Privacy Policy: Count My Herd

1 Who we are

Count My Herd is operated by Origae (ABN 21 237 258 402), a business name registered to a sole trader based in Melbourne, Victoria, Australia ("Origae", "we", "us"). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, whether or not the Act strictly applies to a business of our size.

This policy covers the Count My Herd iOS app, the Android app once it is available on Google Play, the web version of the app they load, and this website. Contact: support@countmyherd.com.

2 There are no accounts

Count My Herd has no sign in of any kind. We do not collect or hold your name, email address, phone number, postal address, date of birth, payment card details or any password.

A purchase is proved by a signed token that says which product was paid for: a single count or a count pack. It carries no identity. Apple takes the payment and never shows us your card or your Apple ID.

If you use the Android app, you pay through Google Play Billing. Google takes the payment. We do not receive your card number, your Google account, or your name. We receive a purchase token and an order id so we can check with Google that Google Play charged for one of our products, grant the count or the pack, and then tell Google Play the purchase has been delivered. We do not keep that order id in plain text, and we do not write it in our logs. We keep a hash of the order id with the pack while counts remain, or until you ask us to delete it. A refund of a count pack reaches us through Google Play. A refunded pack cannot be spent. A refunded single count is not taken back. Google also sends a voided-purchase notice when a purchase is voided.

3 What we collect

This is the complete list. If it is not here, we do not collect it.

Photographs of a paddock

You choose between one and ten photographs of a paddock or a mob. Before upload the app shrinks each one to about 1280 pixels on its long side and re-saves it. Re-saving drops the hidden camera data (location, time, camera model) that phones normally embed. On a rare phone that cannot re-save an image, the original is uploaded as it is, hidden data included.

The camera permission is used only to photograph the paddock. You can refuse it and pick a photo instead. Refusing the camera does not block a count, and it does not give the app access to your photo library.

Two things can be in a photograph that are not livestock:

People. Anyone who happens to be in the shot is sent to the AI company with the rest of the photograph. The AI reads the photograph to count the animals; we do not keep it. Avoid photographing people where you can.
Your property. Yards, sheds, signs and vehicles may be visible. We do not look for them and do not record them.

What you choose or type

The species you are counting (cattle, sheep, horses or goats), from a fixed list.
The name you give a paddock, if you save counts to one. See section 3C. Please do not put your own name, a neighbour's name or other personal details in a paddock name.

What the app keeps on your phone

An install number. On first launch the app makes up a random 32-character number and keeps it. It is sent to our server to claim your free first count, to file your paddocks and count history (section 3C), each time a purchase is checked, and to PostHog with each usage event (section 3A) so we can tell a first count from a second. It is not tied to your Apple ID, your phone's serial number or anything else. In the Android app the number is kept only in the app's storage, so uninstalling the app or clearing its data deletes it.
Your free count token, and whether it has been used.
A short list of used purchase numbers, so a purchase that has already unlocked a count is not offered again.
A once-per-launch flag that stops the splash screen repeating. It is cleared when you close the app.
Your language choice, so the app opens in the language you picked.
Payment counts and an unfinished-payment note: the date the app was first opened, how many counts and purchases this install has had, and, only while a payment is in progress, a note of which product, a random number for that attempt, when it started and how far it got. The note is removed when the payment ends, or reported once to PostHog (section 3A) the next time the app opens.
Apple's records of any count packs you buy, so the app can check your balance with our server. These are Apple's signed purchase records, and they hold no name or Apple ID.
Your pack transfer code, if you buy a count pack, so you can open it again from the menu. It is a short code you can write down. It is not your name.

All of this is deleted from your phone when you delete the app. Deleting the app does not delete the paddocks and count history held on our server; section 3C says how to remove those. PostHog also keeps its own random number on your phone, in the app's storage, which is deleted the same way. None of it is a tracking identifier in Apple's sense: it is never combined with data from other companies' apps or websites, and we have no way to link it to your name, email or Apple ID.

Two small cookies in the app

The app sets a cookie called cs_locale for one year. It holds only the two letters of the language you picked (for example "es") and is sent to our server so its messages come back in your language.

If you open the web version of the app in an ordinary browser and add ?web=1 to the address, we set a cookie called cmh_web for one year so you keep seeing the app instead of this website. It holds the value "1" and nothing else. The iOS app never sets it, and neither does the Android app. This website sets no cookies. PostHog, on this website and in the app, is set to use your browser's local storage instead of cookies.

What arrives on its own

Your IP address, from the network request. We use it only to count requests per minute, so one caller cannot run up our AI bill. We do not store it. It sits in the server's memory for about a minute.
Your browser or device type (the "user agent"), which every web request carries. We read it only to tell the iOS app, the Android app and a web browser apart.
Apple's signed purchase record, when you buy a count or a pack. The app sends it to our server so we can check with Apple that it is real. Section 7 says what is in it.
A Google Play purchase token and an order id, when you buy in the Android app. The app sends them to our server so we can check the purchase with Google. Section 2 says what we keep.

3A Usage analytics (PostHog)

We use PostHog, a product analytics service, to understand how the app and this website are used: for example, how many people who photograph a paddock go on to see the count, where purchases are cancelled, and how often an error appears. This is what PostHog receives:

Named events from a fixed list, such as a photo being added, a count starting or finishing, or a purchase being cancelled. Each carries only short codes and counts, for example: camera or photo library, how many photographs, the species, how long the count took, whether it was your first count, whether it finished, failed or timed out, and an error code if something failed. When the app offers a count or a pack, we also record the price shown, its currency, the country of the App Store or Google Play account the price came from, which offer it was, and whether you took it.
For each payment: which product it was and its price as Apple or Google Play shows it on your device, a random number made on your phone for that one attempt (not Apple's purchase number or Google Play's order id), each step it reached and how long each step took, and how many counts you had already paid for or had left.
Page views and taps on buttons and links. For these counts the text on screen is hidden from PostHog, so a tap event says that a button was tapped but not what it said or what was typed.
Your install number, your device type, its operating system and version, your browser type, screen size, language setting, the app version and the app or page address.

PostHog's usage events never include your photographs, your paddock names, the AI's written notes, anything you type, your Apple ID, or Apple's purchase record or purchase number. PostHog does not set cookies here. Like any web service, PostHog receives your IP address with each request. An approximate location (country and usually city) is worked out from the IP, and then the IP is discarded.

PostHog stores this data on servers in the United States and keeps it for the period our PostHog plan sets: one year on its free plan, seven years on its paid plans. If you want your usage data deleted, write to us.

3B Screen recordings (PostHog)

We may use PostHog to record sessions in the iOS app, so we can see where people get stuck. A recording is a replay of the app's screens: what was shown on them, and where you tapped and scrolled. Session replay does not run in the Android app. The web version of the app, opened in a browser, is never recorded, and neither is this website.

If a session is recorded, a recording can only start when a count starts. A recording can show the app's screens, results and prices, including the count, the range, your paddock names and your count history. It never shows anything you type into a box, and it never shows your photographs: they are hidden on your phone before anything is sent, and a blank block appears in their place.

If we record sessions, we use the recordings only to see where people get stuck in the app and to fix it. We do not use them to work out who anyone is, and we do not use them for marketing or advertising. PostHog stores any recording in the United States and, under our settings, keeps it for 30 days, then deletes it.

3C Paddocks and count history

If you save a count to a paddock, our server keeps, under your install number:

each paddock's name, the species you set for it (if any), and when it was made;
each saved count: the species, the estimate, the range, the confidence level, how many photographs were used, and the date.

No photograph is stored with a paddock or a count, and nothing in this history says who you are. The app compares a new count with the paddock's last one and warns you when it is lower. That comparison uses only these numbers.

Deleting it. You can delete a paddock in the app's history screen, which deletes it and its saved counts from our server. To delete all of your paddocks and saved counts at once, open History from the app's home screen and tap Delete my data at the bottom. That deletes every paddock and saved count for this install from our server. It does not touch your purchases or packs, which are kept as section 6 describes. Uninstalling the app removes the install number from your phone, so the history can no longer be opened from a new install, but it does not by itself delete what is on our server. Tap Delete my data first.

What we do not collect

No advertising or tracking pixels, and no analytics beyond the usage counts in section 3A and any screen recordings from the iOS app described in section 3B. No location data: the app has no location permission and never asks for one. No contacts, no microphone, no identifiers from your phone such as its advertising identifier. We do not sell personal information and we do not disclose it for advertising.

4 Why we collect it

Photographs and the species you choose: to produce the count. That is their only use.
The count result we keep (section 6): so the count you unlock is still there when you come back for it.
Paddock names and count history (section 3C): so you can see a paddock's counts over time and be warned when a count is lower than the last.
The install number: to give each install one free count, to file your paddocks, and to count usage per install in PostHog (section 3A).
Usage events (section 3A): to find where the app is confusing or failing and fix it.
Screen recordings from the iOS app (section 3B): to see where people get stuck in the app and fix it.
Apple's purchase record and Google's purchase token: to confirm the purchase is real and unlock what was paid for.
Your IP address: to limit requests per minute.

We do not use any of it for marketing, profiling or advertising.

5 Artificial intelligence

The count is produced by a large AI model that looks at pictures. Your photographs are sent over an encrypted connection to Google LLC, whose Gemini model reads them. If Gemini returns nothing usable, the same photographs are sent to OpenAI, L.L.C. instead. Both are United States companies. Each count is read three times, so the same photographs are uploaded to that company more than once in a single request. The model marks each animal it sees, and our software counts the marks.

We do not store your photographs. They are held in our server's memory for the length of the request and are never written to a disk or a database. The AI company may keep what we send it for up to 30 days under its own terms, for abuse monitoring, before deleting it. That retention is theirs, not ours. We cannot switch it off or shorten it, and we have not verified it beyond reading their terms.

We use both companies' paid developer services. Under their published developer terms, photographs sent that way are not used to train their models. We have not opted in to any training use, and our software sets nothing that would allow it. Those terms belong to the companies and can change; we will update this policy if they change in a way that matters.

Along with the marks, the model returns a short note on how it read the photographs. We store that note with the count result for 30 days (section 6). It is about the animals, but nothing prevents it from mentioning something else that was in the picture.

The AI can be wrong. It can miss animals, count one twice, or mistake one species for another. Section 4 of the Terms of Service explains what that means for you.

6 How long we keep things

Photographs: for the length of the request only. Never written to our disk or database.
The count result (the estimate, the range, where each mark sits on each photograph, the AI's short note, and the photo check): 30 days, then deleted automatically. It is kept for every count, paid or not, under a random 32-character code that only your phone holds. Nothing in it says who you are.
Paddocks and count history: until you delete the paddock in the app, or ask us to delete them. We keep up to 1,000 counts per install; beyond that the oldest are dropped.
Proof of purchase: 120 days. It records that one purchase was used on one count, so a single purchase cannot unlock many counts. It holds a scrambled version of the purchase number, not the number itself, and no identity.
Your install number: on your phone until you delete the app. On Android it is in the app's storage until you delete the app or clear its data. Our server keeps it with your paddocks and count history (above), uses it to sign your free count, and keeps it beside a scrambled version of each purchase number for 400 days, so a later refund notice from Apple can be counted against the same install. PostHog stores it with your usage events for the period below.
A Google Play order id: not kept in plain text, and not written in our logs. We keep a hash of it with the pack while counts remain, or until you ask us to delete it.
Apple's transaction id for a count pack: we keep it while the pack has counts left, and delete it 2 years after the pack's last activity once it has no counts left or it is refunded.
A pack transfer code: if you buy a count pack in the iOS app, we store a scrambled form of the code with Apple's transaction id, the pack, how many counts are still unused, and when that code was used to move those counts to another iPhone. We keep that record while the pack has unused counts, and delete it within 30 days after the last count is used, the counts are moved to another iPhone, or the pack is refunded. The app offers this only between iPhones. A use is written in our logs as a scrambled reference, not the code itself.
Usage events: kept by PostHog for the period our PostHog plan sets: one year on its free plan, seven years on its paid plans.
Screen recordings (iOS app only, if used): kept by PostHog for 30 days, then deleted.
Server logs: our hosting provider keeps short-lived operational logs of requests. Our own log lines record errors and the Apple purchase number of each verified purchase so a refund can be traced. They do not record IP addresses or photographs, and they do not record a Google Play order id in plain text.

7 Who else handles your data

Only these, and only for the purpose named:

Google LLC (United States). Its Gemini model reads your photographs to produce the count. See section 5.
OpenAI, L.L.C. (United States). Reads your photographs as the backup, when Gemini returns nothing usable. See section 5.
Apple Inc. (United States, operating worldwide). Processes purchases made in the iOS app under Apple's own privacy policy. Apple takes the payment; we never see your card or your Apple ID. Apple gives the app a signed purchase record. Our server reads four things from it: which product was paid for, whether it was refunded, the purchase number, and whether it was a test purchase. Our server also contacts Apple to check the record's signature is still valid.
Google Play (Google LLC, United States, operating worldwide). Processes purchases made in the Android app, once that app is available on Google Play, under Google's own privacy policy. Google takes the payment; we never see your card, your Google account or your name. Section 2 says the purchase token and order id we receive, and what we keep.
Vercel Inc. (United States). Runs our server. As at the date of this policy our server functions run in Vercel's Sydney region, so the photograph you upload lands in Australia before it is sent to the AI company. Vercel keeps its own short-lived request logs, which include IP addresses, as any host does.
PostHog (servers in the United States). Receives the usage events described in section 3A, from the app and this website, and any screen recordings described in section 3B, from the iOS app only. It never receives photographs or purchase records.
MongoDB, Inc. (United States). Stores the count result, the proof of purchase, the pack records, and your paddocks and count history, in a managed database. As at the date of this policy that database is hosted in Sydney, Australia. Photographs are never written to it, and nothing in it identifies you.
Google Fonts, on this website only. The pages you are reading load their typeface from Google's servers, so your browser sends Google an ordinary web request when you open them. The app itself does not do this: its typeface is bundled with it.

8 Overseas disclosure

Two different questions, with different answers.

Where your data is stored: Australia, except usage events and screen recordings

The count result, the proof of purchase, the pack records, and your paddocks and count history are held in a database in Sydney, and those records do not leave the country.

The usage events described in section 3A and any screen recordings from the iOS app described in section 3B are the exception. They are stored by PostHog in the United States.

Where your photographs travel: the United States

Your photograph is uploaded to our server in Sydney and from there sent to Google or OpenAI in the United States to be read. Nothing keeps it at either place beyond the count and the AI company's own retention (section 5), but it does cross the Pacific, and that leg cannot be removed while the model that reads it runs there.

Apple processes purchases across its own worldwide infrastructure. Google Play does the same for purchases in the Android app. Google Fonts serves this website's typeface from wherever Google's nearest server is. PostHog stores usage events, and any screen recordings from the iOS app, in the United States.

By using the Count My Herd iOS app, the Android app once it is available on Google Play, or this website, you consent to those overseas disclosures. Those companies are subject to the laws of their own countries, which differ from Australia's, and we do not have the ability to make them follow the Australian Privacy Principles. We have chosen them because their published terms match what this policy says.

9 Security

What is actually in place, not what would sound good:

All traffic to our server is encrypted in transit (HTTPS). The iOS app refuses to load over anything else.
There are no accounts, so there are no passwords to steal and no profile to leak.
Purchase tokens are signed with a secret key only our server holds, so a forged one cannot unlock anything.
Each count result is filed under a random 32-character code. Without the code, which only your phone holds, it cannot be looked up. Paddocks and count history can only be read with the install number that made them.
Every request is checked for size and shape before it is processed, and each address is limited to a set number of requests per minute.
Photographs are never stored, so a breach of our database cannot expose them.
The database is reachable only with credentials we hold. Its provider encrypts stored data by default; that is the provider's control, and we have not independently verified it.

No system is perfectly secure, and we will not claim otherwise. If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

10 Your rights

You may ask to see personal information we hold about you, ask us to correct it, ask us to delete it, or complain about how we have handled it. Write to support@countmyherd.com and we will respond within 30 days.

Be aware of what we can and cannot find. Because there are no accounts, we hold nothing that connects a count or a paddock to a person. For your paddocks and count history, the Delete my data button in the app's History screen deletes them without needing us. If you ask us for "your data" instead, we can only find a count result if you give us its code from your phone, and then we can delete it. Without them, the honest answer is usually that we cannot identify any data as yours, not that we are refusing.

11 Children

Count My Herd is a tool for livestock producers and is not directed at children. Its App Store age rating of 4+ describes its content, not its audience. We do not knowingly collect personal information from anyone under 16, and there is no account through which a child could give us any.

12 Changes to this policy

We will update the date at the top when this changes. If a change materially affects how your photographs are handled, which AI company reads them, or where data is stored, we will say so on this page, and we will send you the previous version if you ask at support@countmyherd.com.

13 Contact and complaints

Origae (ABN 21 237 258 402)
Suite 329, 98-100 Elizabeth Street, Melbourne VIC 3000, Australia
support@countmyherd.com

If you are unhappy with how we handle a privacy question or complaint, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.

Privacy Policy

The short version