FloraTrace privacy policy

FloraTrace by Flora Carbon

FloraTrace is a field app for monitoring tree-planting and carbon projects. Flora Carbon runs FloraTrace and is responsible for the personal data described here. This policy explains, in plain language, what the app and its server collect, why, where it is kept, and how to have it deleted.

What we collect

• Account details: your name and email address. Sign-in (including your password and sign-in emails) is handled by our authentication provider, Supabase Auth; FloraTrace's own server never sees or stores your password. If you choose "Continue with Google", Google confirms who you are and shares your name, email address and profile picture link with Supabase Auth; FloraTrace uses the name and email address only, and never sees your Google password.
• Location data you record: GPS coordinates of trees, and the boundary points of plots you walk or enter, plus boundary files (KML) generated from them. For each recorded position the app also stores the GPS accuracy the device reported.
• Project records: project, plot and tree details (names, codes, locations, areas, species, planting dates, QR codes, status), measurements (trunk diameter, height, canopy spread, health), notes, and the names you enter for surveyors and plot owners.
• Plot questionnaire: the app can store a short questionnaire about a plot, for example your answers about land use and ownership.
• Photos you take of trees and measurements, with the time they were captured.
• Technical data: when the app talks to our server we process your IP address, your account ID and the request made. We use these to keep the service secure and working, for example to limit abusive traffic.
• Map imagery requests: the app and the web dashboard load map imagery from Microsoft Azure Maps. To show a map, your device contacts Microsoft directly, so Microsoft receives your device's IP address and the map area being viewed.
• Diagnostics from the QR scanner: the app scans tree QR codes with Google ML Kit, which processes the camera image on your device and sends Google diagnostic data: device model and OS version, app version, a per-installation identifier, performance and error data. Google does not share this with third parties (see Google's ML Kit data disclosure).

We do not collect your contacts, and we do not track you across other apps or websites.

Why we use it

Only to run carbon project monitoring: to let you and your project team record, view, measure and export the trees and plots in your projects, to sign you in, and to keep the service secure. Everyone who is a member of a project can see that project's records, including who recorded them.

No selling, no ads

We do not sell your data, we do not show ads, and we do not share your data with advertisers or data brokers.

Where it is stored and who processes it

• Supabase (India, region ap-south-1, Mumbai) holds your sign-in account and the FloraTrace database with your profile and project records.
• Microsoft Azure (Central India) runs the FloraTrace server (API) and stores photos and boundary files in private storage.
• Microsoft Azure Maps provides the map imagery in the app and the web dashboard and receives the map requests described above.
• Google (ML Kit) receives the scanner diagnostics described above.
• Resend delivers emails you ask for, such as a CSV export of a project, to the address you choose.

These providers process data on our behalf and only to provide their service to us.

How long we keep it, and deleting it

We keep your data while your account exists. You can delete your account in the app (Profile → Delete account) or by email; see how to delete your account for the steps and exactly what is deleted and what is kept. In short: your account, your profile and every project where you are the only member are deleted with all their records and files; records you added to projects shared with other people stay with those projects with your name removed. Server logs and our providers' backups are overwritten on a rolling basis.

Security

• All traffic between the app and our server is encrypted with TLS (HTTPS).
• Every request must carry a valid, signed sign-in token, and project data is only available to that project's members, according to their role (owner, editor or viewer).
• Photos and files are kept in private storage; the app gets short-lived links to view them.
• Keys and passwords for our systems are kept out of the app and the source code.

Children

FloraTrace is a work tool for adults on carbon projects. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

Your choices and rights

You can see and change your name in the app, export your project data, and delete your account. To ask for a copy of your data, a correction or anything else about your privacy, email us.

Contact

Flora Carbon — contact@floracarbon.ai

Changes

If we change this policy we will update this page.