Privacy Policy

The short version

• We do not track you, we do not advertise to you, and we do not sell or share personal data with data brokers. There is no advertising identifier in this app and no cross-app tracking of any kind.
• Location is read at the moment you use it, to place a tree where you are standing and to show you where you are on a property map. We do not keep a history of where you have been.
• You can delete your account from inside the app. Your name, email and phone number go immediately.
• The work you recorded stays with the organisation you recorded it for, listed against an anonymous ID instead of your name. If you were the last person in that organisation, the organisation goes too.
• Crash reports contain no content you typed, no photographs, no filenames and no URLs.

The rest of this page is the detail behind those five points.

Two kinds of data, and who decides about each

Arborbase holds two different things, and they are not governed the same way.

Your account data. Your name, email address, phone number, profile photo and professional credentials. Arbcura decides what happens to this, so for this data we are the controller and this policy governs it.

Your clients' data. The names, addresses, phone numbers, site photographs and notes that a tree service enters about the people it works for. The tree service decides what happens to that. We hold it on their behalf and act on their instructions, so for this data we are a processor and they are the controller. If you are a homeowner or a property manager whose details are in Arborbase, the company that surveyed your trees is who to ask about them, and we will help them answer you.

If you are an Arborbase customer and need a data processing agreement covering the client records you enter, write to info@arbcura.com.

What we collect

Nine kinds of data, matching exactly what the app declares to Apple in its privacy manifest.

All nine are linked to your identity, because a tree inventory that could not say who surveyed the tree would not be much of a record. None of the nine is used for tracking.

About location specifically

This is the permission people ask about, so here is exactly what happens. When you place a tree, the app reads your position at that moment and stores it as the tree's position. When you open the property map, it reads your position to draw the dot showing where you are. That is the whole of it. Your position is not recorded on a timeline, not stored as a track, and not read when the app is in the background.

Deleting your account

You can delete your account from My Account inside the app. You do not have to email anyone, and you do not have to ask us.

If you cannot open the app, you can request deletion at https://arbcura.com/arborbase/delete-account instead.

Here is what happens, in order:

1. Immediately. You are signed out and cannot sign in again. Your name, email address, phone number, profile photo and report profile are removed from your record, and copies of your name elsewhere in your organisation are scrubbed in the same operation, including names inside notes that no search would find.
2. For thirty days. Your disabled account can be restored by an administrator. Nothing further is removed during this window.
3. After thirty days. It is removed permanently, by a scheduled job rather than by anyone remembering to run one.

What survives, and why

Your work stays with your organisation. Trees, notes, proposals and completed jobs are listed against an anonymous ID rather than your name. We say this plainly because "delete my account" reads as "delete everything I did", and here it does not. Your organisation continues to need the tree inventory you built for it.

Four fields keep your name on purpose, because the law requires the record to say who did the work:

• who applied a pesticide
• who confirmed a worksite
• who reviewed a legal source
• who saved a revision of a compliance record

These are the records that exist to be evidence. A pesticide application record that could not name its applicator would not be one.

They stay with the organisation, not with us. If you leave and your organisation continues, those records continue with it. If you were the last person in it, the organisation is deleted on the same thirty day schedule as everything else and these records go with it. We are not a long-term archive for your compliance evidence, and you should not treat us as one. They are in the export we build for you before anything is removed, and keeping them after that is your business's responsibility rather than ours.

Aggregate counts are kept and name nobody. When a public tree story is viewed we increment a counter. The counter's key is a one-way salted hash, and the record holds a version, a timestamp and counts. There is no identifier in it, no organisation, and no content, so the traffic to a story cannot be traced back to the property or the tree it describes.

Ordinance lookups keep the place, not the person. When someone checks tree ordinance information for a jurisdiction, we record the postal code, the jurisdiction, the ordinance number and the time, because that metering spans every organisation and is not any one organisation's to delete. Your user ID and the property and report it related to are cleared when your account is deleted.

If you are the last person in your organisation

Deleting your account then deletes the organisation with it, because there is nobody left for it to belong to. You do not have to transfer ownership to somebody first, and you are not stuck if you work alone.

Before that happens we build a complete export of everything that is about to be removed and email you the link, so you are not told to save your data at the moment you can no longer sign in to save it. The export contains a full copy of every record, readable spreadsheets of your clients, properties, trees and proposals, and a list of every photograph with a link to download it. The link stays valid for the whole thirty days, so it does not expire before the data it points at does.

That email is the only message we send when somebody leaves. It says when the window ends, that nothing has been deleted yet, and how to get the organisation back. There is no follow-up sequence and no offer to win you back.

Transferring an organisation instead

If you are the account holder and you want to leave without closing the organisation, you can transfer that role to another member from the user list, and then delete your own account. Both people move in a single operation, so there is never an organisation with two account holders or none.

Who else receives data

Google Firebase hosts effectively all of it: sign-in, the database, file storage, the server functions and the website.

Google Maps Platform provides address lookup, place details, reverse geocoding, static maps, Street View and the base map. Your device does not contact Google for any of these. The requests go to our own server, which asks Google on your behalf, so what Google receives is a search term or a pair of coordinates from us rather than a request carrying your browser and your IP address.

SendGrid delivers email: proposals, invitations and receipts.

Twilio delivers SMS, where an organisation has enabled it.

Intuit QuickBooks receives invoice data, only for organisations that have connected their QuickBooks account.

Sentry receives diagnostic reports about whether the app is managing to sync what you recorded offline. These are unusually narrow by design. Raw exceptions, anything you typed, photographs, file paths, URLs and filenames never enter a report, and unhandled crashes are discarded on the device rather than sent. What leaves is a single fixed event name carrying counts (how many items are waiting, how old the oldest is), your organisation's ID, the build number, and a one-way hash of a random identifier created for your app installation. No user account, name or ID is attached.

iNaturalist, Open-Meteo and Esri supply species reference material, weather for treatment timing, and satellite imagery. No personal data is sent to any of them.

We do not sell personal data, and we do not share it with advertisers or data brokers.

Security, stated accurately

Data is encrypted in transit using HTTPS, and encrypted at rest by Google Cloud. Access is governed by database rules that are deployed and tested with every release.

Two things we are not going to claim, because they would not be true:

• This is not end-to-end encryption. We can read your data, and so can Google as our infrastructure provider. Anyone telling you otherwise about a product built this way is describing something else.
• Your data does not stay on your device. The app works offline and queues what you record, but the queue is a buffer that empties to our servers when you get signal, not a boundary that keeps data local.

Children

Arborbase is a professional tool. It is not directed at children and we do not knowingly collect data from anyone under 13.

Your rights

Whoever you are, you can ask us to give you a copy of your data, correct it, or delete it. Account deletion is in the app and needs no request at all.

If your details are in Arborbase because a tree service you hired put them there, ask that company first, since they decide what happens to their client records. Tell us and we will help them respond.

To make a request, write to info@arbcura.com. We answer within 30 days.

Where Arborbase is available

Arborbase is offered in the United States. It is not marketed to, or made available in, the European Union or the United Kingdom, and the app is published to United States territories only.

If that changes, this policy changes with it.

If you are in California

Under the CCPA and CPRA, the categories of personal information Arborbase collects are identifiers (name, email address, phone number, postal address and an internal user ID), geolocation data, visual information (photographs), and other information you provide (notes, assessments, recommendations and proposals). They are collected to provide the service and for no other purpose.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. There is no "Do Not Sell or Share My Personal Information" link on this site because there is nothing to opt out of.

You have the right to know what we hold, to have it deleted, and to have it corrected. Deletion is in the app under My Account and needs no request. For the other two, write to info@arbcura.com. We will not discriminate against you for exercising any of these rights.

If your information is in Arborbase because a tree service you hired entered it, that company decides what happens to it and your request goes to them first. We will help them answer you.

Changes

When this policy changes materially we will say so in the app before the change takes effect. The effective date at the top always reflects the current version.

Contact

info@arbcura.com