The short version

Your email is only for signing in. It is never shown on your profile, your posts, or anywhere else in the app.
What you post is public — the photos and videos, the exact location, your description and your alias. That is the point of a public record.
No ads, and we never sell your information.
You can delete your account at any time, in the app, and everything goes with it. Here’s how.

Who we are

One For Nature is an independent organisation based in Aotearoa New Zealand. We run the One for Nature app and this website, and we are responsible for the personal information they collect under the Privacy Act 2020. In this policy, “we” and “us” mean One For Nature.

What we collect

Your account

Email address and password. Used to sign you in and, if needed, to send you account emails such as a sign-up confirmation or password reset. Your password is stored scrambled (hashed) — nobody at One for Nature can see it.
Your alias. The public name you choose. If you don’t choose one we make one up, like kaitiaki_3f9a2c. It is never based on your email.
Your region, if you choose to add it.
A profile colour, and the date you joined.

Posts

Photos and videos you take or choose. Photos can carry information your camera saved with them, such as when and where they were taken.
Precise location of what you recorded. The app uses your phone’s location (only with your permission, and only while you are using it), reads it from a photo you choose, or lets you place the pin yourself.
The place name, region and catchment for that location, the issue type, your title and description, and the time it was recorded.
Land details such as a lot number or landowner, only if you add them.

Taking part

Petitions you start, and the petitions you sign.
“Take action” reports. The app writes an email for you to send from your own email app, to the council or agency that handles the issue. We don’t see or keep that email — we only record that your account reported that post, so it can show as “Reported” and people don’t double up.
Reports and blocks. When you report a post or a person we keep the reason, any note you add, and who made the report. We keep the list of people you have blocked so their posts stay hidden from you.

Technical information

Our database and hosting providers keep standard logs — such as IP address, device and browser type, and the time of a request — for security and to fix problems.
When you use “Near me”, the app sends your approximate position to find posts close by. It is used for that search and not saved.
The app has no advertising and no third-party tracking or analytics tools.

What is public

Anyone can see these, with or without an account — in the app, on the web, and on share links like onefornature.org/p/…:

Your posts: photos, videos, exact location, place, description, issue type, any land details you added, and when it was recorded.
Your alias, your region if you added one, your profile colour and when you joined.
Petitions you start, and how many people have signed each petition (a count — not who signed).
Whether a post has been reported to a council through “Take action” (a count, not who).

Never public: your email address, your password, which petitions you signed, which posts you sent to a council, your reports about other people’s posts, and who you have blocked.

Please think before you post. A photo of a property, a number plate or a person can identify someone, and once something is public others can copy or share it. Our community rules ask you to keep people’s privacy.

How we use it

To run your account and publish your posts and petitions to the map and feed.
To keep the record trustworthy: moderating reports, removing posts that break the rules, and suspending accounts that misuse the service.
To keep the service secure and to fix things that break.
To contact you about your account if we need to.

We don’t use your information for advertising, and we don’t sell it or trade it.

Where it is stored, and who helps us

We use a small number of service providers. They handle information only to provide their service to us.

Supabase hosts our database, photo and video storage, and sign-in. Your information is stored on servers in Sydney, Australia.
On the website and the web/desktop version of the app: maps come from OpenFreeMap, and place search uses Photon by komoot. They receive the map area you are looking at or the place you search for, along with your IP address, as part of answering the request. They don’t receive your account details.
On iPhone and Android: the map and place search use your phone’s own services (Apple Maps on iPhone, Google Maps on Android), under Apple’s and Google’s privacy policies.
Our website host serves onefornature.org and keeps standard server logs.

Because our data is held in Australia, it is sent outside New Zealand. Australia’s privacy law gives protection comparable to ours, and our providers are bound by their own security and privacy commitments.

When we share it

Public posts are, by design, visible to everyone — including councils, journalists and agencies.
We will disclose information if the law requires it, or where it is necessary to prevent a serious threat to someone’s safety.
We don’t share your email or private account information with anyone else.

How long we keep it

While your account is open, we keep your account and posts so the record stays complete. You can delete any of your posts from its “…” menu at any time.
When you delete your account, your login, email, profile, posts, photos and videos, petitions you started, signatures, reports and blocks are deleted straight away. Copies may remain in our providers’ backups and logs for a short time before they are overwritten.
Emails you sent to a council with “Take action” stay with them, and we can’t recall them. Anything someone else has already copied or shared is outside our control.
We keep a record of moderation decisions (what was hidden or removed, and why) for as long as we need it to run the service fairly.

Your rights

Under the Privacy Act 2020 you can:

ask whether we hold information about you, and for a copy of it;
ask us to correct it if it is wrong;
delete your account and its data — in the app, or by asking us.

Most of your information you can see and change yourself in the app. For anything else, contact us (email [email protected]). We may need to confirm it’s you — usually by asking you to write from the email address on your account. We will respond within 20 working days.

If you are not happy with how we handle your request, you can complain to the Office of the Privacy Commissioner.

Keeping it safe

Access to the database is locked down by rules enforced in the database itself: members can only change their own things, and only staff moderators can see reports. Connections are encrypted. No system is perfectly secure, but if something happens that puts your information at risk of serious harm, we will tell you and the Privacy Commissioner.

Children

One for Nature is not designed for children. You must be 16 or over to create an account. If you think a child has created an account, let us know and we will delete it.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and let you know in the app.

Contact

Questions or concerns about privacy: contact us, or email [email protected].

Your privacy, in plain English.