Privacy Policy

1. Introduction

Treetag ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard information when you use our Service. By using Treetag, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect the following categories of information:

• Account information — your name, username, and email address when you register
• User Content — tree observations, photographs, health reports, wildlife sightings, and notes you submit
• Location data — coordinates associated with trees you add or observe (entered manually or via map selection)
• Photo metadata — uploaded images may contain embedded EXIF data, including GPS coordinates, camera model, and timestamps
• Usage data — pages visited, features used, and interaction timestamps, collected to improve the Service
• Device information — browser type, operating system, and IP address for security and diagnostics

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Authenticate your identity and secure your account
• Display your contributions (observations, photos, adoptions) on public tree profiles and the map
• Calculate and display points on the community leaderboard
• Send important service-related notifications
• Analyse usage trends to improve features and performance

We do not sell your personal data to third parties.

4. Public Information

The following information may be publicly visible to other Treetag users: your username, profile image, adopted trees, observations, uploaded photos, and your position on the community leaderboard. Your email address is never displayed publicly.

5. Photos & Location Data

When you upload photographs, they may contain embedded EXIF metadata including GPS coordinates. We may use this data to associate observations with map locations. You can strip location metadata from photos before uploading using your device's privacy settings or a third-party tool.

Tree location coordinates are stored and displayed on the public map. These relate to tree positions, not your personal location.

6. Data Storage & Security

Your account data is stored in a MongoDB database. Uploaded files, including photographs, are stored in Cloudflare R2 cloud object storage with access controls. Passwords are securely hashed and never stored in plain text.

We take reasonable measures to protect your data, but no method of electronic storage is completely secure. We cannot guarantee absolute security.

7. Cookies

Treetag uses essential session cookies to keep you authenticated while you use the Service. We do not use advertising, analytics, or third-party tracking cookies. You can disable cookies in your browser settings, but this may affect your ability to log in and use the Service.

For a full breakdown of the cookies we use and how to manage them, please see our Cookie Policy.

8. Third-Party Services

The Service uses the following third-party integrations:

• OpenStreetMap — map tiles are loaded from OSM tile servers. Your IP address may be visible to these servers when loading the map. See the OSM privacy policy.
• Cloudflare R2 — used for photo storage. Data may be stored across Cloudflare's global network.
• iNaturalist — we may import publicly available biodiversity data. No personal data is shared with iNaturalist.

9. Your Rights

Under UK data protection law (UK GDPR), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain types of processing
• Data portability — receive your data in a machine-readable format

To exercise any of these rights, please email us at [email protected].

10. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal information within 30 days. Anonymised tree data and observations may be retained for the benefit of the community even after account deletion.

11. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify users of material changes through the platform. Continued use of the Service constitutes acceptance of the updated policy.

13. Contact

If you have questions or concerns about this Privacy Policy or how we handle your data, please email us at [email protected].