Field Capture privacy notice
Important: Field Capture is a private moderation beta. Community media is not automatically published. Exact device location is collected only when a participant deliberately starts Field Capture and accepts the collection notice.
What Enroofe collects for Field Capture
For a submitted field set, Enroofe collects the live-camera image bytes, capture time, two device-location fixes (before and after capture), reported location accuracy, a one-time server challenge, SHA-256 media hashes, the selected neutral observation category, and a short-lived salted request hash used only for abuse rate limiting. Raw IP addresses are not written to the capture database.
Member accounts
Creating an account is optional for an ordinary field capture. A member account stores an email address, public display name or alias, a one-way password verifier, account/session records and — only if supplied — an optional private real name. Enroofe does not collect profile photos or avatars. Email and optional real name are not public fields. Corroborating another member capture requires a signed-in member identity so the service can enforce a distinct-contributor check.
Private and public location
Exact coordinates are encrypted for private validation and review. The public-facing location is rounded to an approximate cell. A public cell must not be treated as a precise address or path history.
What the capture proves
A location-recorded capture supports a statement about the Enroofe capture process and the location signals received by Enroofe. It does not prove the cause of vegetation change, prove that a chemical was used, identify a responsible person or organisation, or certify an area as safe or unsafe.
People-free image rule
Enroofe does not accept human imagery for Field Capture. This includes children, adults, workers, contractors, background figures, reflections, visible body parts and people who are blurred, pixelated or partly obscured. Readable private vehicle number plates, personal name badges and identifying private-residence details are also outside the capture scope. Enroofe validates and privacy-screens the entire field set before writing any image from the set to private media storage or accepting capture/media rows into the database. If any frame fails, the whole set is rejected. If screening is unavailable or indeterminate, submission fails closed. Automated screening can produce false positives or false negatives and is not a guarantee; accepted submissions still remain private for review.
Children and contributor age
The informational website may be browsed generally, but member accounts and Field Capture contributions are currently limited to people aged 18 or older. Enroofe does not seek photographs, location data or account information from children for contribution features, and children must never appear in submitted field images.
Retention
Private beta capture records carry a 90-day deletion deadline. The scheduled housekeeping worker removes expired private media and capture records. Expired member sessions and short-lived authentication rate-limit events are also purged. Member-account records persist while the account is active so sign-in can function; account closure/deletion requests are handled by the operator during this beta.
AI use
AI is used as a constrained privacy-screening gate for submitted field images and may be used by an authenticated operator to draft aggregate activity summaries, newsletters or social copy. The drafting tool receives aggregate counts rather than private media, exact coordinates, emails or real names, and it cannot publish automatically in this release.
Public publication
This release has no public-media endpoint and does not auto-publish community images. Any later public-media feature should preserve the no-human rule, human moderation, conservative evidence labels and the separation of exact/private from rounded/public location.
Privacy/content concerns
Use the privacy/content concern form to flag a capture reference, privacy issue or suspected breach. The form accepts text only; do not submit person-containing imagery through Enroofe. A report stores the concern category and text, an optional capture/reference ID, an optional contact email, status/timestamps and a daily-rotating salted request hash used for abuse control. Resolved or dismissed reports are scheduled for deletion after 180 days.
Map page (V7)
The map at /map/ draws its base map from OpenFreeMap, a free public tile service built on OpenStreetMap data. Your browser requests map tiles directly from that service, so it receives your IP address and the area you are viewing, as with any web map. Enroofe plans to self-host map tiles before the Android release so no third party sees map views. “Nearby” asks your device for location once, uses it only to move the map, and does not send it to Enroofe. Search looks up names in the base map already loaded on your device; your search text is not sent to Enroofe or a geocoding service.
Community Signals (not yet public)
When the public layer is switched on, a reviewed Field Capture may be published as a structured Community Signal: the observation type, a location rounded to roughly a 100 m cell, the observation time rounded to the hour, its review/corroboration state and an opaque contributor reference. Photos, free text, your alias, email, real name and exact location are never published in a signal. The contributor reference exists so other people can hide or report a contributor without learning who they are.
Reporting and hiding
You can report an observation or a contributor from the map. A report stores the target, reason, optional text, your self-declared role (visitor, member or land manager), your member ID if you are signed in, and a daily-rotating salted request hash for abuse control. Reports go to a person; they never remove content automatically. Resolved reports are deleted after 365 days. Hidden contributors are stored on your device, and in your account if you are signed in, until you unhide them or delete your account.
Product feedback
“Help improve Enroofe” stores the feedback type and text, the page you came from, app version and platform, an optional contact email, and a salted request hash. Technical details (screen size, online status, language, installed-app mode, browser and operating-system family) are stored only if you tick the box, and are removed after 30 days. Feedback is linked to your account only if you ask. Closed feedback is deleted after 180 days. Feedback is kept separate from safety and privacy reports.
Deleting your account
You can delete your account in the app or at enroofe.au/account/delete/. Deletion removes your member record, sessions, hidden list, every Field Capture linked to you (including private photos and encrypted location), and any Community Signal published from your Field Captures. Enroofe keeps only a count-only record that a deletion happened, with no identifier.
Contact / legal posture
This notice describes the beta engineering posture and is not legal advice. A public-scale contribution network should receive Australian privacy and consumer-law review as the service, operating entity and publication workflows mature.