WildWhere — Privacy Policy

Policy Version: v5.0 Effective Date: 2026-10-18 Supersedes: v3.1 (published), and unpublished drafts v4.0 (2026-04-20) and v4.1 (2026-05-20/23).

The short version

WildWhere is a wildlife-sighting alert app. To work, it needs to know where you are and where you saw wildlife. We treat your precise location as sensitive information: it is used for the sighting service you signed up for, and for nothing else unless you separately opt in. We do not sell your data, we show no ads, we use no advertising or analytics trackers, and we send no marketing email. You can see, export, correct, or delete everything — from inside the app — wherever you live. The rest of this policy is the detail behind those sentences.

1. Who we are

Ascendaris Inc., a company incorporated in Alberta, Canada, operates the WildWhere apps for iOS and Android and the wildwhere.com website (including public sighting share pages). Ascendaris Inc. is the controller of the personal information described in this policy — we decide what is collected and why.

Privacy Officer. We have designated a Privacy Officer (under PIPEDA Principle 4.1 and Alberta PIPA s.5(3), the individual accountable for our compliance):

Privacy Officer, Ascendaris Inc. Email: privacy@wildwhere.com Mail: Ascendaris Inc., Calgary, Alberta, Canada

The Privacy Officer is the first point of contact for every request, question, or complaint in this policy (see §13).

2. What we collect

WildWhere collects information to provide wildlife sighting alert services. Retention periods for each category are in the table in §8 — we tell you how long we keep things before we collect them.

This app can locate you. WildWhere includes technology that allows us to identify and locate your device (GPS and related sensors). Location powers the core service: recording where you saw wildlife and warning you about wildlife near you. You can turn location off at any time: on iOS, in Settings → Privacy & Security → Location Services → WildWhere; on Android, in Settings → Location → App permissions → WildWhere. The app keeps working without location, but cannot place your reports on the map or warn you about nearby wildlife.

Core data (collected when you use the app)

• GPS location, speed, and heading (elevation is derived on our servers from your coordinates using a terrain model — it is not read from your device)
• Date, time, and timezone
• Species and behaviour you select when reporting
• Device state (battery level, charging status, thermal state)
• App version, recorded with your reports. A device/OS profile (device model, OS version, network type) on your user account is currently disabled on both platforms; if we enable it, it is used only to know which platforms and OS versions to support, and this policy's retention table (§8) already covers it
• GPS accuracy and time-verification data
• Reverse-geocoded location (country, province/state, city — derived from your GPS coordinates on our servers, or via your device's platform geocoding service: Apple's on iOS, Google's on Android (see §7))

Optional data (your choice, configurable in Settings)

• Photos and basic image metadata (dimensions, location-verification category). Photos are re-encoded on your device before upload, which strips embedded EXIF data (including any GPS tags); EXIF GPS is used only to set a verification category ("verified" / "mismatch") and is not retained.
• Motion and activity type (walking, driving, stationary) — recorded with your sightings only if you opt in. We may also read your current activity (not a history) to tune GPS accuracy and battery use whenever the OS has authorized motion access.
• Siri voice input text (iOS voice reporting; transcription is performed by Apple on-device).
• Email address — required. You need an account to use WildWhere, and an account needs a working email address. We use it to send you a copy of the Terms and this Privacy Policy when you accept them, to give you advance notice before either document changes materially, for account recovery, for transactional notices about your own reports, and for privacy-request correspondence. Never for marketing. You may provide it directly or by linking Sign in with Apple and choosing to share your Apple address. Your email is never attached to the sightings other users see (see the pseudonymity note in §5).
• Name — optional. Used only as a display name in your own profile screen. Your sightings are shown to other users without your name or profile (see the pseudonymity note in §5).

Diagnostic data (collected to keep the service reliable)

• App performance metrics (Apple MetricKit on iOS)
• Crash reports (Firebase Crashlytics)
• Data, power, and map-tile usage statistics (aggregated by category — no locations)
• Error logs with app-state context, keyed to a rotatable per-install identifier rather than your account. Uploaded over Wi-Fi only, except that a small number of high-priority diagnostic events (launch failures, abnormal battery drain) may upload over cellular so we can fix urgent problems
• Battery-drain diagnostics — when abnormal battery use is detected, a snapshot of system state (GPS configuration, foreground/background state, charging, network type, thermal state, recent user actions) is captured to help us fix it

Dead-zone cellular coverage data

When you enter a designated cellular dead zone (a known low-or-no-signal area), the app records lightweight coverage breadcrumbs — your location, the time, and whether your device has signal — so we can refine the dead-zone map and make sighting alerts work better in remote terrain. They are linked to your account for 90 days and then de-identified (§8), and are uploaded over Wi-Fi only. Recording stops when you leave the dead zone.

Verification votes

If you confirm or deny someone else's sighting or sign, we record your vote together with your precise location at the time (only if you have allowed location and have not turned on "Limit the Use of My Sensitive Personal Information"). This is used to detect vote manipulation and to confirm voters were actually near what they voted on. After 90 days the record is de-identified: your identifier is removed and the location is generalized to a ~5 km area and the date (§8). A vote can also contribute a presence ping (only if you opted in to Presence Sharing) and a dead-zone coverage breadcrumb (only inside a designated dead zone) — each governed by its own rules in this section.

Presence sharing (opt-in, off by default — not yet offered)

Presence Sharing is built but currently disabled: the opt-in toggle does not appear in the app today, and no presence data is collected from anyone. When we enable the feature, it will work as follows and remain strictly opt-in, default OFF. If you then opt in to Presence Sharing, we record which trail or ~5 km area you have recently been in — stored as a trail name or ~5 km cell plus the date, never your coordinates or your route — so the community can see which areas have recently been visited (an empty trail then reads as "no animals seen" rather than "nobody looked"). Only a k-anonymous aggregate is ever published: a cell appears only where at least 3 different people visited within the last 21 days.

Visitors to wildwhere.com (the website)

The wildwhere.com website is covered by this policy. If you visit it:

• Beta signup form — if you submit it, we collect your name, email address, preferred platform, language preference, and a record of your consent to be contacted about the beta. Used only to run the beta program and never shared or used for other marketing. Protected by Google reCAPTCHA (see §7).
• Cookieless web analytics — we use Cloudflare Web Analytics, which counts page views without cookies, cross-site tracking, or persistent identifiers. We do not use Google Analytics or any advertising tracker on the site.
• Fonts and embedded resources — pages currently load fonts from Google Fonts, which means Google receives your IP address when a page loads; map tiles on public sighting share pages come from the OpenStreetMap Foundation (§7). (We plan to self-host fonts to remove the Google transfer; this section will be updated when that ships.)
• Public sighting share pages (wildwhere.com/sighting/…) show a sighting at its public-map precision only. When you delete a sighting or your account, its share page stops resolving.

The website sets no advertising or tracking cookies, so no cookie banner is required; essential security tokens (reCAPTCHA on the signup form only) are the sole exception.

3. Why we use your data, and our lawful basis

The Canadian framing is meaningful consent (PIPEDA Principle 3; Alberta PIPA Part 2; British Columbia PIPA Part 3): required processing is identified as required, and every optional purpose is a separate, freely refusable opt-in, default OFF. The purpose-by-purpose table above is the full table.

How consent works in the app. WildWhere records consent in three tiers: collection permissions (what the app gathers), purpose consents (why we process it), and contractual acceptances (Terms). There are five recorded consent types; three are required to use the service (sighting alerts, Terms, safety acknowledgement — labelled as required, not presented as a choice) and two are genuinely optional (presence sharing, precise coverage — both default OFF). Every grant, denial, and withdrawal is appended to a tamper-evident consent ledger with the timestamp, the exact text you saw, and the policy version in force, so both you and we can prove what was agreed and when. You can change any optional consent at any time in Profile → Privacy Settings; withdrawal stops future processing of that kind.

We do NOT:

• Sell your personal information, or share it for advertising — ever
• Show ads, or use any advertising, analytics, or attribution SDK
• Send marketing email
• Track you across other apps or websites
• Attach your name or profile to sightings shown to other users

4. Sensitive data and precise location

We treat your precise geolocation as sensitive personal information everywhere you live — not just where a statute says so. That means:

• Precise location is collected and used only for the service you asked for (recording your reports, alerting you, recording trips you start).
• Every use beyond the core service requires a separate, express opt-in, default OFF (presence sharing, precise coverage).
• The "Limit the Use of My Sensitive Personal Information" toggle (§9) immediately withdraws the opt-in purposes that would propagate precise location beyond the sighting pipeline.
• Your home area can be excluded from presence features, and trip recordings trim start/end points inside your privacy zone before upload.

We do not extract identities or attributes of any person incidentally visible in a photo.

Sensitive-species location coarsening

Sightings of species designated sensitive under the federal Species at Risk Act or Alberta's Wildlife Act are reduced in precision on our servers before they are stored in the public sightings database, and the coarsened coordinate is what appears on the community map, in notifications, on share cards, and on the public share page. There is a public-safety exception for grizzly bear, which stays at full precision for a 72-hour window after a sighting is reported — including the enrichment lookups sent to the processors in §7 at the precise coordinate — and is coarsened thereafter.

The rules, the current species list, the grid sizes, and the no-opt-out position are set out in the Terms and Conditions §8 and §6.4, which govern this behaviour. Precise coordinates that we retain for coarsened species are never shown to other users.

5. De-identified and aggregate data; pseudonymity

Pseudonymous, not anonymous. Inside our systems, your contributions are keyed to your account identifier (a random Firebase UID) — they are pseudonymous: other users don't see your name, but the data is still linked to you on our side, is still personal information, and is still covered by every right in §9. We say "de-identified" or "anonymized" only where identifiers have actually been removed and the data can no longer be linked back to you. Some technical metadata (for example, photo storage paths) can currently include your account identifier; we are actively reducing where that identifier appears.

Data that becomes non-personal on a schedule (details in §8):

• Verification votes — after 90 days we remove your identifier and reduce the location to a ~5 km area and the date.
• Dead-zone breadcrumbs — after 90 days we strip the user and session identifiers; the remaining coverage row (location, signal, network type, battery/thermal context, timestamp) is retained as aggregate.
• Presence coverage — only the k-anonymous aggregate (≥ 3 distinct contributors per cell per 21-day window, banded counts, no identifiers) is ever published; your individual pings are deleted after 21 days, and any precise ping coordinates held in the separate internal store are purged after 90 days.

Our commitment on de-identified data: where we hold data in de-identified form, we maintain and use it only in that form, we do not attempt to re-identify you from it, and we require by contract that anyone we share it with does the same.

Research datasets. WildWhere operates no research-data pipeline, shares no data with research or conservation partners, and offers no research contribution setting. If that ever changes, we will publish the terms that would govern it, update this policy, and give you at least 30 days' notice and a fresh, opt-in choice before any of your data flows under them.

6. Storage, security, and international transfers

Where your data lives

Your data is stored in Google Firebase (Firestore + Cloud Storage) in the northamerica-northeast1 region — Montreal, Canada. Data on your device (Core Data, photo cache) stays on your device and is removed when you delete the app. Cloud sync is what enables community features (shared sightings, alerts, verification voting) and cross-device continuity.

Security

We protect your information with measures appropriate to its sensitivity (PIPEDA Principle 7; Alberta PIPA s.34), including: encryption in transit and at rest (Google Cloud defaults); server-side security rules that restrict every record to its owner, with admin access gated by multi-factor authentication and recorded in an append-only audit log; server-side (not merely client-side) enforcement of the sensitive-species coarsening in §4; a tamper-evident consent ledger; retention enforced by automatic deletion policies (§8); and audited, reason-coded access for any staff view of precise sensitive coordinates.

Transfers outside Canada — advance notice (Alberta PIPA s.13.1)

Some of your personal information is transferred to, or accessible from, service providers outside Canada. As required by Alberta PIPA s.13.1, here are the entities, the countries, and how to reach our Privacy Officer with questions (privacy@wildwhere.com — §13):

Questions about how personal information is handled outside Canada can be directed to the Privacy Officer (§13). Details of what each provider does and does not receive are in §7. This list is also published, and kept current, at wildwhere.com and inside the app.

U.S. CLOUD Act notice. Google LLC, our primary cloud provider, is a U.S.-headquartered company and may be subject to lawful access requests from U.S. authorities under the U.S. Clarifying Lawful Overseas Use of Data Act (CLOUD Act), even where the underlying data is stored in our Canadian region. Our Data Processing Agreement with Google requires Google to challenge over-broad requests and to notify us where lawfully permitted.

Transfer mechanisms. Transfers to Google and Apple rely on contractual data-processing agreements with those providers; the community geolocation services (komoot, FOSSGIS, OpenSnowMap, OSMF) receive only the minimized request data described in §7, with no account identity attached.

7. Third-party services (sub-processors)

We use the services below to run WildWhere. The canonical public list, with a change log, is published at wildwhere.com/sub-processors and in the app. We commit to at least 30 days' in-app notice before any new sub-processor begins receiving user data (§12).

About the searches your device makes. Place search and park/amenity search go directly from your device to komoot and FOSSGIS, so those services see your IP address alongside the query. We minimize what is sent: no account identity ever, and on both platforms the coordinates in these requests are reduced to roughly 100 m precision before they leave your device. We are also evaluating a Canadian proxy so these services no longer see user IPs at all; this paragraph will be updated if that ships.

Deferred — AI photo verification. Code exists for AI-based photo species verification (Anthropic Claude via Google Cloud Vertex AI, Montreal), but the feature is disabled in production and the server gate fails closed: no photos are sent to any AI service today. If we re-enable it, we will give 30 days' in-app notice and update this policy first.

What no third party receives: raw EXIF/GPS photo metadata (stripped on-device before upload); your email or name; your consent records (Google stores them as our database provider but no other party receives them). We integrate no advertising, analytics, or attribution services; the Google Analytics symbol present in the Firebase SDK is unconfigured and collects nothing.

8. How long we keep things (retention)

Retention is enforced by four mechanisms: your own delete controls, the account-deletion cascade, automatic time-to-live deletion policies on our database, and scheduled de-identification jobs. The canonical schedule is the table below.

Deleting the app from your device removes all local data; cloud data persists until you delete your account.

9. Your rights

We grant the following rights to every WildWhere user, and we aim to respond within 30 days. Where a request is complex, or where we need more information from you to act on it, we may take the additional time that Alberta's PIPA allows (up to 45 days for an access request) — if we do, we will tell you before the first 30 days are up, and why. Statutory rights under the privacy law of your province are unaffected by anything in this policy.

• Access & export (portability). Settings → Privacy Settings → Download My Data generates a complete machine-readable (JSON) archive immediately; the download link is valid 6 hours (you can request a fresh link at any time while the archive exists) and the archive is deleted after 30 days. You can also email privacy@wildwhere.com ("Data export request").
• Correction. Edit your own content in-app, or email privacy@wildwhere.com ("Request to correct my data"). If we refuse a correction, we annotate the record with your disagreement (Alberta PIPA s.25(2)).
• Deletion. Delete individual sightings or trips any time, or delete your entire account via Settings → Delete Account. The deletion cascade removes your sightings, photos, trips, votes, profile, reputation data, and DSAR archives from your device and our cloud. Two things survive deletion: (1) your consent-ledger records, which are marked deleted and retained for 7 years as legal-defence evidence of what you consented to, then purged; and (2) data already de-identified on the schedules in §8, which is no longer linked to you. Deletions initiated by us (e.g., moderation) propagate to your devices on next launch, so removed records do not persist as ghost copies.
• Withdraw consent. Toggle any optional purpose off in Profile → Privacy Settings at any time. Before you confirm, we tell you what withdrawing changes. Every withdrawal is recorded in the consent ledger.
• Limit sensitive-data use. The "Limit the Use of My Sensitive Personal Information" toggle immediately withdraws the opt-in purposes that would carry precise location beyond the sighting pipeline, and records why.
• Human review of automated decisions. Automated decisions, and your right to have a person review and reverse any of them, are described in the Terms and Conditions §10.
• Appeal. If we decline any privacy request, appeal via Settings → Privacy Settings → Submit a Privacy Request → "Appeal a decision," or email privacy@wildwhere.com ("Appeal"). A reviewer independent of the original decision re-examines it and explains the outcome, normally within 45 days; if an appeal needs longer, we will tell you why and when to expect the outcome.
• Challenge our compliance. Under PIPEDA Principle 10 you may challenge our compliance with this policy and applicable law — contact the Privacy Officer first; the regulator table is in §13.
• No discrimination. Exercising any right never changes your service quality or costs you anything.

Verification. In-app requests are verified by your signed-in account — no extra documents needed. Email requests are verified against the account's email. Authorized agents may submit requests on your behalf with proof of authorization; we will confirm with you directly before acting.

Global Privacy Control. We do not sell or share personal information for advertising, so there is nothing to opt out of — but we treat a GPC signal on our web pages, and the in-app privacy toggle, as a recorded opt-out preference anyway.

10. Children

WildWhere is for adults. You must be 18 years or older to use it.

At onboarding we ask you to confirm this — an attestation, not a date of birth (we deliberately do not collect your birthday; only the yes/no confirmation, the minimum age applied, and a timestamp are stored, on your device). Anyone who cannot confirm is rejected without recording anything about them — no account, no data. Our privacy defaults are set to maximum protection for every user (optional purposes OFF, no ads or profiling for marketing, minimal collection). If you believe someone under 18 has used WildWhere, contact privacy@wildwhere.com so we can delete their data.

11. If something goes wrong (breach notification)

We maintain an incident-response runbook with an internal 72-hour clock from the moment we become aware of a suspected breach, everywhere — not only where a statute imposes one.

If a breach of safeguards involving your personal information creates a real risk of significant harm, we will:

• report it to the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay (Alberta PIPA s.34.1 — under Alberta's model, the Commissioner then decides whether we must notify affected individuals; our own commitment is to notify you directly whenever there is a real risk of significant harm, whether or not required);
• report to the Office of the Privacy Commissioner of Canada and keep the required breach records (PIPEDA s.10.1, RROSH standard);
• notify you directly, and keep our own record of the incident, whether or not a statute requires it.

12. Changes to this policy

If we make material changes — a new purpose, a new sub-processor, a change to retention or rights — we will notify you by email and in the app at least 30 days before the change takes effect, tell you what changed in plain language, and give you a real choice: accept, or delete your account before the change applies to you. Changes that strictly narrow our processing (e.g., flipping a default to OFF, removing a sub-processor) take effect without re-consent — your existing consent covers the narrower scope. Every version of this policy is archived and linked from the version registry, and your consent records always cite the exact version you accepted.

Where a change must take effect immediately — for example, to comply with a legal or regulatory requirement, a court or regulator order, or to address a security or safety risk — we may not be able to give 30 days' advance notice. In that case, we will present the revised policy to you the next time you sign in to the app and ask you to review and agree to it before you continue using the service. The summary of what changed will be shown alongside the request. If you decline, you can stop using the app and delete your account; we will not continue processing your personal information for the affected purpose on the basis of your prior consent. We will tell you at the time why the change took immediate effect.

13. Contact and regulators

For privacy questions, requests, appeals, or complaints:

Privacy Officer, Ascendaris Inc. privacy@wildwhere.com Ascendaris Inc., Calgary, Alberta, Canada

The Privacy Officer is designated under PIPEDA Principle 4.1 and Alberta PIPA s.5(3). We aim to respond to all requests within 30 days (§9).

Federal works and undertakings. If you use WildWhere in the course of duties on a federally regulated work, undertaking, or business (for example, as Parks Canada staff), PIPEDA applies to that use regardless of your province of residence.

If we cannot resolve your concern, you may contact the regulator for your jurisdiction:

Schedule A — Alberta and British Columbia

This Schedule applies if you reside in Alberta or British Columbia. It adds nothing to the core policy; it is a map showing where the core (§1–§13) satisfies each obligation.

The core is written to Alberta PIPA and PIPEDA as our home regime, in particular: §1/§13 (accountable Privacy Officer, PIPEDA P4.1 / PIPA s.5(3)), §2 (identified purposes at or before collection, P4.2 / PIPA s.13), §3 (meaningful consent, P4.3 / PIPA Part 2), §4–§5 (limiting collection and use, P4.4-4.5 / PIPA s.11/s.16), §6 (safeguards + the PIPA s.13.1 out-of-Canada notice table), §8 (retention, P4.5), §9 (access and correction, including the PIPA s.25(2) annotation on a refused correction), §11 (PIPA s.34.1 OIPC breach reporting + PIPEDA RROSH), §13 (challenge route, P4.10).

British Columbia. BC's Personal Information Protection Act imposes no Alberta-style advance-notice duty for information transferred outside Canada, so the §6 notice table over-complies for BC residents rather than being required of us. BC residents have the same access, correction, withdrawal and complaint rights the core grants everyone, and may complain to the Office of the Information and Privacy Commissioner for British Columbia (§13).

Federal works and undertakings. If you use WildWhere in the course of duties on a federally regulated work, undertaking, or business — for example, as Parks Canada staff — PIPEDA applies to that use regardless of your province of residence (§13).

End of Privacy Policy v5.0.