cave ai pro

Last updated: 15 April 2026

Data controller: Georgios Kourentzis (individual developer). Contact: caveaipro@gmail.com

This Privacy Policy describes how CAVE AI PRO handles information when you use the App. It covers optional cloud artificial intelligence (AI), location and sensors, optional wearables, optional online features, and related processing. Where the EU General Data Protection Regulation (GDPR) and Greek law apply, we aim to describe our practices in line with those rules. Nothing in this Policy limits rights that applicable law grants you in your country.

1. Who this applies to

You are the person using the App on your device. If you use the App on behalf of an organisation, you should ensure that organisation is aware of this Policy.

2. What runs where

The App is built to work mainly on your device. Survey projects, notes, and most content you create typically stay on the device unless you turn on features that need the internet, optional cloud AI, backup/sync, maps, or you choose to publish or export data.

3. Types of information that may be processed

Depending on your settings and use, the App may process:

• Location and sensors — GNSS/GPS and related location data, plus motion/orientation where used for surveying and mapping. In caves, mines, or large chambers, a GNSS fix can sometimes occur with partial sky view; that position may not match the true surface entrance or your intended survey tie-in until you verify it with independent methods.

• Optional wearable / smartwatch data — If you enable companion features, limited wellness or activity-style metrics from a paired device may be processed on the phone (for example for HUD display or optional wording). The App does not provide medical diagnosis from this data; treat all such values as approximate and non-clinical.

• Content you create — Survey data, shots, notes, sketches, photos, audio memos, and similar project material you save in the App.

• Device and diagnostics — Technical information such as device model and OS version may be used to improve stability. Crash-related information (for example stack traces) may be stored locally in app-private storage for troubleshooting. The App is not designed around third-party advertising or ad-tech “profiling” SDKs.

• Optional cloud AI (Google Gemini) — If you add a Gemini API key and send prompts or images, that content is sent to Google and processed under Google’s terms and privacy notices for that service. Do not use cloud AI as a substitute for professional medical interpretation of wearable readings.

• Optional public library / publication — If you choose to publish material, the fields you submit (for example name, email, cave metadata, photos, optional survey files) may be stored and shown to other users as designed for that feature.

• Purchases and subscriptions — Premium access may be offered through an auto-renewing subscription billed via Google Play under Google’s terms and privacy policy. The App does not receive your full payment card details. The App uses Google Play Billing on the device to determine subscription entitlement for the in-app product (for example whether you have an active subscription, an active free-trial phase configured in Play where applicable, or a purchase still pending) solely to unlock premium features. Trial duration, price, and eligibility are shown in Google Play at purchase time and may vary by region or account. You manage or cancel the subscription in Google Play → Payments & subscriptions (or your Google account subscription settings); uninstalling the App does not cancel an active subscription.

• Installation grace & access enforcement — The App may offer a limited period of full access (currently seven (7) days) before a paid subscription is required. To anchor that period and limit abuse (for example repeated uninstall/reinstall on the same device), when `google-services.json` is present, you have network connectivity, and Google Play services provide it, the App reads Google’s Play App Set ID, computes a one-way hash (SHA-256) on device, and stores or updates small timestamp records in Google Cloud Firestore (collection `app_install_grace`) keyed by that hash. Firebase Authentication may use a Google-signed-in session you already have, or otherwise sign in anonymously, solely so Firestore rules can authorise those minimal reads/writes; this is separate from optional “cloud sync” toggles in Settings. The hash is not designed to identify you by name by itself; combined with provider logs it may constitute pseudonymous data under GDPR.

4. Why we process data (legal bases under GDPR Article 6, where applicable)

• Contract and pre-contract — To provide the App and features you ask for (Art. 6(1)(b)).

• Legitimate interests — For example stability, security, fraud prevention, subscription access enforcement, and compatibility, where we balance those interests against your rights (Art. 6(1)(f)).

• Consent — For certain optional processing (some permissions, optional cloud AI, optional publication). You can withdraw consent by turning off the feature or revoking permission where the system allows; some effects may continue until data is deleted according to provider rules (Art. 6(1)(a)).

5. AI: on-device and in the cloud

• On-device — Where a feature runs entirely on your device, inputs may never leave the device.

• Optional cloud (Gemini) — If you enable it, your prompts and attachments may be processed on Google’s systems. Read Google’s documentation on retention, logging, and regions. Avoid sending special categories of personal data (such as detailed health data) unless you have a clear lawful basis and accept the risk.

6. Retention and deletion

Project data is primarily under your control on the device until you export it, sync it, or publish it. Local diagnostic snapshots may be removed over time after use. By default, the developer does not hold a copy of your complete project database on a central server. Uninstalling the App may delete local data unless you have exported or backed it up elsewhere. Cloud and map providers apply their own retention rules to data you send them. Firestore documents used for the installation grace (`app_install_grace`) contain only numeric timestamps tied to a hash of the Play App Set ID; they may be retained for as long as needed for abuse prevention and billing integrity, and can be deleted on verifiable request where the controller can match your request to the stored record (which may be limited if only a pseudonymous hash exists).

7. Recipients and processors

Google entities (including Google LLC / Google Ireland Limited) and Firebase-related services may act as processors or separate controllers for Play, authentication, storage, database, maps, and Gemini, depending on the feature. Bluetooth or other hardware vendors follow their own policies when you connect equipment.

8. Transfers outside the EEA

If information is processed outside the European Economic Area, providers such as Google may rely on safeguards (for example Standard Contractual Clauses) as described in their documentation.

9. Security

We use reasonable technical and organisational measures appropriate to the nature of the App. No method of storage or transmission is completely secure. You should use a device passcode, careful backup practices, and physical control over exported files.

10. Your rights

Where the law gives you rights, you may be entitled to request access, correction, deletion, restriction of processing, data portability, or to object to certain processing, and to complain to a supervisory authority. In Greece, the Hellenic Data Protection Authority is at www.dpa.gr. To contact the controller about data we actually hold as controller, email caveaipro@gmail.com. For data that exists only on your device, your practical options may be limited to deleting the App, clearing data in system settings, or exporting what the App allows.

11. Children

The App is not aimed at children under 16. Do not supply children’s personal data without proper legal authority.

12. Automated suggestions

AI outputs are probabilistic suggestions only. They must not replace human judgment for safety-critical, medical, or legally binding decisions.

13. Changes to this Policy

We may update this Policy from time to time. We will change the “Last updated” date above and, when appropriate, show a notice in the App.

14. Contact

Georgios Kourentzis — caveaipro@gmail.com