Gotcha← Back

Privacy Policy

Last updated September 22, 2026

Gotcha is a real-life creature index for iOS and Android. You photograph an animal, the app cuts it out and identifies it, and it joins your collection and your park.

This policy explains what the Gotcha app and the website at gotcha.catchy.fan collect, why, who we share it with, and the choices you have. We do not sell your data, we do not use it for cross-app advertising or tracking, and we try to collect as little as possible.

What changed

This version of the policy was rewritten to cover everything Gotcha does today:

Who we are

Gotcha is an independent app built by Jurre de Ruiter, based in the Netherlands (the “data controller” under the GDPR). For any privacy question or request, contact gotcha-support@catchy.fan.

What the app collects

Account information

Gotcha asks you to sign in when you set it up, with Apple, Google, or a one-time code sent to your email. We store a few things on our backend so the app works across devices: your email address, a unique handle you pick (your collector ID), an optional display name, an optional avatar image, an account identifier issued by our authentication provider, your referral code, and, if you joined through someone else’s invite, who referred you. With Sign in with Apple you can use Apple’s Hide My Email, in which case we only ever see the relay address.

Photos and identification

When you catch a creature, the app uses your camera to take a photo, and the subject is cut out on your device. To identify it, we send the photo and the cut-out to our identification service, together with the approximate location of the catch if you allowed location access. The full photo is needed to check that the subject is a real, live animal and not a picture on a screen, and the location helps tell look-alike species apart. Our service passes these to an AI model provider (see Who we share data with). We do not upload your camera roll.

The app only asks for photo library access to save stickers you choose to save, and only reads an image from your library when you pick one yourself (for example to attach it to a support message).

Your collection backup

Your catches are backed up to private, per-user storage on our backend, so your collection can be restored on another device. A backup includes the original photo, the finished sticker, the species, the time, any nickname you gave it, and the catch location if one was recorded. Only you can access these files directly. Stickers you show in your park are visible to other players who visit it (see below).

Device identifier

Each catch is sent with a per-device identifier (Apple’s identifierForVendor on iOS, the equivalent app-scoped identifier on Android). We use it to enforce fair-use catch limits, to prevent abuse, and to understand overall usage. It is not an advertising identifier, and it resets if you delete the app.

Location (optional)

If you grant location permission, a catch is tagged with the coordinates where it was made. We use this to improve identification, to show your catches on your catch map, and to store the place with your collection backup. Place names and maps are provided by Apple Maps on iOS and Google Maps on Android. If you deny location, Gotcha still works fully and catches are simply not tagged with a place.

Your public profile, friends, and leaderboards

Gotcha has social features, so some information is visible to other signed-in players: your handle, display name, avatar, level, species and catch counts, streak, achievements and badges, and whether you have Gotcha+. This is what appears when someone searches for you, views your profile, or sees you on a leaderboard. Your badges can also be seen by people who are not signed in. If you add friends, we store your friend requests and friendships, and send a notification when someone adds you. Your email address and catch locations are never shown to other players.

Your park

If you play the park, we store its state on our backend (your layout, animals, coins, food, gems, progress, and when you last played) so it is kept safe and works across devices. Other signed-in players can visit your park, which shows your handle and the catch stickers you have placed in it.

Catch analytics, reports, and species requests

For each identification attempt we log a small event so we can keep the app working and decide which species to add. An event may include: the device identifier and your account identifier; whether a creature was detected; whether it appeared to be a live subject (our anti-cheat check); the identified common and scientific name and confidence; whether it matched our catalog; the outcome; and the optional location. These events do not contain your photos.

If you report a wrong identification or request a species we don’t have yet, we store what you submit (the species involved, your suggestion and any note), along with your account and device identifiers, the app version, and the catch location if there was one.

App analytics and error logging

We use PostHog (hosted in the EU) to understand how the app is used, for example app opens, catches, and purchases. When you are signed in, these events are linked to your account identifier and email address. We do not record your screen or track your taps.

We use Logbook, a logging tool we run ourselves, to find and fix errors and crashes. Logs may include your account identifier, email address, and subscription status, plus technical details such as the app version and device model. For a sample of installs, logs about a catch can contain a private link to that catch’s photo and cut-out so we can investigate identification problems. Those links expire after 30 days, and logs are deleted after 30 days.

Support chat

If you contact us from the in-app support chat, we receive your messages, any images you attach, and your account identifier, handle, name, and email address so we can answer you. Support conversations are handled through Appdeck, and replies can arrive as a notification.

Cancellation chat assistant (optional)

If you open the chat assistant when thinking about cancelling Gotcha+, your messages are answered by an AI model. To give a useful answer, it receives your messages and basic facts about how you use the app (for example your catch and species counts, level, streak, how long you have used Gotcha, and your subscription status). The conversation is stored so we can improve the experience.

Notifications

If you allow notifications, we store your device’s push token with your account, platform and app version, so we can send you things like friend requests and support replies. You can turn notifications off at any time in your device settings.

Subscriptions and purchases

Gotcha+ and park items are sold through the Apple App Store and Google Play. The store processes your payment, and we never receive your card or payment details. We use RevenueCat to manage subscriptions, and share your account identifier and email address with it so your purchase follows your account. We receive your subscription status (for example active or expired, the product, and renewal or expiry dates). For park purchases we record the store’s transaction identifier, the product, and the time, so the items are credited to your park exactly once.

Advertising

The iOS app includes Google’s Mobile Ads SDK so that the park can offer optional rewarded ads (you choose to watch one in exchange for an in-game reward). No ads are shown today. If we turn them on, they will only ever be optional, non-personalised ads, and we will not use them to track you across other apps or websites. When an ad is shown, Google may collect device, diagnostic, and approximate location data to deliver it, as described in Google’s privacy policy.

Widgets

Home screen widgets and Live Activities read a small summary of your collection that stays on your device.

What the website collects

AI and automated processing

Identification and the cancellation chat assistant are automated and use third-party AI models. They can make mistakes. Their results only affect what happens inside the game (for example which species a catch counts as), never anything with a legal or similarly significant effect on you. The AI providers we use process this data on our behalf and, under the paid API terms we use, do not use it to train their models.

Why we’re allowed to use this data (legal bases)

Under the GDPR, we rely on:

Who we share data with

We do not sell your data. Besides the other players who can see your public profile and park, we share the minimum necessary with service providers (“processors”) that help us run Gotcha:

To check species names we also look them up in GBIF, a public biodiversity database. Only the scientific name is sent, never anything about you. We may also disclose data if the law requires it, or to protect the rights and safety of our users and the service.

Some of these providers process data outside your country, including in the United States, under appropriate safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

Your rights

You can delete your account directly in the app: open your Profile, then Settings, then “Delete account.” That permanently deletes your account, profile, handle, avatar, friends, progress, badges, park, push tokens, and every catch photo, sticker and location backed up to our backend. Your catch analytics, reports, species requests, and chat assistant conversations are anonymised: we remove your account identifier (and, for analytics and reports, your device identifier and precise location), keeping only non-identifying information. See Delete your account for details. You can also log out at any time, which leaves your on-device collection untouched.

Depending on where you live (for example under the GDPR or California’s CCPA/CPRA), you can also request access to your data, correction, deletion, a copy of it, or restriction of certain processing, and object to processing based on legitimate interests. We do not sell or “share” personal information for cross-context behavioral advertising. To make a request, email gotcha-support@catchy.fan and we will respond within 30 days. You also have the right to complain to a data protection authority, such as the Dutch Autoriteit Persoonsgegevens or the authority in your own country.

Children

Gotcha is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.

Security

Data is transmitted over encrypted connections (HTTPS/TLS). Access to backend data is restricted by per-user security rules, so you can only read and change your own private data, and your backed-up photos are only reachable through signed links that expire. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your information.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new “last updated” date and, where appropriate, announced in the app.

Contact

Questions or requests: gotcha-support@catchy.fan.