The short version
Your walks, snaps, Field Guide and heart rate live on your phone. To identify an animal, the photo you snap is sent to our identification server and on to Anthropic's Claude, which looks at it and names the species. Heart rate and routes are never sent to our server. If you choose a username you can compare scores with friends. You can also choose to appear on area boards. We don't sell data, show ads, use analytics or advertising tools, or track you across other apps.
Who we are
Wildmiler is made and run by one independent developer in the United States, under the name shown on the App Store and Google Play listings. "We" in this policy means that developer, who is responsible for the data described here. Write to [email protected] with any question or request.
What stays on your phone
Your walk routes (GPS), distance, steps, pace and laps; your photos and clips, including any sound recorded with a clip; where each snap was taken; notes you write on your snaps and how hard you rate each walk; your Field Guide, XP, trophies and settings, including the weight and maximum heart rate you enter; and heart-rate readings. These are stored in Wildmiler's private storage on your phone and are not sent to us. They stay until you delete them or uninstall the app.
If "Save snaps to Photos" is on (under Me), your photos, clips and share cards are also saved to your camera roll, where your phone's other apps can see them if you've given them photo access.
What leaves your phone, and why
Identifying an animal. When you snap a photo or clip, a downsized copy (or three still frames from a clip, never its sound) goes to our identification server over HTTPS, together with your location rounded to about 0.7 miles and the month, which help tell look-alike species apart, and whether it was taken with Wildmiler's camera or picked from your photo library, so imported pictures can be checked for signs of AI generation. A picture you import is also checked on your phone for labels that AI tools write into their files; that check sends nothing anywhere. The server passes these to Anthropic, the maker of Claude, to identify the animal, and returns the answer. Our server does not keep your photos or your location. Anthropic processes them under its commercial API terms (anthropic.com/legal), which do not allow it to train its models on them; it may keep them for a limited time to check for misuse of its service.
Your anonymous account. The first time you identify a snap, the app gets a random account id from our server so it can give each phone its own daily allowance of identifications. It isn't linked to your name, email or phone number, and we have no way to tell who it belongs to, unless you choose a username (see below), which you shouldn't make from your real name. The server keeps the id, when it was created, your phone's platform (iPhone or Android), your tier, and how many identifications you've used each day. To limit how many accounts one network can create, it also keeps a daily count per network, stored as a one-way hash of your IP address, never the address itself. Daily counts are deleted after about a week. The account itself stays until you delete it (see Your choices).
Username, friends and leaderboards. This is optional, and nothing here exists until you choose a username under Me → Compete. Then the server keeps: the username you chose (3 to 20 letters, numbers or underscores, which you shouldn't make from your real name) and a simplified form of it used to stop look-alike names; when you chose it and when you confirmed you are 13 or older (no birthdate is asked for or kept); whether you are listed on an area board; four numbers with the week or year they belong to (XP from snaps this week, species this year, species in your life list, and distance walked this week); up to 14 daily distance totals; the species you have identified, as scientific names with the day first found, kept only so they can be counted (they are never shown to anyone, only the counts are); lists of your friends, the players you block and those who block you; whether other players may find you by searching for your username (on unless you turn it off); friend requests you send or receive, with who asked whom and when (deleted when answered, after 30 days at most, or with your account); invite codes you make (deleted after 48 hours or when used); reports you make or that are made about you (kept 90 days, with only a reason of name, cheating or something else, and no free text); a fingerprint of each counted photo to stop the same picture counting twice (kept 35 days, with no account id and no way back to the photo); and daily counts to limit abuse.
What other players can see. Other players can find you by searching for your username, and when they do they see only your username and whether you are friends or have a request open, nothing else. You can turn this off under Friends, "Let others find me by username": then no one can find you by search or send you a request, though friends you already have stay and you can still add people yourself. Friends see your username and those four numbers, never your photos, species names, location, routes, region, when you were last active or when you joined. Once a week your notifications may say how close a friend's last week was to yours, in a rounded step like "within 50 XP of Sam" (never an exact number, and never who was ahead); a friend who earned no XP that week is not named, and nothing is said when no friend was close. If you choose to be listed on a Region or Nearby board, other players listed in the same state, country or area see your username and the four numbers (the life list there counts only species the identifier checked). A board with one listed player shows just that player, who may be recognizable to people nearby. You are on no area board until you choose it, and you can turn it off at any time.
Where scores come from. Scores come from snaps the identifier checked: the server works out the points and species from its own answer, and the app never sends XP or species counts. Distance walked is the one number your phone reports, as a total for each day, and it is labeled as reported. Walks, Sit & Spot, quests, postcards and corrections are not counted on boards. Photos, notes and routes are never sent for boards, and a photo is never shared with other players.
Your area. If you choose an area, the app takes one rough location fix, works out a region code (like US-PA) and a grid cell about 15 miles across on your phone, and discards the fix. Only the cell and region code are sent and kept, and only if you opt in; exact location and routes are never stored. To name your state or country, your phone's location service sends the position once to Apple (iPhone) or Google (Android), under their own privacy policies; if that isn't available you can pick a state or country by hand. A Nearby area is confirmed by the rounded location (about 0.7 miles) that already comes with your next camera snap nearby: the server compares it to your cell, doesn't keep it, and remembers only that the cell was confirmed. Until then the chosen cell is stored unconfirmed. Turning the listing off deletes the area.
Your notifications. If you have a username, the server keeps short notices for you in the app's inbox: friend requests, accepted requests, a weekly recap of your own week, and, only if you turn them on, milestones such as a friend passing you or finding a rare animal. Each is written by our server from numbers it already holds, names no species, and is deleted after 30 days, when you delete it, or when you and the other player block each other. You can turn each kind off under Settings → Notifications.
Reports and blocks. Anyone can report a name or cheating, or block another player, from a board or friends list. A report stores who reported whom, with the reason, for 90 days. Several reports can hide a player from area boards until we review it. The person reported is never told who reported them. Blocks are stored as lists on both players' records and hide each from the other, and blocking someone also removes any friend requests between you.
Server logs. Our server runs on Google Cloud in the United States, which logs each request (including its IP address). Our own log lines record a shortened account id, the species identified, and how long the identification took, to spot errors and abuse. Usernames and area cells are never written to our logs. Logs are kept for up to 30 days.
Species information. Species names are looked up on iNaturalist and Wikipedia to show names, photos, rarity and descriptions. For "nearby wildlife", the app asks iNaturalist what's been seen within about 9 miles of your location rounded to about 0.7 miles. These requests carry no account id, but, like any web request, the services see your IP address and handle it under their own privacy policies.
Maps. Walk maps are drawn by Apple Maps on iPhone and Google Maps on Android, which receive the map area being shown, under Apple's and Google's own privacy policies.
Feedback form. Beta testers can send feedback, or report a problem, through forms hosted by Jotform, which is optional. If you open one from the Me tab, from Settings → About and help, or from the short "what's new" note shown once after an update, the link carries your platform (iPhone or Android), the app version and build, your phone model and its operating system version, so you don't have to type them; Jotform receives those details as soon as the form opens. What you write, any screenshot you attach and an email address, if you give one, are sent to Jotform and to us only when you submit the form. We use them to understand and fix problems and to reply to you. Jotform handles them under its own privacy policy. Please don't include photos of other people.
Heart rate and health data
If you turn on Heart rate, Wildmiler reads heart rate during each walk and Sit & Spot you start, and reads nothing else. On iPhone it reads from Apple Health, which gets it from AirPods Pro 3, an Apple Watch, a chest strap or another device. Wildmiler runs a workout in Apple Health for each walk so your earbuds or strap send heart rate. If Save walks to Apple Health is on, it saves each walk and Sit & Spot there as a workout: time, distance, route, heart rate and Apple's calorie estimate. With the switch off, no workout is saved; Apple Health may keep the heart-rate and calorie readings taken during the walk. On Android it reads from Health Connect, which gets it from your watch or another device that writes there. If Save walks to Health Connect is on, it saves each walk there as a walking session (time, distance and route) and each Sit & Spot as a mindfulness session; it writes nothing else.
Heart rate is used only to show your heart rate, zones, averages, maximum and per-lap figures for your walks. It is stored on your phone with the walk and is never sent to our server, Anthropic or anyone else. Workouts you save to Apple Health stay in Apple Health, which Apple may sync to your iCloud under its own terms. It isn't used for advertising, sold, or shared with data brokers, insurers, employers or lenders.
Wildmiler's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Data from Apple Health is used under the same limits.
Heart rate in Wildmiler is for fitness only. Wildmiler is not a medical device and its figures are not for diagnosis or treatment.
Backups
Settings → Data and backup → Back up makes one file with your walks (including heart rate), snaps and Field Guide, and saves it wherever you choose, such as Files, iCloud Drive or Google Drive. We never see it. Your phone's own backup (iCloud or Google) may also include Wildmiler's data, depending on your phone's settings.
Security
Everything sent to our server travels over HTTPS. Your account token is kept in your phone's keychain (Keystore on Android), and our server stores only a one-way hash of it, so a copy of our database couldn't be used to act as you. No method is perfect, and no app can promise complete security.
Your choices
Turn Heart rate, Save walks to Apple Health or Save walks to Health Connect off under Settings → Fitness and body, or remove Wildmiler's access in Apple Health or Health Connect settings. Deleting a walk deletes its route and heart rate; deleting a snap deletes its photo and location. Settings → Data and backup → Reset all data deletes everything on your phone and your anonymous account on our server, including a username, scores, friends, blocks and species list if you have them, and reports about you. Delete my account, on the same screen, does the same and explains what goes. Under Me → Compete → Area you can turn off your area listing at any time, which deletes your area from the server. Image fingerprints (35 days, with no account id) and logs (30 days) expire on their own. Uninstalling the app deletes its data from the phone, except that on iPhone the random account id stays in the keychain, so a reinstall keeps the same daily allowance.
Location, camera, microphone, motion and photo access can be changed at any time in your phone's settings. Without location, walks can't be tracked and snaps are identified without a location hint.
Your rights
Because your data lives on your phone, you can see, change, export (Back up) and delete it yourself at any time. The only thing we hold about you is the anonymous account described above, and the username, scores and friend lists if you chose to make them, which you can delete with Delete my account or Reset all data. If you'd rather we delete it, email us the account id shown under Settings → About and help → Developer; we can't look it up any other way, because it isn't linked to you.
Depending on where you live (for example the EU, UK or California), you may have legal rights to access, correct, delete or receive a copy of your personal data, to object to or restrict how it's used, and to complain to your data-protection authority. We won't treat you differently for using them. Where European data-protection law applies, we use your data to provide the service you asked for (identifying snaps and running your daily allowance) and for our legitimate interest in keeping the service working and free of abuse (logs and signup counts); heart rate and location are read only with the permission you give your phone.
We don't sell your personal information and don't share it for cross-context behavioral advertising.
Where your data goes
Our server and Anthropic are in the United States, so if you use Wildmiler elsewhere, the photo, rounded location and account data described above are sent to and handled in the United States, where privacy law may differ from your country's.
Children
Wildmiler is not directed at children under 13, and we don't knowingly collect personal information from them. The username, friends and leaderboard features are for people 13 or older, and you are asked to confirm that before choosing a name. If you believe a child under 13 has used Wildmiler to send us anything, write to [email protected] and we'll delete it.
Changes and contact
If this policy changes, the new version will be posted at https://wildmiler.com/privacy with a new date, and the app will show it. Questions or requests: [email protected].