AskRock privacy policy

Last updated: 13 October 2026

Controller: Jan Konieczny. Contact: hello@askrock.ai.

This version of AskRock checks one original PNG/JPEG image with OpenAI. We ask for consent before uploading. Original files may include metadata such as GPS location, date and camera model. The app does not request the device’s current location. You can withdraw consent for future uploads in Settings.

Firebase provides guest or optional Apple account authentication and App Check protection. Photo checks, purchase and restoration do not require an AskRock account. Apple sign-in is optional for syncing conversation history. Apple may provide an account identifier and optionally your name and email, including Hide My Email. We use account data to sign you in, enforce check limits and restore subscriptions. Apple handles payment; AskRock does not receive your card number. We retain verified subscription details and check usage. RevenueCat processes the stable pseudonymous billing identifier, store receipts, purchase and renewal details, and SDK technical context to validate and restore subscriptions, prevent fraud, and provide purchase analytics. We do not send your images, name, email or advertising identifiers to RevenueCat.

Images pass through our Firebase backend in europe-west1 to OpenAI. AskRock’s Firebase backend does not archive original images. Display copies used in history are saved locally and in private iCloud as described below. OpenAI applies its API platform retention rules: abuse-monitoring logs may include content and are retained for up to 30 days by default, with legal and safety exceptions. We do not claim Zero Data Retention. The Content Provenance documentation refers to these rules and does not specify a separate endpoint retention period. OpenAI API data is not used for model training by default.

Check results, image hashes, request identifiers and accounting records are retained for 7 days and removed during daily cleanup. This allows retries without charging a check twice. Subscription notification identifiers are retained for 90 days. Quota counters are linked to your account. Application logs do not contain images or signed purchases. The default Google Cloud log bucket has a 30-day retention period; required administrative audit logs have a 400-day retention period. Infrastructure logs may include technical identifiers and request information. After account deletion, a hash of the Firebase identifier remains for one day to prevent concurrent data recreation; daily cleanup may add up to one day.

Your name, consent and account session may remain on the device. Conversations, results, display-quality images and saved metadata (including date, camera and GPS when available) form persistent history on the device. Guest history stays local. After Sign in with Apple, we add it to the account and sync it to the user’s private iCloud database when iCloud is available. We do not additionally archive the original analysis uploads in history. Signing out hides account history; unsent changes stay on the device until the next sign-in. A missing connection or full iCloud storage pauses sync. Firebase Analytics collection is disabled in this version. RevenueCat provides subscription and purchase analytics. We do not sell data or track you for advertising.

Delete your account in Settings → Account → Delete account and data. This removes local and iCloud history, the Firebase profile, usage data and stored results. If history was stored in multiple iCloud accounts, deletion requires access to each of them. Deleting iCloud history requires access to the iCloud account used to store it; failed operations can be retried. A minimal deletion marker based on a hash of the app account identifier remains in iCloud, without conversation content or images, to prevent other devices from restoring deleted history. A minimal pseudonymous purchase and quota ledger is retained until the active subscription ends plus 90 days, so restoring a purchase does not refill an already used allowance. This ledger uses a keyed hash of the guest session identifier and, if you choose to sign in, a mapping based on a keyed hash of your Apple account identifier, without your name or email. Restoring through the App Store can transfer access to a new session while preserving the used allowance. When the retained billing ledger becomes eligible for removal, daily cleanup requests deletion of the corresponding RevenueCat customer before removing the local billing records. Provider backups and independent retention obligations are governed by the applicable provider terms. Deleting your account does not cancel an Apple subscription; manage it in Apple subscription settings.

Contact hello@askrock.ai for access, correction, deletion, restriction, portability or objections. You may lodge a complaint with the Polish data protection authority, UODO.

Purposes and legal bases

We process account, history, check and subscription data to provide the service (GDPR Article 6(1)(b)). Images are sent to OpenAI with consent (Article 6(1)(a)); withdrawal does not affect prior processing. We cannot perform a check without uploading the image. Security, abuse prevention, support and subscription performance analysis rely on our legitimate interest in a safe and reliable service (Article 6(1)(f)). We process data to meet legal obligations under Article 6(1)(c) where applicable.

Providers and international transfers

We use Apple (sign-in, payments and private iCloud storage), Google Firebase/Cloud (accounts, backend, limits and security), OpenAI (image checks) and RevenueCat (subscriptions). A European backend region does not mean all processing stays in the EEA. Providers may process data in the United States and other countries under applicable agreements and transfer safeguards, including standard contractual clauses where required. Contact the controller for information about the safeguards used.

Website

Cloudflare hosts the website and processes connection information, including IP addresses, to deliver and protect it. We store your language preference in your browser. This is separate from the app’s check history.

OpenAI data controls · Firebase privacy · RevenueCat privacy · RevenueCat DPA · Apple privacy · Cloudflare privacy