BioLog ← Home

BioLog — Privacy Policy

Published by Terrastation SBC, a Minnesota specific benefit corporation · Last updated: August 13, 2026 · Version 1.0

Download as PDF

This Privacy Policy explains how Terrastation SBC (“Terrastation,” “we,” “us,” or “our”), a Minnesota specific benefit corporation, collects, uses, shares, and protects personal information in connection with the BioLog mobile application and related websites (collectively, the “Service”). Terrastation is legally committed to a public benefit: promoting environmental stewardship and scientific literacy. Protecting privacy — and especially the privacy of younger users — is central to that mission. We aim to collect only what the Service needs, and we do not sell your personal information.

We have designed this policy to meet a high global standard, drawing on the EU/UK General Data Protection Regulation (GDPR) and U.S. state privacy laws, and to apply those protections to all users regardless of where they live.

1. Who This Policy Covers And The Ages We Serve

BioLog is an educational field-science application. It is not directed primarily at children, but we expect that minors will use it, including in classroom and family settings. Because of that, we hold ourselves to heightened protections for younger users and default to privacy for everyone.

Minimum age and permissions

You must be at least 13 years old to create a BioLog account. If you are between 13 and the age of majority where you live, you may use the Service only with the involvement and permission of a parent or legal guardian, who is responsible for supervising your use.

We do not knowingly collect personal information from children under 13 without permission required by law. If we learn that we have collected such information without the required consent, we will delete it promptly. A parent or guardian may contact us at the address below to review, correct, or delete their child's information or to refuse further collection.

2. Information We Collect

Account information

When you create an account, we collect your email address, display name, and chosen @handle. Authentication is handled by our identity provider (Supabase Auth). You must verify your email to use certain community features.

Sightings and content you create

When you log a sighting, we store what you enter and attach: common and scientific species names, your field notes, any photos you add, the sighting's location (GPS coordinates, and where available elevation and location accuracy), and timestamps. You may also save named places. You choose for each sighting whether it is private (visible only to you) or public (shared to the community).

Connections and social features

BioLog lets you follow and connect with other users (“BioLoggers”) and view one another's public sightings. We store your connections, follow relationships, and connection requests, and records of reports or blocks you submit through the moderation tools.

Photos — and what we do not collect from them

Photographs are intended to depict wildlife, plants, and fungi. Posting recognizable photographs of people is prohibited under our Terms. We do not use facial recognition, and we do not intentionally collect biometric identifiers or other special-category data. Photos may contain embedded metadata (such as camera-generated location); treat any photo you make public accordingly.

Device permissions

With your permission, the app accesses your camera and photo library (to attach photos) and your device location (to tag sightings and show the map). You can grant or revoke these permissions at any time in your device settings.

Diagnostic and crash data

We use Sentry to capture crashes and errors so we can fix them. This is configured not to attach personal identifiers or IP addresses, and we do not use it for performance or behavioral tracking. Our app privacy manifest declares crash and diagnostic data collection.

Information we do not collect

We do not serve advertising, and we do not collect advertising identifiers. We do not sell or “share” (as those terms are defined under U.S. state privacy laws) your personal information for cross-context behavioral advertising.

3. How We Use Your Information

• Provide the Service: store your sightings, sync across your devices, and power the map and nearby-sightings features.
• Operate the community features you opt into (public sightings, following, connections).
• Enable safety and moderation: process reports, blocks, and enforcement of our Terms.
• Communicate with you: send transactional emails such as email verification and password resets.
• Maintain reliability: diagnose crashes and improve the Service.
• Protect the Service and comply with the law.

4. Legal Bases For Processing (GDPR/UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the account and core features you request.
• Consent — for device permissions (camera, photos, location) and for making content public; you may withdraw consent at any time.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve reliability, balanced against your rights.
• Legal obligation — to comply with applicable law and lawful requests.

5. How Your Information Is Shared

We do not sell your personal information. We share information only as described here:

• With other users, at your direction — public sightings and your public profile (handle, display name, avatar) are visible to the community and your connections. Public sightings never expose your email address.
• With service providers under contract — Supabase (database, file storage, authentication), Render (API hosting), Sentry (crash reporting), and Apple (App Store / TestFlight distribution). These providers process data on our behalf and are bound by data-processing terms.
• For legal reasons — to comply with law, enforce our Terms, or protect the rights, property, or safety of users, the public, or Terrastation.
• In a business transfer — if Terrastation is involved in a merger, acquisition, or asset sale, subject to this policy's protections.

6. Location Data

Location is collected only while you are logging a sighting or viewing the map, and only after you grant permission. You can revoke location access at any time in your device settings; sightings you have already saved keep the location you recorded. Because publishing a precise location can be sensitive — for you and for protected or sensitive species — sightings are private by default, and you choose when to make one public.

7. Data Retention

We keep your account and content until you delete them or close your account. When you delete a sighting or your account, we remove the associated content from the live Service and from backups within a defined period, except where we must retain limited information to comply with law, resolve disputes, or enforce our agreements.

8. Your Privacy Rights And Choices

You can edit or delete your sightings, switch them between private and public, manage your connections, and update your profile in the app at any time.

Rights under GDPR/UK GDPR

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to processing of your personal information; to data portability; and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority.

Rights under U.S. state privacy laws

Depending on your state (for example, California, and other states with comprehensive privacy laws), you may have the right to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of sale or targeted-advertising “sharing.” We do not sell or share personal information for cross-context behavioral advertising.

To make a request, contact us at support@terrastation.io. We will verify your request as required by law and respond within the applicable time limits. An authorized agent may submit a request on your behalf where permitted.

9. International Data Transfers

Our providers may process data in the United States and other countries. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed.

10. Security

Access tokens are stored in the device keychain, and traffic to our API uses HTTPS. We take reasonable administrative, technical, and physical measures to protect your information. No system is perfectly secure, and we cannot guarantee absolute security.

11. Changes To This Policy

We may update this policy from time to time. Material changes will be reflected here with a new “last updated” date and, where appropriate, additional notice within the app.

12. Contact Us