Privacy Policy

Account information. When you register we collect your email address, a display name, your locality and your notification preferences, and optionally a profile photograph. Your password is stored only in securely hashed form and is never stored in plain text. If you sign in with Google, we receive your name, email address and profile picture from your Google account.

Contributions. When you record a tree or an observation we collect the content you submit: photographs, species identifications or guesses, location coordinates (from your device's GPS or as corrected by you), the date and time of the record, and any optional measurements, descriptions and notes. Records you submit are attributed to your account; no form asks you to type your own name. Where guest submissions are enabled, we collect only the minimum needed to process and moderate them: a display name, the photograph, the location and the date.

Technical information. Like most websites, the Platform may automatically collect technical information about your visit, such as your Internet Protocol (IP) address, browser type and version, operating system and device details, and the pages you visit, using cookies and similar technologies. If you enable push notifications, we store a notification token for your device. When you capture records offline, they are stored on your own device until they sync to our servers.

We do not collect financial information, health information or any other sensitive category of personal data through the Platform, and we do not knowingly collect more personal information than is needed to run it.

• To operate, maintain and improve the Platform, including displaying the tree register, species atlas, maps and Biodiversity Score;
• To review and moderate submissions, maintain data quality and keep an auditable record of moderation decisions;
• To attribute contributions to the contributing account and maintain your Passport, levels, badges and activity history;
• To send transactional messages such as email verification, password resets and the outcome of your submissions;
• To send optional web push notifications (for example, reminders and moderation outcomes) where you have opted in; you can disable these at any time in your device or browser settings, and every non-essential message includes a way to opt out;
• To protect the security and integrity of the Platform, prevent abuse and enforce our Terms and Conditions;
• To comply with applicable law and respond to lawful requests from public authorities.

Approved contributions appear on the public map, tree pages and feeds together with the contributor's display name. To protect you and the wildlife you record, the Platform reduces the precision of publicly displayed locations, applies coarser location masking to protected or sensitive species, and strips embedded GPS metadata from any publicly served image. Exact coordinates are visible only to authorised administrators and reviewers. Your email address and contact details are never displayed publicly, and custodian contact details for trees and sites are likewise never made public. Nothing you submit is publicly visible until it has been approved through review.

The Platform may offer an automated species identification aid powered by a third-party artificial intelligence service (currently the Google Gemini API). Where this feature is used, you will be shown a plain-language notice before your photograph, and where applicable a reduced-precision location, is transmitted to the service, and such transmission takes place only with your consent. AI suggestions are an aid only; they are never published as a verified identification without human review.

We do not sell, rent or trade your personal information. We share information only as follows:

• Service providers. We use reputable third-party providers to run the Platform, including cloud hosting and database services, Firebase Authentication for sign-in, map services, and email and push notification delivery. These providers process information on our behalf and are bound by contractual and confidentiality obligations;
• Technology partners. Our development and maintenance vendors may have limited access to Platform systems strictly for building, supporting and securing the Platform, under written contracts and confidentiality undertakings;
• Research and conservation. Verified biodiversity datasets and analytics may be shared with researchers and institutional partners, but standard data exports exclude all personal information; any operational export that contains personal information is separately restricted and logged;
• Legal requirements. We may disclose information where we are legally required or entitled to do so, including to law enforcement authorities investigating illegal activity.

Event registration is handled on external third-party websites linked from the Platform; any information you provide there is governed by those websites' own privacy policies, and the Platform does not store event attendee lists.

The Platform uses cookies and similar technologies that are necessary for it to function, such as keeping you signed in, remembering your preferences and supporting offline capture, and may use them to understand how the Platform is used so we can improve it. Information collected by these technologies cannot be used to identify you without additional identifiable information. You can control cookies through your browser settings, though some features of the Platform may not work without them.

We retain your personal information for as long as your account is active. If you delete your account, or ask us to, your account enters a 30-day grace period after which your personal information is deleted or anonymised. Verified ecological observations are retained permanently in anonymised form as part of the scientific record, because removing them would corrupt the integrity of the biodiversity dataset; this retention is disclosed at sign-up and no longer identifies you once anonymised. Moderation and audit logs are retained as required for the integrity and security of the Platform.

We have invested significantly in safeguarding personal information against unwarranted access and improper use. Measures include encryption of data in transit, storage of passwords only in strong hashed form, role-based access controls with every privileged action attributable to a named account, rate-limited authentication, automated backups, and independent security testing of the Platform before public launch, with periodic review thereafter. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your information using appropriate technology and policies.

In the event of a personal data breach affecting your personal information, we will notify you without undue delay, describing the nature of the breach, its likely consequences and the measures being taken, and will intimate the Data Protection Board of India within the timelines prescribed under the Digital Personal Data Protection Act, 2023 and the rules made under it.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to: access a summary of the personal information we hold about you; correct or update inaccurate or incomplete information; withdraw consent you have previously given; request erasure of your personal information (subject to the anonymised scientific record described in Section 7); nominate another individual to exercise your rights in the event of death or incapacity; and raise a grievance about how your information is handled. To exercise any of these rights, write to us at compliance@rpgf.in. If you believe we have not resolved your grievance satisfactorily, you may complain to the Data Protection Board of India.

The Platform is intended for users aged 18 and above. Minors may use the Platform only with the consent and under the supervision of a parent or legal guardian, or through a supervised school or institutional programme, and we process a minor's personal information only on the basis of such verifiable consent. If you believe a child has provided us personal information without appropriate consent, please contact us at compliance@rpgf.in and we will take appropriate steps to remove it.

We reserve the right to change, alter, amend or modify the contents of this Privacy Policy from time to time to reflect changes to the Platform, technological advancements, and legal and regulatory developments. The current version will always be available on the Platform, and material changes will be highlighted there. Your continued use of the Platform after a change constitutes acceptance of the updated policy.

For any questions, requests or grievances relating to this Privacy Policy or your personal information, contact our Grievance Officer: [Name of Grievance Officer], Grievance Officer, RPG Foundation (Wings & Roots, nature:re initiative), Mumbai, India, email: compliance@rpgf.in.

The Grievance Officer will acknowledge your complaint within 24 hours and dispose of it within 15 days of its receipt, and in any event within the timelines prescribed under applicable law, including the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. If you are not satisfied with the resolution of your grievance, you may complain to the Data Protection Board of India.