Privacy
Your recordings are yours.
This describes what the software actually does. Where a control exists in the product, it is linked rather than described in the abstract.
What we hold
- Account
- Email address, display name, chosen role, locale and timezone.
- Media
- The audio, video and images you upload, stored in object storage and never in the primary database. Access is via short-lived signed URLs only.
- Extracted features
- Numerical descriptors computed from your media — pitch statistics, spectral shape, movement measures. These contain no recoverable audio or imagery.
- Context
- The structured situational information you provide with each observation, plus any free text.
- Location
- Only if you provide it. Without precise-location consent, coordinates are snapped to a grid before storage. For species vulnerable to poaching the grid is deliberately very coarse.
- Interpretations
- The structured results, their evidence, the model and adapter versions, and your outcome feedback.
- Audit log
- Who accessed what and when, including every occasion an administrator overrode normal ownership checks.
What we do not do
- We do not sell personal data.
- We do not put your media into a training dataset without two separate, explicit, revocable consents.
- We do not include media content in analytics. Analytics carries event metadata only.
- We do not store precise coordinates without precise-location consent.
- Media from a child account is never training-eligible under any circumstances.
Training eligibility
A recording is eligible for model training only when all of the following hold: active terms and privacy consent; an active account-level model-training consent; an explicit per-submission consent given with that specific item; no identifiable unblurred humans; no pending deletion request; and not a child account.
Eligibility is recomputed from live consent records on every read, so revoking any consent takes effect immediately and everywhere.
Retention
- Original uploads are kept until you delete them or your account.
- Analysis-optimised derivative copies are removed after 365 days.
- Extracted features and interpretations survive media deletion so your behavioural history stays readable. They cannot be used to reconstruct the recording.
Your controls
- Export everything — a complete portable JSON export of your account, animals, observations, context, interpretations, feedback and audit trail.
- Delete a recording, an animal or your account — deletion is self-service. Account deletion runs after a 30-day grace period; signing in during that window cancels it.
- Withdraw any consent — research participation, model training, precise location and marketing are independent and separately revocable.
- See your sessions — every active session, with the option to sign out everywhere.
Security
- Passwords are hashed with argon2id. Refresh tokens are stored only as hashes and rotate on every use.
- Reusing a refresh token is treated as evidence it leaked: the entire session family is revoked rather than renewed.
- Animal medical notes are encrypted at rest with a per-record key derivation and require their own permission to read.
- Every read of a protected field is written to the audit log.
Contact
Privacy questions: [email protected]. Security disclosures: [email protected].