Useful data. Nothing more.

Permissions and your choices

Picchu requests iOS permissions when a feature needs them: camera access to take photos or show the live view, microphone access to record bird songs, location for altitude and geographic features, and motion to align mountains in the camera and terrain horizon views. The microphone activates only after your action. From the Camera screen, you can start continuous listening for bird songs while that screen remains active. Listening and recording stop when you leave the screen or the app enters the background.

Importing an audio file or a selected video does not require microphone permission. System pickers provide only the files, photos or videos you choose. Picchu never requests full photo library access.

To add a photo taken in the app to Photos, Picchu requests add-only permission. If you decline, you can still use the photo in Picchu. No Picchu album is created or managed. Deleting a photo in Picchu does not delete its copy in Photos.

Photo and recording locations are optional: you can select a position manually, change it or save without precise coordinates. Background location is requested only when you enable background altitude tracking. Permissions can be revoked in iOS Settings; declining affects the features that depend on them.

Private account saving and restoration use the internet connection without an additional iOS system permission. Camera, microphone and Photos permissions do not authorize publication of your media.

Location and altitude

When permitted, Picchu uses location to show your position and altitude, find nearby wildlife and summits, record routes and optionally geotag an observation.

Precise coordinates may be sent and linked to your account when you use online identification, sync an observation, geotagged photo or recording, or publish a route export. A published export makes its coordinates, dates and photos available to anyone who has its link.

Background altitude tracking stays off until you enable it. You can revoke permission in iOS Settings.

Camera and photos

The camera opens only from features that need it. Picchu never takes a photo automatically.

If you select an offline model (BioCLIP 2 or BioCLIP 1), the photo is analyzed directly on your device without being sent to Picchu or Modal for that analysis. A connection is needed to download the model and relevant data before using them offline.

In online BioCLIP 2.5 mode, a copy of your selected photo without EXIF metadata is sent to the Picchu server as soon as it is prepared, even before you start identification, to reduce waiting time. During analysis, this copy is sent to Modal, the provider hosting Picchu’s AI model. The Picchu server is hosted on Railway.

The preloaded copy is held temporarily in memory on the Picchu server, not in your account’s photo storage. It is automatically erased no later than 10 minutes after preload, or earlier after use or when the app requests removal. Photos sent for analysis are not automatically added to your observations.

Attaching a photo to an observation is a separate action. Photos you choose to save are re-encoded as JPEG and may be kept in private storage linked to your account until you delete them.

Bird songs and audio files

The bird song identification model is downloaded before first use. Bird songs are then analyzed on your device, including offline; audio is not sent to an AI service for this analysis.

During continuous listening in the camera, audio stays in a local rolling memory buffer limited to the latest 15 seconds. The full listening session is not recorded to a file. Only excerpts you confirm are saved and can sync privately to your account.

You can record with the microphone, choose an audio file or import the audio track of a selected video. Only the selected passage, lasting 1 to 15 seconds, is saved after confirmation. Video images are not included in this saved audio file.

Confirmed recordings contain the compressed passage, a stable identifier, duration, available dates, associated birds and, if attached, the observation location. One file can be associated with multiple birds. Recordings may contain voices or ambient sounds: check the selected passage before saving.

Private saving and account synchronization

Photos and bird songs you choose to save or confirm are stored on the device. Guest saves stay local. When you sign in, guest saves are transferred to your account and become eligible for private synchronization.

With an account, confirmed files are uploaded to the private Cloudflare R2 storage used by Picchu. Their metadata and associations are stored in the Picchu services hosted on Railway. Media and attached coordinates are linked to your account so they can be restored after signing in or on another device.

Without a connection, saves and deletions remain in a persistent local queue. They resume when the app can access the network again, including when opened or brought to the foreground. Failed files are retried independently.

Synchronization does not publish your photos or bird songs. Private file access uses your account and temporary download links. Publishing a route export is a separate sharing feature for the information and photos it contains.

Account

Sign-in provides access to services linked to your account. Picchu stores your email address, a stable account identifier, sign-in providers, and information required for authentication and session security. Passwords are never stored in plain text.

Subscription

Apple processes purchases of the BioCLIP subscription. Picchu receives no payment-card data. To grant access to the correct account, Picchu stores the transaction identifier supplied by Apple, product identifier, subscription status, and its expiration or revocation dates.

Deleting a Picchu account does not automatically cancel the App Store subscription, which must be managed separately with Apple.

History and local storage

Altitude readings, routes and histories displayed in the app are stored locally by default. You can remove them from Picchu. Removing the app also removes data that has not been published or linked to an online service.

Online services

A connection is required for account creation, identification with online BioCLIP 2.5, downloading models or new data, and some saving, syncing and sharing features. Offline models that have already been downloaded can identify a photo without a connection.

For each online identification, Picchu stores in your account the supplied coordinates, country and taxonomic group, top result, prediction list and technical processing-time data. Clearing the history displayed locally in the app does not erase this server record; it is deleted with the account.

Synced observations, reports, private photos and recordings and published exports are also linked to your account. Picchu uses Railway for the server and database, Cloudflare R2 for photos, audio passages and exports, Modal for online BioCLIP processing, Apple for subscriptions and Apple sign-in, and Google if you choose Google sign-in. Public export maps load OpenStreetMap tiles.

Species profiles may include public content and images from sources such as GBIF, iNaturalist, Wikimedia or Wikipedia, with attribution.

Website audience measurement

picchu.app uses a self-hosted Umami instance on Railway to measure viewed pages, traffic sources, approximate country and device type anonymously. It sets no analytics cookie, is not linked to Picchu accounts and is never used for advertising or personal profiling.

An IP address may be used briefly to produce a hashed technical identifier and approximate location, but it is not stored. Anonymous statistics are kept for no more than thirteen months. Search crawlers are counted separately from their technical signature.

Retention and deletion

Preloaded identification photo copies are deleted no later than 10 minutes after preload. Private photos and recordings and public exports remain until you delete them. Account data, synced observations, identifications, reports and subscription data remain until account deletion unless a legal duty requires otherwise.

You can delete local readings, photos, recordings, exports and your account in the app. Account deletion removes associated active data; temporary technical backups may remain only for the hosting provider’s recovery cycle before being overwritten.

Deleting an entire audio recording removes its bird associations and its private file. Removing only one bird keeps the file while it remains associated with other birds. An offline deletion must still sync before it takes effect on the server. Originals in Photos or Files are separate from Picchu copies and must be deleted separately.

Security

Network exchanges use encrypted connections. Private photos, recordings and account data are protected by authentication and short-lived links where appropriate.

Your rights and settings

Saving and location choices are made in the app; technical permissions are managed in iOS Settings. Revoking a permission does not automatically erase previously saved data: you can delete media or your account in Picchu.

To request access, correction, erasure or portability of your data, or exercise other applicable rights, email [email protected]. You may also lodge a complaint with the CNIL or your competent data protection authority.

Contact

For questions about your data or to exercise your rights, email [email protected].

Your audience measurement choice