Privacy Policy

Who we are

Urban Biome is run by Urbanbiome Ltd, trading as Urban Biome. We are the controller of the personal information described in this policy, which means we decide how and why it is used.

1. Information We Collect

This policy covers the Urban Biome website, the Urban Biome app for iPhone and Android, and the Urban Biome web map at sightings.urbanbiome.co.uk. We collect information you provide directly to us, such as when you create an account, contact us for support, or use the app.

Personal Information:

• Name and email address (when you create an account)
• Account preferences and settings
• Communication preferences

Technical Information:

We do not use analytics on the website or in the apps. The only technical information we hold is what our servers and providers receive when your browser or device talks to them:

• Your IP address and the requests your device makes, in our hosting provider's server logs
• Device and browser type, as sent with those requests
• Crash and error reports from the iPhone and Android apps, if the app crashes or something goes wrong (see section 3)

The Urban Biome app (iPhone and Android):

If you use the Urban Biome app, we additionally collect:

• Precise location: to show nearby sites on the map and to record the accurate location of a new site. Collected only while the app is in use, never in the background.
• Photos: when you attach a photo to a site or a condition reading, that photo is uploaded and stored against that record. We remove the photo's embedded metadata, including any GPS location, when it is uploaded, before it is screened, analysed or stored.
• Name and email address: collected at sign-in (via Apple, Google, or email) to run your account. Your name is never published with what you add.
• Account identifier: a user ID linking your contributions to your account.
• Age confirmation: a record that you are 18 or over, with the date, whether you used the iPhone or Android app, and how it was confirmed: either you answered the app's question, or your Apple or Google account told the app you are 18 or over (see section 9).
• Push notification token: if you turn notifications on, an identifier for your device issued by Apple or Google, so we can send notifications to it.
• Things you post: the sites you record, condition readings, species names and observation notes, along with any reports you make and people you block.
• Organisation claims: if you are a signed-in member of an organisation, you can claim a site for that organisation, as its owner or as its maintainer. We record the claim against the organisation, and the organisation's name is shown publicly on the site (see section 2a).

None of the above is used for tracking (as defined by Apple's App Tracking Transparency framework) or shared with third parties for advertising purposes.

The Urban Biome web map (sightings.urbanbiome.co.uk):

The web map shows the same public map in a web browser, and is view only. It has no accounts and you cannot record anything through it. It shows only what section 2a says is published.

• Browser check: before the map loads any sites, Cloudflare Turnstile checks that it is being opened by a person's browser rather than an automated program. To do this, Turnstile processes signals from your device and browser, and your IP address. Cloudflare does this on our behalf, as our processor. Most visitors see nothing; some are asked to tick a box. Our server also uses your IP address, for a short time, to limit how many checks one connection can ask for.
• One cookie: once your browser has passed the check, our map server (sightings-api.urbanbiome.co.uk) sets one cookie, called ub_viewer. It holds a random code and the time it expires, signed by us, and nothing about you. It lasts 24 hours, it cannot be read by the page's own scripts (it is "HttpOnly"), and it is sent only to our map server. It is strictly necessary: without it the map cannot load any sites. The map also keeps the time the pass expires in your browser's local storage, so it knows when to check again. See section 8.
• Searching for a place: what you type in the search box goes from your browser directly to postcodes.io (for postcodes) or to OpenStreetMap's Nominatim service (for other place names). The map also asks postcodes.io for the postcode area and ward of the sites it shows; that sends the sites' locations, not yours.
• The web map uses no analytics, no advertising and no tracking cookies.

Dictation:

You can dictate notes instead of typing them, using the microphone button. The speech is turned into text by your phone's own speech recognition service: Apple's speech recognition on iPhone, and on Android the device's speech recognition service (on most phones, Google's). That service may process the audio on your phone or send it to Apple's or Google's servers, under their own privacy terms. We never receive the audio. We only receive the text, and only if you save it.

Donations:

If you make a donation through Open Collective, payment information is processed by Open Collective and their payment processors. We do not store your payment card details.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our environmental analysis tools
• Manage your account and authenticate your access
• Send you technical notices, updates, and security alerts
• Respond to your comments, questions, and support requests
• Find and fix crashes and errors, and keep the service secure and free of abuse, using server logs and crash reports from the apps
• Comply with legal obligations and protect our rights

2a. What is published, and to whom

Urban Biome is a public map. When you record a site, the following becomes visible to anyone, including people who do not have an account and are not signed in:

• The site's type and location. Other people see the location rounded to four decimal places, about 10 metres. If the site's record names a protected or sensitive species, they see it rounded to two decimal places, about 1 kilometre, and not its outline.
• Condition readings, observation notes and species names
• Photos you attach, once they have passed screening
• The date of each contribution. Other people never see the time of day.
• If an organisation has claimed the site, that organisation's name, and whether it owns or maintains the site

New records appear on the public map overnight, a day or two after they're added. In detail, they become visible to other people in a daily batch, at 03:17 UTC each night (04:17 in British Summer Time), and only once they are at least 12 hours old. So a site you record is published between 12 and 36 hours later. You see your own contributions immediately. This stops anyone from using the map to see where a particular person is now. The only exception is the Urban Biome team's own administrators, whose corrections and additions are published straight away.

Nothing that identifies you is published with your contributions: not your name, your display name, your email address or your account identifier.

Your display name is shown only to the other members of organisations you belong to, in the organisation's list of members, with your role. It is never shown on the map or with anything you record. New accounts are given a generated pseudonym such as "Green Hawk", and you can change it at any time in the app.

Publishing site records is the purpose of the service: a shared record of small green and blue spaces in towns and cities, such as street trees, planters, rain gardens and green walls, that community groups, councils and others can use. If you would rather not have a contribution published, do not record it, or delete it in the app before it is published or afterwards.

3. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties, except as described below:

Service Providers:

These providers process your information on our instructions, under written contracts:

• Clerk - Authentication and account management (name, email address, account identifier)
• Cloudflare - Hosting, database and photo storage (including uploaded photos and site locations), the server logs described in section 1, and the Turnstile browser check on the web map (section 1)
• Sightengine - Automated screening of every uploaded photo, and of the text of notes, species names and organisation names and descriptions, for objectionable content (see section 3a)
• Anthropic - Analysis of your photos by its Claude AI, only if you turn on Auto-fill from photos (see section 3a)
• Google Firebase Cloud Messaging - Push notification delivery to Android devices, where you turn notifications on (your device's push token)
• Apple - Push notification delivery to iPhones, where you turn notifications on (your device's push token)
• Sentry - Crash and error reports from the iOS and Android apps, and error reports from our server. An app report describes what went wrong, your device model and operating system, and the app version. A server report describes what went wrong and which part of the service it happened in. Neither includes your name, email address, account identifier, IP address or location.

Other services your device contacts directly:

• OpenFreeMap and Esri - The map, in the app and on the web map, is drawn from map tiles that your device downloads from OpenFreeMap (the standard map) and Esri (the satellite view). They receive your IP address and the area of the map you are viewing, as any website you visit would, under their own privacy terms. They do not receive your account details.
• postcodes.io and OpenStreetMap Nominatim - Place search and area names on the web map (section 1). Your browser contacts them directly, and they receive your IP address and what you search for, under their own privacy terms.
• Apple and Google - Sign-in providers, where you choose to sign in with an Apple or Google account, and the speech recognition used for dictation (section 1)
• Open Collective - Donation processing (if you choose to donate)

We do not sell your personal information, and we do not share it with anyone for advertising.

Legal Requirements:

We may disclose your information if required by law or if we believe such action is necessary to comply with legal processes or protect our rights. If we find child sexual exploitation or abuse content, we will report it to the National Crime Agency.

3a. Automated checks of photos and text, and analysis of photos

When you upload a photo in the app, two different things can happen to it. One always happens; the other is your choice.

• Screening, for every photo. Sightengine, an automated moderation service, checks every photo before anyone else can see it. This is a condition of posting photos, so you cannot turn it off.
  • Photos showing explicit nudity, a real firearm, serious gore or a hate symbol are rejected and not stored.
  • Photos with a face that got past the phone's blur, a knife (often a garden tool) or a rude gesture are held. Only you can see a held photo until one of us has checked it.
  • If screening can't run at the time, the photo waits, unpublished, for a later automatic check.
• Auto-fill from photos, only if you allow it. The first time you add or take a photo, the app asks whether you want it to fill in details from your photos (Auto-fill from photos). If you choose Allow suggestions, your photo is sent to Anthropic's Claude AI, which suggests what kind of green space it shows, what condition it appears to be in, and what species may be present. These are suggestions: you see them and decide whether to accept them. Nothing is recorded about a site without a person confirming it. If you have allowed Auto-fill from photos and Sightengine cannot be reached, Claude also checks the photo for objectionable content.

If you choose Not now, your photo is still uploaded and screened by Sightengine, but it is never sent to Anthropic, and you fill in the details yourself. You can change your choice at any time from the account menu in the app, under Auto-fill from photos. The choice is stored on your device.

Text is checked too. Sightengine also checks the text of notes, species names, and organisation names and descriptions for offensive or abusive content before it is saved. Notes that contain a phone number or an email address are refused, so that nobody's contact details end up on the public map.

Both providers process what we send them on our instructions and neither uses it to train their models. Anthropic deletes what we send it within 30 days by default. Where each provider is based is set out in section 7.

Neither the screening nor the analysis produces any decision about you, and neither has a legal or similarly significant effect on you. The analysis describes a plant, a planter or a wall. If a photo or note of yours is rejected or held and you think that was wrong, email support@urbanbiome.co.uk and a person will look at it (see section 5a of our Terms of Use).

4. Data Security

We implement appropriate security measures to protect your information:

• Encryption for data in transit (HTTPS)
• Access controls and security best practices
• Removing embedded metadata, including GPS location, from uploaded photos
• Regular security reviews

While we strive to protect your personal information, no method of transmission over the Internet is 100% secure.

5. Data Retention

We retain your account information for as long as your account exists. Beyond that:

• Site records (location, type, condition, observation notes) are kept indefinitely. They are the point of the service: a condition history is only useful if it goes back years, and other people's condition readings for the same sites build on them.
• Photos are kept for as long as the record they belong to, unless you delete them, or delete your account and choose to delete your photos too.
• Your age confirmation is kept for as long as your account exists, and deleted with it.
• Content reports are kept for one year after they are resolved, as a record that they were acted on.
• Operational logs (spend counters, photo screening results) are deleted automatically after 90 to 180 days.
• Backups. We keep backups so that we can restore the service if data is lost. There are two:
  • Cloudflare's own point-in-time copy of our database, kept for 30 days.
  • A daily copy of our database and our photos on a server that we own and control, in the UK. Access to it is restricted to us. It keeps every daily copy, and photos that were later deleted or replaced, with no set deletion date. We keep it because the photos and condition records, over years, are the long-term record of how green infrastructure in towns and cities changes.
  We use backups only to restore the service after data loss, and for nothing else. When you delete something, or delete your account, it is deleted from the live service straight away, but copies made before then stay in the backup. We never restore a deleted account from a backup.

What happens when you delete your account

You can delete your account yourself at any time from within the app (Account, then Delete Account). You do not need to ask us, and we do not ask why. You can also email us if you would rather. Our Delete your account page explains both ways step by step. When an account is deleted:

• Your sign-in, name, display name and email address are deleted.
• Your photos: you choose. When you delete your account, the app asks whether to Also delete my photos. This is on unless you turn it off.
  • If it is on, every photo you uploaded is deleted, from storage as well as from the record.
  • If you turn it off, your photos stay public on the map with the sites they belong to, without your name. They are linked to the same random marker as your site records (see below), not to you. Once your account is deleted, we can no longer tell which photos were yours, so you can't later ask us to remove them. Anyone, including you, can still report any photo.
• Your device is removed from push notifications, and your organisation memberships, the blocks you made and your age confirmation are deleted.
• The site records you contributed are kept, with your name and account identifier replaced by a random anonymous marker. This is pseudonymisation, not full anonymisation. The records stay linked to one another, and to any photos you chose to keep, as the work of one anonymous contributor, with their locations, which is what makes the ecological record usable. Someone who knows where you record sites might still recognise them as yours. We keep them rather than deleting them because other people's condition timelines for the same sites depend on them.

If you want specific records removed as well, email us and tell us which ones, and we will consider the request on its facts.

Older copies remain in our backups, as described under "Backups" above. We never restore a deleted account from them.

5a. Our lawful bases for using your information

Under the UK GDPR we must have a lawful basis for each thing we do with your personal information. Ours are:

• Contract: creating and running your account, authenticating you, and providing the features you ask for, including using your location and photos to record the sites you choose to record.
• Legitimate interests: publishing the site records you contribute as an open map of green infrastructure, which is the purpose of the service and what contributors join in order to do; screening every uploaded photo and piece of text so the map is safe to look at; keeping a record that account holders confirmed they are 18 or over; keeping the service secure, preventing abuse, and finding and fixing crashes and errors.
• Consent: sending your photos to Anthropic for Auto-fill from photos, which you allow or refuse in the app and can change at any time from the account menu; and push notifications, which you can turn off at any time in the app or in your device settings.
• Legal obligation: responding to lawful requests, reporting child sexual exploitation and abuse content to the National Crime Agency, and keeping records we are required to keep.

Your phone also asks your permission before the app can use your location, camera or microphone. Those permissions are a control your device gives you, and you can change them at any time in your device settings. They are not the lawful basis we rely on: that is set out above.

Where we rely on legitimate interests, you have the right to object. See section 6.

6. Your Rights (GDPR)

If you are in the UK or European Economic Area, you have the following rights regarding your personal information:

• Access: Request a copy of your personal information
• Rectification: Update or correct inaccurate information
• Erasure: Request deletion of your personal information (see our Delete your account page)
• Portability: Request your data in a machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent. For Auto-fill from photos, change your choice under Auto-fill from photos in the app's account menu.

To exercise these rights, please contact us at support@urbanbiome.co.uk. We will respond within one month.

7. International Data Transfers

Some of the providers in section 3 process your information outside the UK. Where they do, we rely on the safeguards the UK GDPR requires. For each one:

• Cloudflare (hosting, database and photo storage): a global network, including the United States. Covered by the UK Extension to the EU-US Data Privacy Framework, and by the EU Standard Contractual Clauses with the UK Addendum.
• Clerk (sign-in): United States. Covered by the UK Extension to the EU-US Data Privacy Framework.
• Anthropic (Auto-fill from photos, only if you allow it): United States. Covered by the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. Anthropic deletes what we send it within 30 days by default.
• Sightengine (photo and text screening): based in France, which the UK recognises as providing adequate protection. It may process photos and text in the EU, Canada or the United States.
• Sentry (crash and error reports from the apps and our server): Sentry is a US company. Our reports are stored in its EU region (Germany), which the UK recognises as providing adequate protection. Any access from the United States is covered by the EU-US Data Privacy Framework (including the UK Extension) and, as a fallback, the Standard Contractual Clauses with the UK Addendum.
• Google Firebase Cloud Messaging (Android push notifications): may process your push token in the United States and elsewhere. Covered by Google's Firebase data processing terms, which include the Standard Contractual Clauses.
• Apple (iPhone push notifications): may process your push token in the United States, under Apple's terms.
• OpenFreeMap and Esri (map tiles): your device contacts them directly, and their servers may be outside the UK. Esri is based in the United States.
• postcodes.io and OpenStreetMap Nominatim (web map place search): your browser contacts them directly, and their servers may be outside the UK.

8. Cookies and Tracking Technologies

This website (urbanbiome.co.uk) sets no cookies. The one exception is a private page our app testers use, where signing in with Clerk, our sign-in provider, sets the cookies needed to keep testers signed in.

The Urban Biome web map at sightings.urbanbiome.co.uk uses one cookie, which is strictly necessary for it to work, so it does not need your consent:

• ub_viewer, set by sightings-api.urbanbiome.co.uk after the Cloudflare Turnstile browser check (section 1). It holds a random, signed code and its expiry time, and nothing about you. It lasts 24 hours and is HttpOnly. Without it the map cannot load any sites.

The web map also stores the time that pass expires in your browser's local storage. During the check, Cloudflare Turnstile processes signals from your device and browser to tell people from automated programs, as our processor.

We do not use analytics or advertising cookies, and we do not use third-party tracking on this website or the web map. If that ever changes we will ask for your consent first, as PECR requires, before setting any such cookie.

You can control cookies through your browser settings. If you block the ub_viewer cookie, the web map will not be able to load sites.

9. Children's Privacy

Urban Biome accounts are for people aged 18 and over. Before you sign in or create an account, the app checks that you are 18 or over. If your Apple or Google account shares an age range with apps and it says you are 18 or over, the app accepts that. If it says you are under 18, you can't create an account. Otherwise, the app asks you to confirm you are 18 or over. The app has no feature for under-18s, and we do not knowingly collect personal information from them. If we become aware that we hold information about someone under 18, we will delete it promptly. You can tell us at support@urbanbiome.co.uk.

We set the minimum age at 18 rather than 13 or 16 deliberately. The app is built on precise location and photographs, and we have not built the separate, reduced-permission kind of account that a service used by children would need under the ICO's Age Appropriate Design Code.

10. Third-Party Links

Our Service may contain links to third-party websites or services (such as Open Collective for donations). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date
• Sending you an email notification where appropriate

12. Complaints

If you are unhappy with how we have used your personal information, please complain to us first, by email to support@urbanbiome.co.uk. Tell us what happened and what you would like us to do.

• We will acknowledge your complaint within 30 days of receiving it.
• We will look into it, and tell you the outcome without undue delay.

You can also complain to the Information Commission (still known as the ICO), the UK's data protection regulator. It took over from the Information Commissioner's Office on 30 September 2026: ico.org.uk/make-a-complaint. You do not have to complain to us first, although we would like the chance to put things right.

13. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: