Privacy Policy

Photographs of an animal

You choose between one and four photographs of an animal. Before upload the app shrinks each one to about 1280 pixels on its long side and re-saves it. Re-saving drops the hidden camera data (location, time, camera model) that phones normally embed. On a rare phone that cannot re-save an image, the original is uploaded as it is, hidden data included.

The camera permission is used only to photograph the animal. You can refuse it and pick a photo instead. Refusing the camera does not block a weighing, and it does not give the app access to your photo library. The photo is handled the same way as a photo from the iOS app or the website.

Two things can be in a photograph that are not an animal:

• People. "A person · 1.75 m" is one of the reference objects the app offers. Choosing it tells the AI what is in the photograph and roughly how tall it is. The AI may treat that as a hint; it is not a measured scale and it does not change the range the app shows. If you use it, a photograph of that person is uploaded and read by an AI company. Do not use a person as your reference unless they are happy with that. Anyone else who happens to be in the shot is treated the same way: the AI reads the photograph, we do not keep it.
• Your property. Yards, sheds, signs and vehicles may be visible. We do not look for them and do not record them.

What you choose or type

• The reference object you pick from a fixed list.
• If you mark a known length on a photograph, the two points you tapped and the length you typed.
• If you choose to send one, the real scale weight of an animal you have already assessed. See section 12.

What the app keeps on your phone

• An install number. On first launch the app makes up a random 32-character number and keeps it. It is sent to our server to claim your free first weighing, each time a purchase or your weighing-pack balance is checked, and when the app opens, so a pack can be added to this phone if it did not arrive, and to PostHog with each usage event (section 3A) so we can tell a first weighing from a second. It is not tied to your Apple ID, your phone's serial number or anything else. When you weigh, it is sent with the photographs only so our server can tell your free first weighing from a later one (and, if we are adding a pack to your phone, to note that the phone contacted us, as section 6 explains). It is not stored with your photographs, which we never store, or with the assessment. When your free first weighing is used, we keep a scrambled code made from the install number, paired with that assessment's code, for 120 days, so the free weighing cannot be used twice. It is never sent with scale weights. In the Android app the number is kept only in the app's storage, so uninstalling the app or clearing its data deletes it.
• Your free weighing token, and whether it has been used.
• A short list of used purchase numbers, so a purchase that has already unlocked a weight is not offered again. Up to the last fifty.
• A once-per-launch flag that stops the splash screen repeating. It is cleared when you close the app.
• Your language choice, so the app opens in the language you picked.
• Payment counts and an unfinished-payment note: the date the app was first opened, how many weights and purchases this install has had, and, only while a payment is in progress, a note of which product, the random number for that attempt, when it started and how far it got. The note is removed when the payment ends, or reported once to PostHog (section 3A) the next time the app opens.
• An unfinished weighing note: only while a weighing is in progress, a random number for that weighing, when it started, how many photographs, camera or photo library, the size of the upload, which language the app is showing and, once the photographs have left the phone, how long the upload took. The note is removed when the weighing ends, or reported once to PostHog (section 3A) if the app is closed or moved to the background first. The app also keeps the random numbers of its last 20 reported weighings, so none is reported twice. These random numbers stay on your phone and are never sent to us or to PostHog.
• Apple's records of any weighing packs you buy, so the app can check your balance with our server. These are Apple's signed purchase records, and they hold no name or Apple ID.
• Your pack transfer code, if you buy a weighing pack, so you can open it again from the menu. It is a short code you can write down. It is not your name.
• Your local price, if you type one in to see an animal's value in your own currency: the price per kilogram and the currency. It is used on your phone only and is never sent to us or anyone else.
• Which offer this install sees after a second weight (the report or a 10-weighing pack), picked at random once so the app shows the same offer each time. It is sent to PostHog with the offer events in section 3A.
• Photographs you have taken but not yet weighed. They stay only on your phone, so they are not lost if you open the ruler sheet or the app reloads. They are deleted when the weigh succeeds or you start a new animal. If you leave them for more than 2 hours, they are deleted the next time the app opens. They are never uploaded until you tap Weigh.

All of this is deleted when you delete the app. PostHog also keeps its own random number on your phone, in the app's storage, which is deleted the same way. None of it is a tracking identifier in Apple's sense: it is never combined with data from other companies' apps or websites, and we have no way to link it to your name, email or Apple ID. On Android, deleting the app removes the install number with the rest of what the app kept on the phone. To ask us to delete usage data from the Android app, email support@cattlescale.app.

Two small cookies in the app

The app sets a cookie called cs_locale for one year. It holds only the two letters of the language you picked (for example "es") and is sent to our server so its messages come back in your language.

If you open the web version of the app in an ordinary browser and add ?web=1 to the address, we set a cookie called cs_web for one year so you keep seeing the app instead of this website. It holds the value "1" and nothing else. The iOS app never sets it, and neither does the Android app. This website sets no cookies. PostHog, on this website and in the app, is set to use your browser's local storage instead of cookies.

What arrives on its own

• Your IP address, from the network request. We use it only to count requests per minute, so one caller cannot run up our AI bill, and to label scale-weight submissions in a way that cannot be reversed (section 12). We do not store it. It sits in the server's memory for about a minute.
• Your browser or device type (the "user agent"), which every web request carries. We read it only to tell the iOS app, the Android app and a web browser apart.
• Apple's signed purchase record, when you buy a weighing. The app sends it to our server so we can check with Apple that it is real. Section 7 says what is in it.
• A Google Play purchase token and an order id, when you buy in the Android app. The app sends them to our server so we can check the purchase with Google. Section 2 says what we keep.

3A Usage analytics (PostHog)

We use PostHog, a product analytics service, to understand how the app and this website are used: for example, how many people who photograph an animal go on to unlock the weight, where purchases are cancelled, and how often an error appears. This is what PostHog receives:

• Named events from a fixed list, such as "photo added", "weigh started", "purchase cancelled" or "weight revealed". Each carries only short codes and counts, for example: which angle, camera or photo library, how many photographs, how long the weighing took, an internal note on the reading (not shown in the app), whether it was your first, second or third weight, and an error code if something failed. If the app could not find a farm animal in your photographs, the same event also carries one word from a fixed list of four: no animal, blank, person or object. That word says what kind of thing the AI reported seeing. It is never a description of your photograph. When a payment fails we also record the error message from Apple or from our server (never anything you typed), the device's language setting and time zone, and how long the attempt took. For each weighing we also record whether it finished, failed, timed out or was left before an answer, how large the upload was, how long the photographs took to leave the phone, whether it ran in the iOS app, the Android app or a web browser, whether you used a scale reference, and the country part of your phone's language setting (for example AU from English (Australia)). That country comes from the language setting. When the app offers a weighing, a pack or the report, we also record the price shown, its currency, the country of the App Store or Google Play account the price came from (for example AUS), which offer it was, and whether you took it or closed it and after how many seconds. That store country is a country only, set by the store account, not where you are. The app does not use GPS or your IP address for any of this, and none of it includes your Apple ID, Google account or purchase records. PostHog's own rough estimate from your IP address is described below.
• For each payment: which product it was and its price as Apple or Google Play shows it on your device, a random number made on your phone for that one attempt (not Apple's purchase number or Google Play's order id), each step it reached (Apple's payment sheet, our check of the purchase, the weight being shown or the report being made) and how long each step took, how many weighings you had already paid for or had left, how many days since you installed the app, and how many weights and purchases this install has had. If the app is closed in the middle of a payment, it remembers that on your phone and reports it the next time it opens.
• When Apple tells our server about a payment or a refund: the kind of notice, the product, its price and currency, and the country of your App Store account, joined to your install number when we know it. Never Apple's purchase number or Google Play's order id.
• When our server checks a Google Play purchase, or Google Play tells our server about a refund, a cancelled or voided purchase, or a charge, we record the kind of notice, the product, its price and currency from our Google Play price list, and the country of your Google Play account, joined to your install number when we know it. Never Google Play's order id, your Google account or your card.
• Page views and taps on buttons and links. For these counts the text on screen is hidden from PostHog, so a tap event says that a button was tapped but not what it said or what was typed. Screen recordings (section 3B) work differently.
• Your install number, your device type, its operating system and version, your browser type, screen size, language setting, the app version and the app or page address.

PostHog's usage events never include your photographs, the weight, measurements or value of your animal, the AI's written assessment, anything you type, your Apple ID, or Apple's purchase record or purchase number. Screen recordings are different. If we record a session in the iPhone app or the Android app, the recording can show what was on screen, as section 3B explains. PostHog does not set cookies here. Like any web service, PostHog receives your IP address with each request. An approximate location (country and usually city) is worked out from the IP, and then the IP is discarded.

PostHog stores this data on servers in the United States and keeps it for the period our PostHog plan sets: one year on its free plan, seven years on its paid plans. If you want your usage data deleted, write to us. The app does not show you its install number, so we usually cannot pick out which data is yours. Deleting the app removes the install number and PostHog's own number, so any new usage cannot be linked to the old.

3B Screen recordings (PostHog)

In the Android app the analytics platform is recorded as android. Session replay runs in the iPhone app and in the Android app from the start of a weigh. The same masking applies in both apps: what you type into a box is hidden, and the photo areas are hidden. We use PostHog to record these sessions so we can see where people get stuck. A recording is a replay of the app's screens: what was shown on them, and where you tapped and scrolled. A session opened in a web browser is not recorded, and neither is this website.

A recording starts when a weigh starts, including your free first weighing, and not before. Until a recording has started, opening the app, adding or choosing photographs and the other screens you see before you tap to weigh are not recorded. Once a recording has started it can carry on while the app stays open, so it can also show the results, offers and screens you open after the weigh. If the app has been left open for a long time, the recording can continue into your next visit without a new weigh. A session in the iPhone app or the Android app that never has a weigh, and never had one earlier in the same app launch, is not recorded.

What a recording can show:

• The app's screens, results and prices, and the other text on them. That includes the assessment of your animal (breed, sex, age, measurements, body condition and the AI's notes), the warnings above the weight, the range around the weight, prices and pack offers, your balance of weighings and, once you unlock it, the weight, the dollar value and the AI's short explanation.
• Where you tapped and scrolled, and which screens you moved between.
• The same details that come with usage events (section 3A): your install number, your device type, its operating system and version, your browser type, screen size, language setting, the app version and the app address, and PostHog's rough estimate of your location from your IP address.

What a recording never shows:

• Anything you type into a box, such as a length you mark, a scale weight or your own price. If a session is recorded, what you type is masked on your phone before anything is sent, and we also hide the "Marked:" line that shows a length you marked and the "Your local price" card that shows your animal's value at your own price.
• Your photographs. If a session is recorded, we hide them everywhere the app shows them, including the keepsake preview and the name box. That includes the photo tiles, the screen where you mark a known length, and the "Your photos" card on the results screen. The recording shows a blank block in their place. Photographs are never sent to PostHog.

If we record sessions, we use the recordings only to see where people get stuck in the app and to fix it. We do not use them to work out who anyone is, and we do not use them for marketing or advertising.

PostHog stores any recording on servers in the United States. Under our PostHog settings it keeps each recording for 30 days, then deletes it. CattleScale has no accounts and no sign in, and never asks for your email address, so a recording is linked only to random numbers made on your phone, such as the install number. The limits on finding and deleting your data described in section 3A apply to recordings too.

3C The keepsake

If you buy a CattleScale Keepsake, it is drawn on the phone. The photograph you choose for it and the name you type never leave the device. They are not sent to us, to any AI company, or to PostHog, and we do not store them or write them in a log. Apple's purchase check is the signed purchase record in section 7, and that record carries no photograph and no name. A screen recording hides that photograph and that name, as section 3B describes.

What we do not collect

No advertising or tracking pixels, and no analytics beyond the usage counts in section 3A and the screen recordings described in section 3B. Those recordings come only from the iPhone app and the Android app, never from a web browser. No location data: the app has no location permission and never asks for one. No contacts, no microphone, no identifiers from your phone such as its advertising identifier. A screen recording never includes your photographs or what you type into a box. We do not sell personal information and we do not disclose it for advertising.

Where your data is stored: Australia, except usage events and screen recordings

The assessment, the proof of purchase and any scale weight you send are held in a database in Sydney, and those records do not leave the country.

The usage events described in section 3A and any screen recordings from the iPhone app and the Android app described in section 3B are the exception. They are stored by PostHog in the United States. A screen recording can show what was on screen, including your animal's assessment and, once unlocked, its weight and value, so if a session is recorded, a copy of that information as it appeared on screen is stored in the United States for 30 days.

Where your photographs travel: the United States

Your photograph is uploaded to our server in Sydney and from there sent to Google or OpenAI in the United States to be read. Nothing keeps it at either place beyond the assessment and the AI company's short retention (section 5), but it does cross the Pacific, and that leg cannot be removed while the model that reads it runs there.

Apple processes purchases across its own worldwide infrastructure. Google Play does the same for purchases in the Android app. Google Fonts serves this website's typeface from wherever Google's nearest server is. PostHog stores usage events, and any screen recordings from the iPhone app and the Android app, in the United States.