Privacy Policy
Effective date: August 7, 2026. Applies to: the Plant With Purpose mobile application for iOS and Android, and the Plant With Purpose staff web portal.
1. Who we are, and who this policy is for
The Plant With Purpose app is published by Floresta USA, Inc., doing business as Plant With Purpose, a California non-profit corporation with its office at 5075 Shoreham Place, Suite 240, San Diego, California 92122, United States. In this policy, "we", "us" and "our" mean Floresta USA, Inc.
This app is an internal work tool. It is not a consumer product and it has no public sign-up. Accounts are created for you by your programme administrator, and only staff of Plant With Purpose and of our partner organisations can use it. If you are reading this because you saw the app on the App Store or Google Play and wondered what it does: it is how our field teams record the tree-planting, training and community work they carry out, and there is nothing in it for a member of the public to use.
"You" in this policy means the staff member using the app. Section 5 covers the separate and important question of the people you record while doing your job.
The app is available in English, Spanish, French, Amharic, Kiswahili, Chichewa, Thai and Haitian Creole.
2. What we collect
Your account. Your name, your work email address, your role, and the country or countries you are assigned to. Your password is stored only as a cryptographic hash. It cannot be read by anyone, including us.
The visits you record. The date of a visit and its start and end time; the activity, sub-activity, unit and type recorded against it; attendance; the number of trees planted; your written comments; and the church, school, group or core area the visit relates to. Every visit is stamped with the account that filed it and the time it was filed.
Location. When you complete a visit, the app reads your device's location and stores it, together with a figure describing how accurate that reading was, on the visit record. A location fix is required — a completed visit cannot be saved without one. This is deliberate: the entire purpose of the record is to establish where in a watershed a planting or a training session actually took place. Photographs you take are individually tagged with the location they were taken at.
The app reads your location only while you are actively filling in a visit. It holds no background-location permission, it cannot read your position when it is closed or when you are using another app, and it does not build any history of your movements between visits.
Photographs. Photographs you take with the camera, or choose from your photo library, in order to attach them to a visit record, along with any caption you write for them.
Voice and video notes. If you choose to record one, the app captures audio or video during a visit and attaches it to that visit. These are optional — a visit can be completed without them. Each recording is transcribed into two languages: English, and the working language of the country the visit took place in. Both the recording and its transcripts are kept on the visit record.
Your signature and your feedback. The signature you draw to confirm the visit took place, and the written feedback you provide alongside it. Both are required to file a visit.
A push notification token. An anonymous identifier issued by Apple or by Google that allows us to send you a notification about work assigned to you. It identifies an installation of the app, not you personally, it is not connected to any advertising identifier, and it cannot be used to recognise you anywhere outside this app.
3. What we do not collect
We do not collect your contacts, your calendar, your messages, your health or fitness data, your browsing or search history, your financial information, or anything you do in any other app on your device.
The app contains no advertising and no advertising identifiers. It contains no analytics software, no tracking software, no profiling software and no crash-reporting software of any kind. We do not build a profile of you. We do not sell, rent or trade information about you to anyone, for any purpose. Nothing the app collects is ever used for advertising, and nothing is ever shared with a data broker.
We do not track your location in the background. The app has no always-on location permission and cannot determine where you are while it is closed or while you are doing something else.
We do not read your photo library. When you choose to attach a photograph, your device hands us that one photograph and nothing else.
4. Why we collect it
Your account details exist so that you can sign in, so that the app can show you the schedules and records you are responsible for and hide the ones you are not, and so that each record carries the name of the person who filed it.
Visit records are the work product of the programme. They are how we know what was done, where, by whom, and with what result, and they are what our reporting to funders and to our own board is built from.
Location is collected so that a planting or a training session can be attributed to the correct watershed, and so that programme results can be verified and mapped. Field programmes are funded on the understanding that work happened where it was reported to have happened, and a location reading taken at the moment of the visit is how that is evidenced. It is not collected to supervise your movements, and because the app cannot read location in the background it is not capable of doing so.
Voice and video notes exist because the app is used in rural areas by staff who are frequently standing in a field with a farming family, where typing out a long account of a conversation is impractical and where writing it up hours later loses most of it. Recording it and transcribing it afterwards is faster and produces a more faithful record. The transcript is produced in two languages so that the person who made the recording and the programme staff who read it later do not have to share a language.
Photographs, signatures and feedback are the evidentiary record of a visit.
The push token is used only to notify you about work assigned to you.
We do not use any of this data for any purpose other than running the programme and reporting on it.
5. About the people you record
This section matters, and we ask you to read it even if you skip the rest.
When you file a visit you are usually recording information about other people — farmers, families, church and school groups, community members. Their attendance is counted. They appear in photographs. The location recorded is often the place where they live or farm. A voice note may contain their words.
That information belongs to them, not to us and not to you, and we hold it on the following basis:
- Ask first. Before photographing someone or recording their voice, tell them what it is for and get their agreement. If they say no, the visit can still be filed — nothing in the app requires a particular person's face or voice.
- It is used only for the programme. Information about participants is used to run and report on the work, and for nothing else. It is never used for advertising, never sold, never shared with anyone outside the organisations named in section 6.
- It is not published. Photographs and records filed through this app are visible only to authorised staff inside our own system. They do not appear on any public website, social media account or fundraising material as a result of being filed here. If we ever want to use a particular photograph publicly, that is a separate conversation and a separate permission, asked for at the time.
- Withdrawal. If a participant later asks that their photograph, recording or record be removed, contact us at the address in section 12 and we will remove it.
If you are a programme participant reading this and you want to know what we hold about you, or you want it deleted, please contact us directly using the details in section 12. You do not need to go through a staff member.
6. Who else sees it
Inside Plant With Purpose, a visit record is visible only to staff whose role and assigned country give them access to it. A field facilitator sees their own country's work. Regional and national staff see their own region or country. Only a small number of administrators can see everything.
Outside Plant With Purpose, the data reaches the following service providers, all of which process it strictly on our instructions and none of which may use it for their own purposes:
Google Cloud Platform hosts our storage and our database. Photographs, recordings and visit records are held in our own Google Cloud project, under our own control.
Google Cloud Vertex AI produces the transcripts of voice and video notes. Recordings are sent to that service only for transcription; they are not retained by it after the transcript is returned, and under Google Cloud's terms they are not used to train any model.
Apple Push Notification service and Google Firebase Cloud Messaging deliver notifications. They receive the notification and the token that identifies your app installation. They do not receive visit records, photographs, recordings or location data.
That is the complete list. No advertising network, no analytics provider, no data broker and no other third party receives anything.
We will disclose information if we are legally required to — for example by a valid court order — and we will tell the people affected unless the law forbids us from doing so.
If Plant With Purpose were ever to merge with or transfer its programmes to another organisation, records could pass to that organisation, which would be bound by this policy until it published one of its own and gave notice of the change.
7. Where it is stored, and how it is protected
Data is stored on Google Cloud infrastructure in the United States. If you are using the app outside the United States — and most of our field staff are — your information is transferred to and processed in the United States, which may have data-protection rules different from those where you live. By using the app you are working with information that is handled this way.
In transit, everything is encrypted using industry-standard TLS. Photographs and recordings are uploaded and downloaded through short-lived signed links that expire quickly and cannot be shared or reused.
On our servers, access requires an authenticated staff account, and what any account can see is limited by its role and its assigned countries. The credentials that control our storage never leave our servers and are never present in the app.
On your device, the app deliberately keeps a copy of your assigned schedules and the visits you are filing, so that you can work in places with no mobile coverage — this is what "offline-first" means, and it is the reason the app is useful at all in rural programme areas. That local copy is stored inside the app's private storage, which the operating system protects from other apps, and which is encrypted by the device itself when you have a passcode or screen lock set. We strongly recommend setting one.
We have switched off automatic backup of that local copy to Google Drive and iCloud, and switched off phone-to-phone transfer of it, so that programme records cannot leave a device through a route nobody chose. Once a visit has been filed and synced, it lives on our servers; the app does not download other people's completed records or their photographs onto your phone.
No system is perfectly secure, and we do not claim otherwise. If a breach ever affects your information we will tell you, and the relevant authorities, as promptly as the law requires.
8. How long we keep it
Visit records, photographs, recordings and transcripts are programme records and are kept for as long as we need them for programme reporting, funder accountability and historical impact measurement. In practice this is the life of the programme and a period after it, because a watershed restored twenty years ago is still evidence of what the work achieves.
Your account is kept while you work with us. When you leave, your login is disabled. Your name stays attached to the visits you filed, because a record of who did the work is part of what makes the record meaningful — the same way a signed paper form keeps its signature.
Voice and video recordings may be deleted once their transcripts have been reviewed, at the discretion of programme staff. Transcripts are kept with the visit record.
Push notification tokens are discarded when they stop working, or when you sign out or uninstall the app.
9. Your choices, and your rights
Permissions. You may decline camera, photo-library, microphone, location or notification access at any time in your device settings, and you may withdraw any of them after granting it. Please understand what each one means:
- Location, at least one photograph, and a signature are required to file a completed visit. These are what a visit record consists of. Declining them does not degrade the app gracefully; it means visits cannot be filed from that device.
- Microphone is entirely optional. Declining it does not prevent you from completing a visit, and never will.
- Notifications are optional. Declining them means you will not be told when work is assigned to you.
Nothing you decline is collected by some other route or in the background.
Language. You can change the app's language at any time from Settings. The change is immediate and needs no restart and no connection.
Access, correction and deletion. You have the right to ask what we hold about you, to ask us to correct anything wrong, and to ask us to delete it. Write to us using the details in section 12 and we will respond within thirty days. Requests to delete programme records may be limited where we have a legal or funder obligation to retain them, and we will tell you plainly if that applies and why.
Depending on where you live you may have further rights under local law, including the right to object to processing, to ask for a portable copy of your data, and to complain to your national data-protection authority. We will honour those rights wherever they apply, regardless of whether we are strictly obliged to.
Accounts are not self-service. Because accounts are created and removed by your programme administrator rather than by you, there is no "delete my account" button in the app. Section 12 is the route, and it is a real one.
10. Children
This app is a workplace tool for adults. It is not directed at children, we do not knowingly create accounts for anyone under 18, and there is nothing in it aimed at a child audience.
Children do appear in programme work — in school programmes, and in family photographs taken during visits. Section 5 applies to them with particular force. Ask a parent, guardian or responsible teacher before photographing or recording a child, and do not do it if the answer is no.
If you believe we hold information about a child that we should not, contact us using the details in section 12 and we will delete it.
11. Changes to this policy
We will update this page when the app changes in a way that affects what we collect or how we use it. The effective date at the top always shows when the current version was published, and material changes will be announced inside the app.
This version was published to describe the location, photograph, voice-note and video-note features introduced in version 1.0 of the mobile app, and to describe the transcription service used to process recordings. A previous version of this page stated that the app contained no location functionality. That was accurate when it was written and is no longer accurate; section 2 now describes location collection in full.
12. Contact us
Questions about this policy, requests to see, correct or delete information, and requests made on behalf of a programme participant:
Plant With Purpose (Floresta USA, Inc.) 5075 Shoreham Place, Suite 240 San Diego, CA 92122 United States
Telephone: 800-633-5319 Email: [email protected] ← add the mailbox that will actually be monitored
We aim to answer every request within thirty days.
