Privacy Policy

Last updated: 3 July 2026 · Effective: 3 July 2026

PaleoDex is built on a simple principle: everything is sourced, and nothing is hidden. That applies to your data too. This policy explains what personal data we collect, why, how we protect it, and the rights you have over it — written to meet the EU/UK GDPR, Chile's Law No. 19.628 as amended by Law No. 21.719, and recognized global best practice.

1. Who we are

PaleoDex ("PaleoDex", "we", "us") is an independent paleontology app and website operated by a sole developer based in Chile, Rodrigo Leonel Toloza Monsalvez - 18.050.959-3. For the purposes of the GDPR and Chilean Law No. 21.719, we are the data controller responsible for your personal data.

You can reach us about anything in this policy at hello@paleodex.co. This is also the address to use to exercise any of your data-protection rights (see Section 10).

2. What data we collect

a. Information you give us — the website

• Waitlist sign-up: your first name and email address, and the fact that you ticked the consent box. This is stored in our CRM (HubSpot).
• Email & messages: if you email hello@paleodex.co or otherwise contact us, we keep your message and contact details so we can reply.

b. Information we collect automatically — the website

• Usage & device data: pages viewed, referring links, approximate location derived from your IP address, browser and device type, and similar diagnostic data, collected via cookies and our analytics/CRM tools.
• Server logs: our hosting provider records IP addresses and request metadata for security and reliability.

c. Information collected by the PaleoDex app

In the PaleoDex mobile app:

• On-device by default: your collection, in-game progress, and settings are stored locally on your device, not on our servers.
• Location (optional): if you turn on GPS field mode, your device's approximate location is used to find fossil sites near you and to query that map region. It is used for that one search and never stored. You can use the app, pan, and scan any region without sharing your location, and you can revoke the permission at any time in your device settings.
• Anonymous leaderboard (opt-in): if you choose to join the online leaderboard, we process an anonymous skill score and a display name of your choosing. It is opt-in and does not require an account or your real identity.
• Cloud backup & Google sign-in (optional): you can sign in with Google to back up your collection and progress to our servers and restore them on another device. When you do, Google provides your email address to identify your account, which we store only for that purpose. If you don't sign in, none of this leaves your device.
• Purchases (optional): if you buy the Field Researcher License or a Dig Pack, our in-app purchase platform (RevenueCat) processes the transaction through the App Store / Google Play and links it to an anonymous purchaser ID — we never see your card details.
• No analytics or ads: the app contains no third-party analytics, advertising, or crash-reporting tools, and sends no usage telemetry.

The scientific content in PaleoDex (species, occurrences, classifications) comes from open databases — it is not your personal data. See the data sources listed on our site. The SIGNAL feed in the app also fetches public headlines from third-party science news outlets — see the sharing table below.

3. Why we use your data & our legal bases

We only process personal data where we have a lawful basis to do so. Under the GDPR and Law No. 21.719, our bases are:

We follow the principles of lawfulness and fairness, purpose limitation, data minimization, accuracy, storage limitation, security, transparency, and accountability — the shared core of the GDPR and Chile's Law No. 21.719. We collect the minimum we need and never use your data for purposes incompatible with those above without telling you first.

4. Cookies & tracking

We use a small number of cookies and similar technologies:

• Strictly necessary — needed for the site to work and to remember your cookie/consent choices.
• Analytics & marketing — set by our CRM/analytics provider (HubSpot) to understand traffic and measure interest. These are used only where you consent, where consent is required.

You can control cookies through our cookie banner (where shown) and through your browser settings. Blocking some cookies may affect how the site works. Our pages also load web fonts from a third-party font provider, which may receive your IP address as part of serving those files.

5. Who we share data with

We do not sell your personal data or share it for others' advertising. We share it only with service providers ("processors") who help us run PaleoDex, under contracts that require them to protect it:

We may also disclose data if required by law, to protect our rights or users' safety, or in connection with a future business transfer — in which case we will tell you.

6. International data transfers

Some of our providers (for example HubSpot) process data outside Chile and outside the EU/EEA, including in the United States. When personal data is transferred across borders, we rely on appropriate safeguards required by the GDPR and Chile's Law No. 21.719 — such as transfers to countries recognized as providing an adequate level of protection, or Standard Contractual Clauses and equivalent contractual guarantees. You can ask us for details of the safeguards that apply.

7. How long we keep data

• Waitlist data: until you unsubscribe or ask us to delete it, or until the waitlist purpose ends, after which we delete or anonymize it.
• Emails: for as long as needed to handle your request and a reasonable period afterward.
• Analytics/logs: for a limited period, then deleted or aggregated.
• App data on your device: stays until you delete it or uninstall the app.
• App data on our servers (your leaderboard handle and scores, and — if you enabled it — your cloud backup): kept until you delete it. You can erase all of it from the app via Settings → "Delete my data", which removes your on-device data, your leaderboard profile and scores, and your cloud backup, and signs you out — or email us to request deletion.

8. Security & data breaches

We apply reasonable technical and organizational measures appropriate to the risk — including encryption in transit, access controls, and data minimization — to protect your data against loss, misuse, and unauthorized access. No system is perfectly secure, but we work to keep risk low.

If a personal-data breach occurs that is likely to create a risk to your rights, we will notify the competent authority — including Chile's Agency for the Protection of Personal Data (APDP) within 72 hours of becoming aware of it, where required — and will inform affected individuals without undue delay where the risk is high.

9. Children's privacy

Under Chilean law, the data of niños (under 14) and adolescentes (14–17) receives special protection, and a minor's own consent is not, by itself, valid — verifiable consent from a parent or legal guardian is required, always in the child's best interest. COPPA (US, under 13) and the GDPR (13–16 depending on country) take the same approach.

If you believe a child has provided us personal data, email hello@paleodex.co and we will delete it promptly. Note that the app itself stores gameplay on the device and does not require children to provide personal information to play.

10. Your rights

Depending on where you live, you have some or all of the following rights over your personal data. Chile's Law No. 21.719 guarantees the "ARCO+" rights, which closely mirror the GDPR:

• Access — get a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure / cancellation — have your data deleted when it is no longer needed.
• Objection & restriction / blocking — object to or limit certain processing.
• Portability — receive your data in a portable format, or have it sent to another provider.
• Withdraw consent — at any time, without affecting prior processing (e.g., unsubscribe from emails using the link in any message).
• Not be subject to solely automated decisions that significantly affect you (we don't make any such decisions).

To exercise any right, email hello@paleodex.co — or, for data the app holds, use Settings → "Delete my data" in the app to erase it immediately. We will respond within the timeframe required by applicable law (and aim to do so promptly). Exercising your rights is free, and we will not discriminate against you for doing so.

11. Regional notices

Chile

We process personal data in accordance with Law No. 19.628 as amended by Law No. 21.719. If you believe we have not handled your data lawfully, you may complain to the Agencia de Protección de Datos Personales (APDP) once it is operational, in addition to contacting us directly.

European Union / EEA & United Kingdom

If you are in the EU/EEA or the UK, the GDPR (and UK GDPR) applies to data we collect about you. You have the right to lodge a complaint with your local supervisory authority. As a small operator outside the EU, we currently rely on direct contact at hello@paleodex.co for data-protection requests.

United States (California & others)

We do not sell or "share" personal information as those terms are defined under the CCPA/CPRA. California and other US residents may request access to or deletion of their personal information by contacting us.

12. Changes to this policy & how to contact us

We may update this policy as the product and the law evolve (Chile's Law No. 21.719 takes full effect on 1 December 2026, and we are aligning ahead of that date). We will post the new version here with an updated date and, for material changes, give prominent notice.

Questions, requests, or concerns: hello@paleodex.co.