Privacy Policy

1. Information we collect

Information you provide

• Account information: email address, password (stored hashed), display name, and optional profile avatar.
• Profile preferences: home location (latitude/longitude), state, time zone, birding preferences, and favorite species.
• User content: wildlife sightings you log (species, location, date/time, count, notes), photos you upload, and votes you cast on other users’ sightings.
• Communication: messages you send us through support channels.

Information collected automatically

• Location data: when you grant location permission, we access your device’s foreground location to show nearby sightings, generate predictions, and let you log sightings at your current location. We do not access background location.
• Device information: device type, operating system, and app-related identifiers needed to deliver push notifications and keep your account signed in.
• Push notification token: if you enable push notifications, we store the device token so we can deliver alerts you opt into.
• Technical logs: limited server logs such as request timestamps and error messages, used for security and debugging.

Information from third parties

We ingest publicly available wildlife observation data from sources such as iNaturalist (and, where licensed, eBird). That observation data is not personal to you, but it powers Nearby, Map, and related features.

2. How we use information

We use the information we collect to:

• Provide and operate the Service (nearby sightings, predictions, alerts)
• Authenticate your account and maintain your session
• Process and display the wildlife sightings you submit
• Send push notifications you’ve subscribed to (for example, rare-species alerts)
• Communicate with you about service updates, security alerts, or support requests
• Detect and prevent fraud, abuse, and security incidents
• Improve and develop the Service
• Comply with legal obligations

We do not sell your personal information to third parties for advertising.

3. How we share information

We share information only as follows:

Other users. Your display name, avatar, and the sightings you log are visible to other users of the Service. The location precision of each sighting is governed by your privacy setting (Exact, Approximate, or Hidden) — Approximate is the default and rounds your location before other users can see it. Hidden sightings are visible only to you.

Service providers. We use third-party processors to operate the Service, including:

• Supabase — database, authentication, and file storage
• Apple Push Notification service / Firebase Cloud Messaging — push notification delivery
• Expo — push token registration and app update infrastructure
• iNaturalist (and, where applicable, eBird) — wildlife observation and species media data sources

These providers receive only the data necessary to perform their function and are bound by their own privacy and data-handling commitments.

Legal compliance. We may disclose information if required by law, subpoena, court order, or other legal process; to protect our rights, users, or the public; or to investigate fraud or security incidents.

Business transfers. If we are acquired, merged, or restructured, your information may be transferred as part of that transaction. We will notify you when required and provide an opportunity to delete your account where practical.

4. Your privacy controls

• Location precision. Each sighting you log has a privacy setting — Exact, Approximate, or Hidden.
• Push notifications. Manage subscriptions in the app, or disable system-level notifications from your device settings.
• Profile visibility. Your display name, avatar, and life list summary may be visible to other users. Your email is never visible to other users.
• Access and correction. You can view and edit most account information in the app. For other requests, email support@outrly.app.
• Data export. You may request an export of your account data by emailing support@outrly.app. We will respond within 30 days.
• Account deletion. You can delete your account from Profile in the app, or by emailing support@outrly.app. See our account deletion page for details.

5. Your rights under privacy laws

California residents (CCPA / CPRA)

You have the right to know what personal information we collect, to request deletion or correction, to opt out of any “sale” or “sharing” (we don’t sell or share for cross-context advertising), and to be free from discrimination for exercising these rights. To exercise these rights, email support@outrly.app.

EU / UK residents (GDPR)

If you are in the European Economic Area or the United Kingdom, you have rights to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. The lawful basis for our processing is your consent (for optional features like push notifications) and performance of our contract with you (for core functionality). To exercise these rights, email support@outrly.app.

Other jurisdictions

If you are in a jurisdiction with privacy laws that grant you similar rights, you may exercise those rights by contacting us at support@outrly.app.

6. Children’s privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it. If you believe we have collected information from a child under 13, please contact support@outrly.app.

Users between 13 and 18 should have a parent or guardian’s permission to use the Service.

7. Data retention

We retain your account information for as long as your account is active. After you delete your account:

• Profile data, push tokens, and personal preferences are deleted within 30 days
• Photos you uploaded are deleted from our storage within 30 days
• Sightings you logged that have been viewed, voted on, or referenced by other users may be anonymized (your user ID removed) and retained for the integrity of the community dataset
• Backups containing your data may persist for up to 90 days before being overwritten in the normal backup rotation

We retain technical logs for up to 90 days for security and debugging purposes.

8. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS), hashed password storage, and access controls on our infrastructure. No system is perfectly secure. If we become aware of a security breach affecting your data, we will notify you and the appropriate authorities as required by applicable law.

9. International data transfers

Outrly is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US. By using the Service, you consent to this transfer.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email when appropriate. The “Last updated” date at the top of this policy reflects the most recent revision.

11. Contact

Questions, requests, or concerns about this Privacy Policy? Email us at support@outrly.app.

For general app help, visit our Support page.