at any time.
The controller answers questions at the address above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live.
TODO Add the competent supervisory authority for the controller's registered address (in Germany, the data protection authority of the relevant federal state).
Retention
- Location and compass values: only while they are being computed; they are not stored.
- Card and portrait: until you delete them or remove the app.
- Recordings: until you delete them or remove the app.
- Settings: until you change them or remove the app.
- At the developer: nothing, because nothing is transmitted.
Security
The card and the portrait are encrypted with iOS file protection at the “complete” level. All other files sit in the app's private, OS-isolated container and cannot be read by other apps. The app offers no file sharing. Network requests run over HTTPS only, without cookies and without a cache; downloaded content is verified against checksums before it is used.
Changes to this policy
If the app gains something that processes data differently, this page is updated first and the date at the top changes with it. Earlier versions can be traced through the history of the public repository.
Contact
Privacy questions, withdrawals and access requests: TODO: contact-address@domain.tld
Your Zoo is not affiliated with Frankfurt Zoo. For the membership card itself and for everything that happens at the turnstile, the zoo's own privacy policy applies.