Privacy, with clear boundaries.

Sharing and optional browser reminders

Public activity cards show only chosen public text and coarse locations. Meeting instructions, member names, parcel boundaries and evidence files stay private. Completed-work cards require independent community review and an explicit publish step; they do not certify ecological outcomes.

Member share links can include a source code. The join form explains that requesting membership records the source privately for participation reporting. It grants no access and uses no tracking cookie or outside analytics service. Founder, test and unclassified accounts are excluded from participant counts.

Optional browser reminders store your subscription and delivery status privately. Apple, Google or Mozilla processes encrypted delivery. Notifications contain generic text, with no private co-op details. Choose batched updates or a weekly digest, disable each browser in Care & participation, and check the test on your device. Reminders remain connected after sign-out; disable them on shared devices. Account deletion removes subscriptions. We do not send reminder emails.

Your account and access

We store your chosen username and display name, a salted password hash, and a hashed recovery code. No email address is required to join. Sessions and optional device or agent tokens are stored as hashes with expiry and revocation. Security events record the account ID, action and time without including your password, recovery code or token.

When optional Google or Apple sign-in is enabled, the provider verifies your identity. We retain its account identifier and an encrypted token used to revoke authorization, plus an optional display name. Our local co-op database does not store the provider email address or merge accounts by email. Linking an existing account requires your password and explicit consent. Removing a link or deleting your account queues provider authorization revocation; a provider outage can delay that step after local access ends. A hashed provider identifier and timestamp prevent an older sign-in attempt from restoring a removed identity. Google and Apple process sign-in requests under their own privacy policies.

When Supabase sign-in is enabled, Supabase also processes your provider identity, email address and basic profile for authentication. It can associate provider identities with the same verified email within its authentication service; this does not automatically join VergeCommon accounts or grant access to a co-op. The temporary Supabase session is closed after verification. Removing the final connected sign-in method queues deletion of the Supabase authentication profile; a profile still used by another connected sign-in is retained until its final link is removed. See Supabase’s privacy policy.

When email-link sign-in is enabled, your email address is sent to Supabase and its configured mail sender to deliver a one-time link. The link must be opened in the browser that requested it within ten minutes. VergeCommon temporarily stores a hash of the address for request matching and abuse limits, and retains the verified authentication identifier for returning sign-in. We do not publish your address or match it to an existing co-op account. Existing members must explicitly link email from their account settings.

The hosted service keeps co-op records in a private database and uploaded evidence on its dedicated server, hosted by DigitalOcean in the United States. Operators manage that server and its backups. The host may process request metadata such as IP addresses, which are also used briefly for rate limiting. VergeCommon includes no advertising or application analytics tracker.

Who can see your records

• Public visitors: a co-op’s introduction, general region, active member count, and projects, updates and event summaries that have been explicitly made public. Public discovery does not expose exact land references, agreements, evidence, member identities, votes or financial records.
• Active members: their co-op’s projects, discussions, governance and financial records. Exact event instructions stay member-only. Organizers and stewards see RSVP names; other members see their own response and a total.
• Submitters and stewards: parcel boundaries, agreements, field evidence, imagery jobs and results. Evidence downloads require the uploader or an active steward. Choose stewards you trust with sensitive material.

Organization profiles are self-reported. Public descriptions must not contain private addresses, sensitive habitat locations, personal information or confidential evidence. The software cannot establish that you have someone else’s consent to publish.

A partner invitation shares the organization’s name, website and agreed role with the selected member. Their response, role and authority reference are visible to that representative and the co-op’s stewards. Private agreement files are not shared with them by the invitation. Participation does not verify the organization or give the representative additional permissions.

Reports, blocking and stewardship

The separate operator report form stores your description, category, referenced item and review status privately on the hosting server. A signed-in browser report is associated with your account and removed when that account is deleted. Reports sent without sign-in are linked only to a private receipt; contact the operator with that receipt for a privacy request. No email address is required. The receipt reveals status only, not report text. Operator decisions are recorded separately for accountability; reports and decisions also follow backup retention.

Reports are visible to the reporting member and co-op stewards. Hidden content stays in moderation records; hiding is not deletion. Your personal block list is visible only to you. Blocking hides social updates, replies and events between the two members within that co-op, while shared governance records and public pages remain visible. Stewards retain access to moderation material.

Transferring a co-op’s founder responsibility changes application administration. It does not transfer land rights, legal authority or financial records.

Maps, links and local tools

The optional background map contacts OpenFreeMap only after you choose to load it. The provider receives your IP address and tile requests revealing the viewed area; parcel overlays are drawn locally. Device location is requested only when you choose the location control.

Satellite catalogue searches separately require confirmation before sending a parcel’s bounding box and a date window to Copernicus Data Space. Member identities, land references and consent documents are not sent. Revoking permission stops future searches for that boundary version but cannot erase previous requests to a provider.

Woodland projects, where enabled, keep corridor layers and treatment plans visible to active members. Old-growth spine analyses run on the co-op server and are not stored. Stewards see every woodlot in them. Other members see the woodlots they recorded and counts, and the build-out toward the next woodlots only as a co-op total; their projections use only planned join years they recorded. They never see another member’s woodlot, boundary, planned join year or place in the build-out order. Every member sees the share of the spine committed and which links between core areas it holds, which can indicate that the woodlots along a single route have consented. Account deletion removes your treatment plans; a plan another member reviewed or voted on keeps only its status, the review decision and pseudonymous votes.

The local planner keeps its plan in browser storage. The hypothetical co-op calculator keeps scenarios in page memory until exported. Neither writes to the shared co-op ledger. Downloads can contain private records; store and share them carefully. External links, GitHub and payment providers have their own privacy policies.

Your choices and account deletion

From Your account, you can export records available to you, change your password, revoke connected devices or agents, and permanently delete your account. Deletion revokes access and removes your authored personal content, private land records, associated evidence and uploaded files. The native app also offers account deletion. It has a separate control for deleting journal drafts and prepared evidence stored on your device.

Transfer founder responsibility from the co-op’s Members area before deleting a founder account when other active members remain. Shared numeric and governance structures may remain with account identities and attributable text removed; related financial recording is paused when necessary identifiers have been erased. Other members’ own text and copies already downloaded by others cannot be automatically removed by this action. Contact us if those records identify you.

A minimal private deletion receipt keeps an opaque account identifier and time so restoring an older backup does not restore deleted account data. Existing backups are not instantly rewritten; any restoration must apply the current deletion ledger before the service reopens. Operators control backup access and retention. Removing a member or archiving a co-op is separate from deleting an account.

For account, privacy or record-removal requests, contact justin@viridisconservation.com. Do not include passwords or recovery codes.

Photos and files in the iPhone app

The native beta build lets you choose a photo, PDF or text file and review its destination before sharing it. Photos are resized and reencoded without the source metadata. PDF and text files keep their contents and metadata; check them for private details before sharing. The app does not capture your camera or location automatically.

Prepared evidence is saved in protected storage on your device, excluded from device backups, until you submit or remove it. Pending attempts belong to the account that prepared them. An interrupted attempt can be retried explicitly without creating another upload. Signing out or deleting your account does not erase local drafts; use the app’s separate local removal controls. Removing a local copy does not withdraw evidence already received by a co-op.

Prepared discussion replies also stay in protected, account-bound device storage until you explicitly send them. They are excluded from device backups and journal exports. Interrupted submissions retain the same reply and retry identity; the app never sends them automatically. Confirmed success removes the local reply text and retains a receipt. Signing out or deleting your account does not remove these local copies. Use the separate reply-queue removal controls; removing a local copy does not delete a reply already posted to the group.