1. Controller
The data controller for personal data processed in the Trace of Nature app is Trace of Nature AB, registered in Sweden ("we", "us"). We decide why and how your personal data is processed in connection with the app.
2. What we collect and why
- Account data — name, email, password hash. Purpose: creating and securing your account. Legal basis: performance of contract.
- Tour and sighting content — GPS tracks, timestamps, photos, notes, tags. Purpose: providing the journaling features you use the app for. Legal basis: performance of contract.
- Location data — recorded only while you are actively logging a tour or requesting nearby sightings. Purpose: route recording and proximity features. Legal basis: performance of contract; you control device permissions.
- Technical and usage data — IP address, device type, browser, basic request logs, error reports. Purpose: security, fraud prevention and improving the service. Legal basis: legitimate interests.
- Support correspondence — messages you send us. Purpose: answering you. Legal basis: legitimate interests.
3. Sharing and subprocessors
We share personal data only with service providers necessary to run the app:
- Lovable Cloud (Supabase) — application hosting, database, file storage and authentication.
- Lovable AI Gateway — proxying photos to AI models (e.g. Google Gemini) for species identification when you press "Identify".
- Paddle.com — Merchant of Record for all sales. Paddle collects billing and tax data directly from you at checkout and is the data controller for that data; see paddle.com/legal.
- Map and observation providers — OpenStreetMap, iNaturalist, GBIF, eBird, Artportalen and similar public sources are queried to display tiles and third-party sightings near your location. Your coordinates may be sent to them in the request.
- Professional advisers and authorities — accountants, lawyers, and regulators where required by law.
4. International transfers
Some subprocessors may process data outside the EEA. Where this happens, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision to safeguard your data.
5. Retention
We keep your account and tour data for as long as your account is active. If you delete a tour or sighting, it is removed from active storage promptly. If you delete your account or use the in-app "Reset all data" function, your data is deleted or anonymised within a reasonable period, except where we are required by law to retain records (e.g. invoicing data held by Paddle).
6. Your rights (GDPR)
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request erasure of your data ("right to be forgotten").
- Restrict or object to certain processing.
- Receive a copy of your data in a portable format.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.
We aim to respond to requests within one month. Contact us via contact@traceofnature.se.
7. Security
We apply appropriate technical and organisational measures, including encryption in transit, access controls, and row-level database security, to protect your data. No system is perfectly secure; please use a strong, unique password.
8. Cookies and local storage
The app uses essential browser storage (localStorage, IndexedDB) to remember your session, language preference, safety acknowledgement, and offline map tiles. We do not use third-party advertising or tracking cookies.
9. Children
The app is not directed to children under 13. If you are a parent and believe your child has provided personal data to us, contact us and we will delete it.
10. Changes to this notice
We may update this notice. The "Last updated" date above will change accordingly. Material changes will be highlighted in the app.