1. Controllers and contact

Nagihan Şirin and Sinan Şirin are the data controllers for the DendroGeo project. Contact security@dendrogeo.org for privacy, correction, deletion or content-removal requests. The interface is hosted on GitHub Pages; authentication, database and file services use Supabase.

2. Account and field data

Account information includes email, name, optional institution, role and active status. Supabase Auth handles password hashes; passwords are not stored as plain text. Google sign-in supplies account information under the provider’s terms. Field records include location, altitude and reported accuracy; tree species and group; circumference measured at 1.30 m; diameter derived by dividing circumference by π; height, slope and measurement identifiers. Stored outputs include volume, biomass and carbon estimates. Optional photographs are checked and resized in the browser before upload.

3. Technical data and usage summaries

The legacy visitor counter records timestamps. Daily usage summaries contain page category, broad referral category, device group and approximate country when available, retained for up to 400 days. These summaries exclude account/session identifiers, stored IP addresses, full referrer URLs, query strings and fingerprints. They are not unique-person or individual-conversion measurements. An IP address may be processed transiently on the server against a local DB-IP country database; it is not stored in these summaries or sent to an external geolocation API. VPNs and proxies can affect the estimate. New summaries respect Do Not Track and Global Privacy Control.

4. Purposes and providers

Data supports account access, scientific inventory and calculation, quality review, security and responses to data requests. The Turkish policy describes the stated legal bases. Providers include Supabase; Google sign-in and Fonts; Cloudflare Turnstile; OpenStreetMap, Nominatim and Overpass; Esri and OpenTopoMap; Microsoft Planetary Computer/Azure; and AWS-hosted land-cover sources. Map and analysis requests can disclose the requested geographic area to those providers. Some providers operate outside Türkiye. Provider privacy policies apply to their own processing. Data is not sold or rented for advertising.

5. Public and restricted records

Approved measurements may be published with coordinates, species, dimensions, derived estimates and optional photographs under the applicable publication licence. Private account information and unpublished records are subject to authorization. RLS controls access according to ownership, collaboration and administrative roles. Software is MIT-licensed; authorized DendroGeo data and original editorial material generally use CC BY-NC 4.0. Third-party rights and each release’s metadata remain applicable. The software DOI is not a dataset DOI.

6. Retention and local storage

Account and measurement data is retained while needed for the account and project; deletion requests are handled under the published policies. Published, versioned scientific copies may have a separate retention scope. Offline measurements and photographs can be queued in IndexedDB. Local storage preserves authentication and preferences; the service worker caches application assets and map resources. Clearing browser storage can remove unsynchronized work and does not delete server records.

7. Rights and requests

Under applicable law, including KVKK Article 11, you may request information about processing, purposes and recipients; correction of inaccurate data; deletion or destruction where applicable; notification of corrections/deletion to recipients; object to adverse outcomes from exclusively automated processing; and seek compensation for unlawful processing. Send your name, registered email and request to security@dendrogeo.org. Requests are addressed within 30 days under the Turkish policy. You can also manage your own records through My Records.

8. Security, location and children

Transport uses HTTPS. Database authorization, review workflows and audit records protect access; no system is guaranteed error-free. Location permission is requested through the location control; optional live sharing is a separate transient feature. Wake Lock can keep the screen awake during fieldwork. Advertising trackers and third-party analytics are not used. The service is not directed at children under 13; educational fieldwork involving children requires responsible adult supervision.

9. Policy status

This English companion explains the published Turkish policy without changing account permissions, consent records, retention settings or licensing. For the source wording and future amendments, consult the Turkish policy.