RockGeo Privacy Policy

Data we process

RockGeo may process:

• Google Account data: name, email, profile photo, account identifier and session tokens; RockGeo does not receive your Google Account password;
• projects, field points, GPS coordinates, altitude, accuracy, descriptions, units, lithologies, structural measurements, samples, features, topography, geotechnics, sections, field plans and any other content created by the user;
• photos, audio, imported documents, attachments and exports;
• requests, evidence and responses of the AI features;
• subscription status and transaction identifiers needed to validate purchases, without access to card data;
• preferences, app version, language, device model/OS, installation identifier, general usage events and approximate country/region;
• credentials the user chooses to provide for mapping or geospatial services. Personal AI-provider keys are not accepted.

Local storage and cloud sync

The local database and files remain the working source in the field and allow offline use. When the user is signed in and has access to RockGeo Cloud, compatible changes are synchronized automatically over the internet between the device, the web portal and RockGeo infrastructure. This may include technical data, coordinates, photos, audio, attachments and project metadata.

Structured records are stored in Google Firebase/Firestore. Photos, audio and other synchronized binaries are stored on Cloudflare Workers/R2 infrastructure under an account-exclusive prefix. Communication uses HTTPS/TLS; the Android app blocks cleartext traffic.

Purposes

Data is used to:

• authenticate the account and keep the session;
• save, sync, recover and export technical work;
• process maps, analyses, reports and AI features you request;
• validate the subscription, storage quota and AI credits;
• protect the service against fraud, abuse and unauthorized access;
• provide support and meet legal obligations;
• after consent, measure adoption, operation and campaigns to improve the product.

Device permissions

RockGeo may request location to record points and GPS accuracy; camera for photos; microphone for audio or dictation; and file access for import/export. The internet is used for authentication, sync, online maps, AI, purchases and external services. Sensitive permissions are requested when the corresponding feature is used.

AI and external services

AI-provider credentials are kept only on the RockGeo backend. Depending on the requested feature, prompts, selected project evidence and temporary files may be processed by Google Gemini or DeepSeek to produce the response. Users should avoid sending unnecessary personal data.

Users may also connect mapping or geospatial services such as Google Maps Platform, Google Earth Engine, Sentinel Hub and Esri. When using them, the necessary data is sent to the respective provider and is also subject to its terms and policies.

AI can make mistakes. Any report, interpretation or recommendation must be reviewed, validated and assumed by a legally qualified professional before official use. RockGeo does not replace ART/RRT, an engineering report or professional responsibility.

ChatGPT integration

RockGeo Pro is an integration for ChatGPT (OpenAI), served by an MCP server at https://rockgeo-cf977.web.app/mcp. This section describes exactly what the integration does.

Authorization and account link

• The connection uses OAuth. Sign-in is done with your Google Account. Email/password sign-in exists only for the OpenAI review account.
• The issued token is linked to the Firebase UID of your RockGeo account, and the tools can only access that account's data.
• OAuth authorization codes and refresh tokens are stored only as hashes, with an expiry (TTL): authorization codes expire after 5 minutes and refresh tokens after 30 days. The access token is valid for 1 hour.
• An active RockGeo Pro subscription is required to use the integration.

What the tools do

• Read-only: list your projects; list the field points of a project; read a single field point. Reading a point does not include attachments (photos, audio, documents) or storage keys.
• Slope stability calculation from parameters the user provides in the conversation; this calculation neither reads nor writes account data.
• Nothing is written, changed or deleted in your RockGeo account by the integration.

Sharing with OpenAI

RockGeo data is sent to OpenAI only in the tool responses you request in ChatGPT. Once delivered to ChatGPT, that data is subject to OpenAI's terms and policies and to your ChatGPT account settings, outside our control. Avoid asking ChatGPT for data you do not want to share with OpenAI.

How to revoke access

• Disconnect RockGeo Pro in ChatGPT settings (connected apps); access is no longer possible from then on.
• When you delete your RockGeo account (see the section below), the link and associated data are also removed.

Analytics and crash diagnostics

Google Analytics for Firebase stays disabled until the policy is accepted. After consent, it may process general usage events, an installation identifier and technical app/device information. RockGeo's custom events do not include coordinates, project names or IDs, notes, lithologies, photos, audio, documents or API keys.

After acceptance, Firebase Crashlytics may also receive crash reports, stack traces, app version, device model/OS and technical identifiers needed to diagnose crashes and freezes. RockGeo does not add technical project content to these reports.

In the PWA, sending data to Sentry is a separate option, disabled by default in the account menu. When enabled, it receives errors, stack traces, version and technical information; URLs are stripped of parameters and fragments and RockGeo attaches neither identity nor project content. The backend may use Sentry and Google Cloud Error Reporting for operational failures, with minimized logged data.

Processors and sharing

RockGeo does not sell personal data or publish the user's technical content. To operate the service, data may be processed by vendors acting as processors, including Google/Firebase (authentication, database, Functions and analytics), Cloudflare (storage and private delivery), Google Gemini and DeepSeek (AI), Sentry (crash diagnostics, when configured), Google Play/Apple (distribution and purchases) and, for the ChatGPT integration, OpenAI (only in tool responses requested by the user).

Data also leaves RockGeo when the user exports/shares files or triggers an external service. Exports and copies delivered to third parties are no longer under RockGeo's technical control.

Retention

Local data stays on the device until deleted by the user, by system data cleanup or by uninstalling. Synchronized data remains while the account exists and is needed to provide the service. After a subscription ends, cloud binaries may be kept for up to 90 days to allow renewal and recovery, and are deleted when that period ends.

Temporary AI operations and artifacts have short cleanup cycles, generally up to 7 days. Records may be kept longer when required by law, fraud prevention, defense of rights or financial integrity.

Account deletion and your rights

Under Settings > Account & Subscription > Delete account and cloud data, users can request permanent deletion inside the app, without sending an email. The operation deletes the Firebase account and associated data controlled by RockGeo in Firestore, R2 and temporary AI areas. Signing out does not delete data.

Deleting the account does not automatically delete local files on the device, exports, shared backups, data sent to services configured by the user (including data already delivered to ChatGPT/OpenAI) or payment history kept by the stores. Those items must be deleted on the device or in the corresponding service; subscriptions must be cancelled in Google Play or the App Store.

To exercise rights of access, correction, information or objection, or to get help with deletion, write to suporte@thardtech.com.br. We may ask for a secure way to confirm ownership.

Children

RockGeo is intended for adult students and professionals in geology, geotechnics, engineering, mining, environment and research. It is not directed at children.

Changes to this policy

This policy may be updated; the last-updated date is shown at the top of the page.

Contact

Controller: Thard Tech — CNPJ 67.141.076/0001-08
Email: suporte@thardtech.com.br
Previous public policy (mirror): https://thainararsousacorrea.github.io/rockgeo-privacidade/