Field Capture privacy notice
Important: Field Capture is a private moderation beta. Community media is not automatically published. Exact device location is collected only when a participant deliberately starts Field Capture and accepts the collection notice.
What Enroofe collects for Field Capture
For a submitted field set, Enroofe collects the live-camera image bytes, capture time, two device-location fixes (before and after capture), reported location accuracy, a one-time server challenge, SHA-256 media hashes, the selected neutral observation category, and a short-lived salted request hash used only for abuse rate limiting. Raw IP addresses are not written to the capture database.
Member accounts
Creating an account is optional for an ordinary field capture. A member account stores an email address, public display name or alias, a one-way password verifier, account/session records and — only if supplied — an optional private real name. Enroofe does not collect profile photos or avatars. Email and optional real name are not public fields. Corroborating another member capture requires a signed-in member identity so the service can enforce a distinct-contributor check.
Private and public location
Exact coordinates are encrypted for private validation and review. The public-facing location is rounded to an approximate cell. A public cell must not be treated as a precise address or path history.
What the capture proves
A location-recorded capture supports a statement about the Enroofe capture process and the location signals received by Enroofe. It does not prove the cause of vegetation change, prove that a chemical was used, identify a responsible person or organisation, or certify an area as safe or unsafe.
People-free image rule
Enroofe does not accept human imagery for Field Capture. This includes children, adults, workers, contractors, background figures, reflections, visible body parts and people who are blurred, pixelated or partly obscured. Readable private vehicle number plates, personal name badges and identifying private-residence details are also outside the capture scope. Enroofe validates and privacy-screens the entire field set before writing any image from the set to private media storage or accepting capture/media rows into the database. If any frame fails, the whole set is rejected. If screening is unavailable or indeterminate, submission fails closed. Automated screening can produce false positives or false negatives and is not a guarantee; accepted submissions still remain private for review.
Children and contributor age
The informational website may be browsed generally, but member accounts and Field Capture contributions are currently limited to people aged 18 or older. Enroofe does not seek photographs, location data or account information from children for contribution features, and children must never appear in submitted field images.
Retention
Private beta capture records carry a 90-day deletion deadline. The scheduled housekeeping worker removes expired private media and capture records. Expired member sessions and short-lived authentication rate-limit events are also purged. Member-account records persist while the account is active so sign-in can function; account closure/deletion requests are handled by the operator during this beta.
AI use
AI is used as a constrained privacy-screening gate for submitted field images and may be used by an authenticated operator to draft aggregate activity summaries, newsletters or social copy. The drafting tool receives aggregate counts rather than private media, exact coordinates, emails or real names, and it cannot publish automatically in this release.
Public publication
This release has no public-media endpoint and does not auto-publish community images. Any later public-media feature should preserve the no-human rule, human moderation, conservative evidence labels and the separation of exact/private from rounded/public location.
Privacy/content concerns
Use the privacy/content concern form to flag a capture reference, privacy issue or suspected breach. The form accepts text only; do not submit person-containing imagery through Enroofe. A report stores the concern category and text, an optional capture/reference ID, an optional contact email, status/timestamps and a daily-rotating salted request hash used for abuse control. Resolved or dismissed reports are scheduled for deletion after 180 days.
Contact / legal posture
This notice describes the beta engineering posture and is not legal advice. A public-scale contribution network should receive Australian privacy and consumer-law review as the service, operating entity and publication workflows mature.