This page is checked against the code that runs. If the app does something this page does not say, that is a bug in this page, and we would like to hear about it.
Ecoregions is made by Josh Kloss. Questions, corrections, access or deletion requests: joshuakloss@gmail.com. We answer within 30 days.
This table is the source for the App Store “nutrition label” and the Google Play data safety form. “Linked” means tied to your account or to a device id we can connect to it. Nothing here is used for tracking across other companies’ apps and sites, and nothing is sold.
| Data | Why | Linked to you? | Kept |
|---|---|---|---|
| Email address | Sign-in, password reset | Yes | Until you delete your account |
| Password | Sign-in (stored only as a salted hash by our auth provider, never readable by us) | Yes | Until you delete your account |
| Profile: handle, display name, bio, “born in” line, links, portrait, flag style, country | Shown on your plaque and profile (country is stored but not shown or readable by other people) | Yes | Until you delete your account |
| 18+ confirmation and its date | Age gate required for accounts | Yes | Until you delete your account |
| Plots you hold | The public plot list. Shows the 12 m cell, region and your name | Yes, public | Kept under “Deleted account” after deletion (see Deleting your data) |
| Photos and film you upload, with capture time, place and consent record | The product. Published once reviewed | Yes, public once accepted | Until you withdraw them or delete your account |
| Master copies of film from clips you opt in to the film release | Possible use in a documentary | Yes | Until you withdraw the release or delete your account |
| Purchases of plots (if and when payments are on) | Fulfil and record the purchase; card details go to Stripe and never reach us | Yes | The payment record is kept for accounting and legal reasons even after account deletion, with your profile anonymised |
| Usage events: install, sign-in, map shown, region opened, upload started or finished, return visit to your own plot, session; app build, version, platform | To learn whether the app works and is used | Yes: a random install id, plus your account when signed in | 13 months, then deleted. Your account link is removed when you delete your account |
| Error reports: message, file and line, page path, browser, app build and device model, install id | Fix bugs | Yes (install id; never your name or email) | 90 days |
| Feedback you send: your message, the page you were on, build and device, an optional screenshot you allow, your account if signed in | Answer you and improve the app | Yes | 12 months after it is dealt with; deleted with your account |
| Push notification token (if you allow notifications) | Tell you a decision on your upload | Yes | Until you turn it off or delete your account |
| Notes and board posts, comments and likes you write; reports and blocks you make | The community boards and safety | Yes, public for posts | Posts, comments and likes are deleted with your account; safety reports about content are kept |
| Beta sign-up email and accessibility report (only if you send one) | Contact you about the beta; answer your report | Only the email you give | Until you ask us to delete it |
| Visitor counts: a daily salted hash of IP address and browser string, country, page path | Count visitors and spot abuse | No. The hash cannot be reversed without a secret we hold | 30 days; totals without any identifier are kept |
| Camera, microphone, photo library | Filming and choosing files; used on your device | Only the files you upload | n/a |
| Your current location | Move the map when you press “Where I am” | Never sent or stored | Not kept |
Your account, profile, plots, upload records and the analytics, error and feedback tables.
Serves the app and runs the code behind sign-up, uploads and deletion. Like any host, it sees your IP address and browser when you load the site and keeps ordinary access logs. We use Netlify’s storage for push tokens, beta sign-ups, accessibility reports, the visitor counts above, the nightly backup and a few rate-limit counters (keyed by a salted hash, not your address).
The original file you upload, the smaller copies the app makes (thumbnail, display, streaming versions) and, for clips you opt in to the film release, a higher-quality “4K master.” Cloudflare handles the files; it does not get your name.
Takes your card. We receive a confirmation and the amount, not the card number.
Carry a short message to your phone. They see your device token.
Receives a short alert such as “beta sign-up, iOS, gmail.com” or the first line of an accessibility report. Never a full email address.
gibs.earthdata.nasa.gov, basemap.nationalmap.gov, imagery.nationalmap.gov and
tiles.maps.eox.at receive the map tiles you look at, which reveals roughly where your screen is pointed. They never receive who you are.
nominatim.openstreetmap.org and photon.komoot.io receive the words you typed and your IP address.
These are ours, not a third party’s: there is no Google Analytics, no advertising SDK and no crash-reporting company. The browser or app keeps a random install id on your device, and sends small events to our own server. When you are signed in, the event also carries your account id so we can tell whether people come back to a plot they hold. The server drops any latitude, longitude or similar field even if one were sent. Error reports and feedback go the same way. If you press “Send feedback” you choose whether a small screenshot of the page goes with it.
Your device’s position is read only when you press “Where I am,” only while the app is open, and it stays on your device. The place a photo or film was taken is different: it is required, stored with the contribution, and shown with it. In public data files we round plot coordinates to four decimal places (about 11 m). A plot is a 12 m cell, so the plot list shows which cell, not a street address.
Handle, display name, bio, “born in” line, links, portrait, flag, plots and accepted uploads are visible to anyone. Your email, country, 18+ date and password are not. Other people can report or block you; we review reports.
Ecoregions is for people 18 and over. Making a profile requires you to confirm it. It is not directed at children, and if we learn that a child has an account we delete it.
See the table for each type. Nightly backups of the database are held for 14 days on our host and 60 days on the maker’s own computer, so a deleted account can remain in a backup for up to 60 days and is not restored. Where we say “13 months” or “90 days,” a scheduled job deletes the data after that time.
Sign in and choose Delete my account in your profile, or email us. We then remove from our systems: your uploaded files (including originals, copies and film masters in Cloudflare R2 and our file storage), your profile, your sign-in, push tokens, your notes, board posts, comments and likes, and your feedback. Your usage events lose their link to you. Two things stay by design: the plots you hold remain in the public plot list under “Deleted account,” because who held a plot is the record, and payment and provenance records are kept as accounting and integrity records. In that case your profile is blanked and your sign-in is disabled. You can also withdraw a single contribution without deleting your account.
Wherever you live you can ask us for a copy of your data, to correct it, or to delete it. If you are in the European Economic Area, the UK or California you have these as legal rights, including the right to complain to your regulator. We collect only what the table lists, on the basis of your consent to use the service and our interest in keeping it working and safe. We do not sell or share personal information for advertising. Data may be processed in the United States and other countries where our providers operate.
If this page changes in a way that matters, the date below changes.