Privacy notice

Stranding is a citizen-science project for reporting sightings and strandings of marine organisms. Personal data is processed by Davide Crupi and Alice Guzzi as joint controllers under Article 26 GDPR: we decide together on the purposes and means of processing and respond together to requests.

For any privacy question or to exercise your rights, write to [email protected] or use the support form on the website. You may contact either joint controller: both handle the request.

We have not appointed a data protection officer (DPO), as it is not required for a project of this size.

• Account: email, password (stored only as an Argon2 cryptographic hash, never in clear text), public name (may be a pseudonym), language, role, notification and display preferences, last sign-in date; optional bio and profile picture.
• Guest use: if you report without an account, we assign a random device identifier and keep the contact email if you choose to leave one.
• Sightings: organism or species, observation date and time, exact GPS coordinates and their accuracy, country derived from the coordinates, place description, number of individuals, condition, notes and photos.
• Photos: once the upload is completed, the server removes EXIF metadata (such as GPS coordinates, date and device model); until then the original file stays in a temporary, non-public area. If you add a watermark, the text you choose (name, social handle or email) becomes part of the image.
• Community: identifications and votes, comments, environmental annotations, sighting participants and attribution requests.
• Scores: identification karma and accuracy, activity streaks and eligibility for higher roles.
• Field sessions (feature not yet active): GPS track with points, speed, times and notes.
• Notifications: notification text on the website; in the app, the device token for push notifications.
• Support: name, email, message, the page you write from and any linked sighting.
• Beta programme: answers to the application form (email, first and last name, age bracket, country and region of residence, whether you live or will be on the coast and where, availability and interests), the invitation you received, test reports with outcome, comments, bugs and suggestions, and technical browser data attached to reports (browser and system version, window size, language).
• Mailing list and waiting list: email, language, origin and date of signup, confirmation date, any referral code and a log of emails sent.
• Accepted documents: version of the Terms and Privacy notice, date and age confirmation; for the beta programme, also confirmation that you are an adult.
• Security: IP address, requested page (without parameters), times and outcome of requests in server logs; a cryptographic fingerprint of IP and email, briefly used to limit repeated attempts; a log of administrator actions.
• Ambassador programme (not yet active): role, motivation, affiliated institution, invitations and referral codes.

We do not ask for special categories of data (such as health, opinions or origin), we do not process payment data and we do not use traffic analytics or advertising tools.

• Creating and managing your account, publishing sightings, enabling identifications and comments, sending service emails (address verification, password recovery, review outcome): performance of the contract, i.e. the Terms you accept (Art. 6(1)(b) GDPR).
• Moderating content and handling support or removal requests: performance of the contract and our legitimate interest in keeping the platform fair (Art. 6(1)(b) and 6(1)(f)).
• Protecting accounts and infrastructure, preventing abuse and spam, keeping technical logs and limiting repeated attempts: legitimate interest in the security of the service (Art. 6(1)(f)).
• Calculating community scores and role eligibility: performance of the contract (Art. 6(1)(b)).
• Beta programme: the application is a pre-contractual step taken at your request; participation and reports are part of performing the contract (Art. 6(1)(b)).
• Mailing list and project updates: consent (Art. 6(1)(a)), confirmed through an email link and revocable at any time.
• Push notifications in the app: consent you give to the operating system, revocable from the device settings (Art. 6(1)(a)).
• Scientific research and publication of approved sightings as open data: legitimate interest in contributing to knowledge of marine biodiversity, with the safeguards of Article 89 GDPR (Art. 6(1)(f)).
• Aggregate, anonymous statistics on use of the service and on sightings: legitimate interest (Art. 6(1)(f)).
• Complying with legal obligations, answering authorities, demonstrating the consents collected and defending our rights: legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f)).

Email, password and sighting data are required to use the service: without them we cannot create the account or publish the sighting. Bio, profile picture, notes, guest email, mailing-list signup and beta application are optional.

• Public profile: public name, bio, profile picture, role, scores, activity streaks and number of contributions and confirmed sightings. Your email is never public. Profile pages are not indexed by search engines.
• Approved sightings: organism, date, time, exact coordinates and their accuracy, notes, photos and the public names of the author and participants. They are visible to anyone, including through the website’s technical interfaces, and the sighting page may be indexed by search engines. The submission form reminds you of this before you confirm.
• Comments and identifications are public together with the public name of their author.

Locations are published exactly. An administrator may reduce or correct their precision, for example to protect a sensitive species or if the point reveals a private place such as a home: in that case, write to us.

Do not upload photos showing recognisable people, minors, number plates or other third-party data without permission. Public photos can be viewed, downloaded and copied by anyone.

Approved sightings may be published as open data in open scientific biodiversity archives, such as GBIF or OBIS, under an open licence that allows reuse with attribution.

Datasets include organism, date and time, coordinates and their accuracy, number of individuals, condition, links to published photos and the author’s public name as attribution. They never include email, contact details or account data.

Published datasets can be downloaded and reused by third parties: if a sighting is removed we take it out of later versions, but we cannot delete copies others have already downloaded. If you do not want your sightings in open data, write to us before publication and we will exclude them.

We do not sell data or use it for advertising. Only the providers needed to run the service process it on our behalf, as processors (Art. 28 GDPR):

• Railway (Railway Corporation, United States): hosting of the application and database.
• Cloudflare (Cloudflare, Inc., United States): content delivery and protection for the website, storage and delivery of photos and images. It receives the IP address of anyone who visits the site or uploads and views photos.
• Resend (Resend, Inc., United States): sending automatic emails, through Amazon Web Services infrastructure in Ireland.
• Google (Google Ireland Limited and Google LLC): the project’s Gmail mailbox, used for support and for invitations sent by hand; in the app, Firebase Cloud Messaging for push notifications.
• OpenStreetMap Foundation (United Kingdom): maps. Both the website and the app load them through our own intermediate server, so it does not receive your IP address.
• Nominatim (OpenStreetMap Foundation): derives the country from a sighting’s coordinates. It receives only the coordinates, no data identifying you.
• Research Organization Registry (ROR): receives only the search text when an ambassador looks up their institution (feature not yet active).

Within the limits of their role, the two joint controllers and the people who moderate the platform have access to the data. We disclose data to authorities only when required by law.

Some providers are based in the United States and may process data there. We rely on providers that offer the Standard Contractual Clauses approved by the European Commission or participate in the EU-US Data Privacy Framework (Articles 45 and 46 GDPR). The United Kingdom, where the OpenStreetMap Foundation is based, is covered by an adequacy decision.

You can ask us about the safeguards in place by writing to [email protected].

• Account, profile and contributions: while the account is active. When it is closed, the section on account closure applies.
• Drafts and unapproved or rejected sightings: until you delete them or close your account.
• Sign-in: the session renewal lasts 1 day, or 30 days if you choose “Remember me”; the email verification link is valid for 24 hours, the password reset link for 30 minutes.
• Website notifications: deleted automatically after 90 days if read, after 365 days if unread.
• Beta tester form applications: deleted automatically 30 days after submission.
• Beta invitations: the personal link is valid for 7 days; invitations revoked, declined or expired without activation are deleted automatically 90 days later.
• Mailing list: until you unsubscribe. After unsubscribing we delete the address and keep only a non-reversible cryptographic fingerprint for 5 years, so we do not write to you again by mistake. Signups never confirmed are deleted automatically after 30 days, and the log of emails sent after 12 months.
• Support requests: deleted automatically 12 months after the reply or closure.
• Beta reports: kept while useful to improve the service; after 24 months we remove the technical browser data and, if you close your account, they stay without your name or email.
• Limits on repeated attempts: we store only a cryptographic fingerprint of IP and email, kept for the duration of the limit (from a few minutes to 24 hours) and removed at the next automatic cleanup.
• Server technical logs: for the retention period of the hosting service.
• Accepted documents and the log of administrator actions: for as long as needed to demonstrate compliance.
• Copies of public images in the browser and content-delivery caches: up to 1 year; when we remove an image we request cache invalidation.

You can close your account from Profile settings, under “Account deletion and anonymization”. We immediately delete your email, password, bio, profile picture, preferences and active sessions; your name becomes “Removed user”.

Drafts and sightings not yet approved are deleted together with their photos. Approved sightings, photos, comments and identifications stay public but are moved to an archive profile without your name, because they are part of the shared scientific archive. You can ask for their removal at any time, including after closure.

Closing your account also removes personal data from other features: support requests and beta reports are kept without your name, email and browser data; field sessions move to the archive profile without your notes; we delete your mailing-list signup, the log of emails sent, beta invitations and applications, notifications and devices registered for push notifications.

At any time you can ask us to:

• access your data and receive a copy;
• correct or complete it;
• erase it, in the cases set out in Article 17 GDPR;
• restrict its processing;
• receive it in a structured, machine-readable format (portability): from Profile settings, “Your data”, you can download it immediately as a JSON file;
• object to processing based on legitimate interest, including publication as open data;
• withdraw consent, without affecting processing already carried out: every mailing-list email contains an unsubscribe link, and push notifications can be turned off in the device settings.

Write to [email protected]. We reply within one month, extendable by two further months for complex requests, in which case we will let you know. To protect your data we may ask you to confirm your identity, usually by writing from your account email.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

You can create an account from age 14, the age set in Italy for consent to online services (Art. 2-quinquies of the Italian Privacy Code), by confirming it at registration. The beta and ambassador programmes are reserved for adults.

If we find an account belonging to someone under 14, we close it. Parents and guardians can write to us with any request.

We use encrypted HTTPS connections, store passwords only as Argon2 hashes, protect sessions with HttpOnly and Secure cookies, 15-minute access tokens and rotating renewal, remove EXIF metadata from photos, restrict and log administrator access and block repeated attempts.

If a data breach poses a risk to your rights, we notify the Garante within 72 hours and, when the risk is high, we also inform you.

We automatically calculate karma and accuracy scores and community role eligibility based on confirmed identifications. These values help the people who moderate the platform: no decision with legal or similarly significant effects on you is taken solely by automated means (Art. 22 GDPR). We do not profile you for advertising.

We use only technical cookies and storage, needed for sign-in, security, language and service continuity. We use no analytics, profiling or advertising cookies, so no consent banner is needed. The full list is on the “Cookies, tokens and storage” page.

If we change this notice substantially we update the version and ask you to review it at your next sign-in. This is version 1.1, effective 1 October 2026; it replaces version 1.0 of 4 August 2026.