Privacy Policy
Your collection stays on your device unless you choose to back it up to your account. Sharktoothify never sells your data, and it does not keep the photos you send for an Expert ID.
Data Stored on Your Device
Profiles, find logs, tally counts, badges, report images, photos, preferences, saved locations and consent status are stored in your browser's localStorage and IndexedDB on this device. The optional Backup file you export contains this same data; treat it like the personal file it is.
Your Sharktoothify Account
Expert IDs, crews, reports and purchases use a Sharktoothify account. Sharktoothify keeps: your email address, your name if you give one, a securely hashed password (or your Google account ID, name and picture if you sign in with Google), your lookup balance, plan and purchase history, a short record of each lookup (time, how it was paid for, and the species returned), a record of any gift code you redeem, in-app notices sent to you, and whether you opted in to occasional email. Sign-in uses a secure, HttpOnly session cookie that exists only to keep you signed in.
Device Check
To keep the free lookup fair, the app sets a random identifier in a cookie on your device. Only a one-way hash of it is stored, together with which accounts have signed in on that device and when. If more than three accounts are used on one device, Expert IDs are turned off for that device. The identifier is not used for advertising and is deleted with your accounts.
Crews, Finds, Reports, Plans and Places
If you join or start a crew, the crew keeps the finds that are posted to it (count, species, place, notes, time, who posted and who decided), the guest hunter names the owner enters, and the decisions made on each find. Crew members see each other's display names. If you opt in to the public leaderboard, only your chosen nickname and your totals are shown. A report you make is stored as a snapshot on a Sharktoothify server and opens for anyone who has its private link; comments on it show the name the commenter typed and a time, and the commenter's account identifier is kept if they were signed in, and a short-lived network address used only to limit abuse. Trip plans, checklists and notes you write in the planner stay on your device unless you share a beach-day plan with a friend, in which case that plan is stored on a Sharktoothify server for the people it is shared with. Friends connect through a one-time link; each can see the other's display name, and either can disconnect at any time. A place you suggest is stored with your account identifier until a person reviews it; approved places show no information about you.
Data That Leaves Your Device (only when you use these features)
(1) Expert IDs: the tooth photos you choose (up to three), a place you type if you add one, and any observations you choose are sent over HTTPS to the Sharktoothify service and processed by the photo-analysis provider solely to produce your result. Sharktoothify does not keep these photos today; see "Using Your Photos to Improve Sharktoothify" below. (2) Tides, weather, sun and planning: approximate coordinates or a ZIP code are sent to NOAA, the U.S. National Weather Service, and open geocoding services (Zippopotam; Nominatim, © OpenStreetMap contributors) to fetch conditions; sunrise and sunset are calculated on your device. (3) Purchases and plans: checkout and billing are handled entirely by Stripe under Stripe's own privacy policy; card details never touch Sharktoothify. Stripe reports which pack or plan was paid for, its status and renewal dates so lookups can be added and ads removed. (4) Email: account emails (confirming your address, resetting your password, crew invitations you ask to be sent, and notices about your crew) and, only if you opted in, occasional messages such as a free lookup after you've been away, are sent through Resend. Every marketing email has a one-click unsubscribe, and you can switch it off anytime in Settings. (5) Feedback: if you send a suggestion or issue report, its text, your email if you give it, and basic device information are emailed to Sharktoothify, and any screenshots or screen recording you attach are kept privately on a Sharktoothify server for 90 days, so they can be opened from a link in that email. (6) Content delivery: fonts are served from this site, so no font provider receives your request. Map tiles, when you open the map, come from OpenFreeMap. (7) Sharing a party member: only if you choose to pass a member to their own account. The counts added to that member's tally (the number, a short note, the date and who added it) are stored on a Sharktoothify server and shown to the two accounts on that link, using the first name or display name on each account and never an email address. The invite link works once and expires in 7 days. Either person can stop sharing at any time, and counts already on a phone stay on that phone. Photos, reports, lookups and your other profiles are never part of it. (8) Backup and sync (off until you turn it on): your party members' names and pictures, their tallies, and your identified finds (species, date, place, notes and a small copy of the photo) are stored in your account so they survive a lost phone and appear on every phone you sign in on. Full-size photos and report cards stay on the phone. Only your account can read it. You can turn it off or delete the whole backup in Settings. If you hand a member over to someone else's account, that member's records move to their account and are removed from yours. (9) Your device's maps and calendar: if you tap a map or calendar button, your coordinates or plan details are handed to that app or website. (10) Tide alerts (only if you turn them on in the Tide chart): your browser's alert address, the tide station you chose, your time zone and your choices (high or low tides, how early, quiet hours) are stored on a Sharktoothify server and used only to send those alerts, with the tide times fetched from NOAA. No account is needed and nothing else is stored. Turning alerts off deletes them, and an address that stops working is removed automatically. (11) Sign in with Google (optional): Google tells Sharktoothify your name, email address and picture when you choose it, and Google receives the fact that you signed in to Sharktoothify; nothing else is shared. (12) Sign-up and sign-in checks: a short check run by Cloudflare (Turnstile) may ask your browser to show it is not a bot; Cloudflare handles your network address and browser signals for that under its own policy. (13) Hosting and security: Cloudflare delivers and protects the site, so it sees each request, including your network address and browser details, and keeps standard security logs; Sharktoothify does not use them to profile anyone.
Using Your Photos to Improve Sharktoothify
Today, the photos you send for an Expert ID are processed to produce your result and are not kept by Sharktoothify; the optional Backup keeps only a small copy of the photo of each find you chose to back up, and feedback attachments are kept for 90 days as described above. The Terms reserve the right, for the future, for Sharktoothify and the partners and service providers it works with to keep photos you submit, together with the result and any correction you make, in order to test, improve, train and scale Sharktoothify's identification technology and species reference. If that starts, this Policy will be updated first with a new effective date; photos used that way will be stored without your name, email address or other contact details attached, will not be sold, and will not be published as yours; and where the law requires your consent for the use, Sharktoothify will ask for it first. You can ask Sharktoothify at any time to stop using your photos for this purpose and to delete the ones it holds, by writing to [email protected] or using Contact Us. Do not submit photos of people, and do not submit anything you do not have the right to share.
Cookies, Ads & Analytics
Sharktoothify uses first-party cookies to keep you signed in and for the device check described above; the sign-up check (Cloudflare Turnstile) may also use a cookie or similar technology to do its job. Unless you hold an active Sharktoothify Plus plan or a Vacation Pass, the app may show advertisements from Google AdSense, which may use cookies or similar technology to serve and measure ads as described in Google's policies (see how Google uses information from sites that use its services); visitors in the EEA, UK and Switzerland are asked for consent first. Ads are never shown inside a dialog or in the identification flow. No other advertising or profiling is run.
Children
Sharktoothify accounts are for people 13 and older, and personal information is not knowingly collected from children under 13. A parent or guardian may add a child to their own crew as a "guest hunter" using only a first name or nickname they choose; guest hunters have no account, no public profile and no advertising personalization, and the parent can remove them at any time. Purchases require an adult (18+) or a parent or guardian.
Your Rights (including GDPR / CCPA)
Device data is in your control: view it in the app, export it from the Backup file in Settings, and erase it with Clear App Data or by clearing browser storage. For account data, sign in and use the Download everything Sharktoothify holds about this account link in Settings for a copy of everything held about your account, and Settings → Account → Delete account to erase your account, balance, history and any backup in one step (payment, refund and billing-event records are kept without your identity for tax and dispute purposes). You can also email [email protected] or use Contact Us for a copy or a correction. Sharktoothify does not sell or share personal information as defined by the CCPA/CPRA, and honors applicable GDPR rights of access, rectification, erasure, objection and portability.
Retention, International Transfers & Security
Device data persists until you delete it. Account data is kept while your account exists and deleted when you delete it; purchase records may also be kept by Stripe as required by law. Processing occurs in the United States. Data is protected in transit with HTTPS, passwords are hashed, all API credentials stay server-side, card numbers are never handled, and the photos you send for an Expert ID are not kept. Report security concerns to [email protected] or through Contact Us at the bottom of this page.
Changes & Contact
Material changes will be posted here with a new effective date. Privacy questions and rights requests: email [email protected] or use Contact Us at the bottom of this page (Sharktoothify).