Privacy policy

Last updated November 7, 2026

Concho is run by Rec-Safe (RECSAFE), a Washington corporation ("we" and "us"). This policy says what Concho keeps about you, why, who else sees it, and what you can do about it. It covers Concho only; our other sites and apps have their own.

What we keep

When you use Concho, we keep:

• your email address, your name, your time zone, your collection's currency and country, your catalogue number prefix, the name you put on labels, your reminder settings, the note you leave for your heirs, and whether (and under what name) your photos are shared in the Conchopedia
• each specimen's details: what it is (its group, species, common name, and form), its catalogue number, where it came from (its locality, region, and country, and its exact spot, encrypted), how it was taken (the method, whether alive or empty, the depth and habitat), how and when it came and who found it, from whom and what you paid, any permit (encrypted), its size, weight, grade, and features, where it's kept (its place's name and its exact spot, both encrypted), its values over time, whether it's kept off galleries and a note for gallery visitors, its tags and notes, and, once it's gone, when, for what, how, and to whom (encrypted)
• your collecting spots: their names, what and where they are, whose land they're on, their rules and finds, and their GPS, directions, and access notes (encrypted); and your shelling trips: when, where, who went, the weather, a packing list, and notes
• the photos, maps, GPS tracks, and papers you upload (encrypted)
• your checklists, want list, storage places, sources (dealers, shows, clubs), dates to keep, and calendar events
• your galleries (what each shows and how much, and how many visits it has had), and the messages visitors send from them: the name and email address they give (the address encrypted) and their message (encrypted)
• the people you share your collection with, and their invitations
• a sign-in log (the time, IP address, and browser), to keep accounts safe

You sign in with a one-time link emailed to you, or a passkey.

Photos and papers are encrypted before they're stored, with a key for your collection, and are sent only to you and the people you share it with, except a specimen's photos, which a gallery that shows that specimen also shows while it's on, and a specimen's main photo when you share it in the Conchopedia. Photos are re-saved first, which removes the location and other camera details saved in them.

Like any website, our servers also keep a short log of the pages asked for (with the IP address, the browser, and the time), to keep the site running and safe. We don't use analytics, advertising, or tracking services.

Why we keep it

Only to run Concho for you: to keep your collection's records and work out its totals, to fill in specimens' names from the Conchopedia, to show the galleries you make, to pass on gallery visitors' messages to you, to send sign-in links, invitations, and the reminders you ask for, and to keep Concho working and secure. We don't sell or rent your information, we don't show ads, and we don't use it for anything else.

Who else sees it

Nothing in your collection is public unless you make a gallery: a page anyone with its link can open, showing the specimens you choose with their photos, what each is, and as much of where it came from as you pick (its locality, its region, its country, or none), and, if you choose, its size, its grade and how it was taken, the year it was found, your name, and asking prices of what's for trade or sale. A gallery never shows what you paid, values, sources, where things are kept, exact spots, your collecting spots, permits, your notes, tags, or papers, or your email address. Search engines are asked not to list galleries, and you can turn one off or change its link at any time. If you let visitors message you from a gallery, their message is emailed to you with their address to reply to; they don't see yours unless you reply. Exact spots, spot GPS, directions and access, permits, where things are kept, who they went to, gallery messages, and every photo and paper are encrypted where they're stored, with a key for each collection. The Conchopedia is the same for everyone signed in, and isn't public. If you choose to share your photos there (it's off unless you turn it on, in Settings or on a specimen), each shared specimen's main photo is shown to everyone signed in on the entry for its species, credited to the name you choose, and nothing else about you or the specimen; photos are saved without the location data a phone puts in them. Anyone signed in can report a shared photo, which hides it until the people who run Concho look at it. The people who run Concho don't look at collections. Reminder emails name dates, never specimens or spots. Everything is stored on servers in the United States.

We use these services to run Concho, and each sees only what it needs:

• Amazon Web Services, which hosts our servers in the United States, where everything the app keeps is stored
• Postmark, which sends our emails, so it handles your email address and the message

We'd share information if the law makes us (a court order, for example), or to protect someone's safety. If Rec-Safe ever handed Concho to someone else, this policy would go with it.

Cookies

Concho uses cookies to keep you signed in (for up to 60 days) and to remember how you like the list of shells shown. They aren't used for advertising or tracking.

How long we keep it, and deleting it

We keep your information while you use Concho. You can delete any specimen, spot, trip, photo, paper, gallery, message, or record, download your collection, and delete your account, which deletes your collection with everything in it and turns off its galleries and we'll do it, apart from anything the law makes us keep (such as payment records). Server logs are kept only as long as they're needed to run and protect the site, and backups are overwritten in time.

Keeping it safe

Every page uses an encrypted connection (HTTPS). Sign-in links work once and expire, passkeys can't be guessed or phished, and exact spots, spot GPS, directions and access, permits, storage places, buyers, gallery messages, and every photo and paper are encrypted at rest with a key for each collection. No website is perfectly secure, but if something ever goes wrong in a way that puts your information at real risk, we'll tell you, and the authorities when the law requires it.

Children

Concho isn't meant for children under 13, and we don't knowingly keep a child's information. If you think a child has given us theirs, email us and we'll delete it.

Your choices and rights

You can ask us what we keep about you, ask us to correct it, or ask us to delete it, by emailing info@rec-safe.com. We'll answer within 30 days. Depending on where you live (for example in Canada, a US state such as Washington or California, the UK, or the EU), the law may give you more rights, and we honour them for everyone.

Our servers are in the United States, so if you're elsewhere, your information is stored and handled there, under US law. In Canada, if you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Changes and questions

If we change this policy, we'll change the date at the top, and if a change is big, we'll say so on Concho first. Questions? Email info@rec-safe.com.