Privacy notice

Information we handle and why

• Accounts: your email address, account identifier, email-confirmation status, sign-in and recovery records, and authentication credentials handled by Supabase. At signup we also receive your self-declared age band (legal adult or at least 13 but not a legal adult where you live), any required guardian-permission declaration, and your Terms acknowledgement with a policy version. We use these to assess account eligibility and document the declaration; they do not verify age or parental permission. We use account records to create and secure your account, restore access, and associate purchases with you. Do not send us your password or confirmation/reset link.
• Website purchases: the product purchased, account identifier, payment-provider references, payment status and relevant transaction records. Checkout sends your account email and purchase references to Stripe. Stripe handles payment details; our website does not receive or store your full card number or security code. Payment or billing information may also be available to us through the provider's merchant tools for support, accounting and disputes.
• Etsy verification: the order number you enter is checked through our seller-side Etsy connection. The verification flow uses order/payment status and purchased-item identifiers, then saves hashed order/transaction references and the resulting account access records. A hash is still account-linked information, not anonymous data. This flow does not require your Etsy password or a match between your Etsy email and account email. Information available separately through our Etsy seller account is governed by Etsy's platform practices and our handling described here.
• Library and content access: purchased product identifiers, included study-pack revisions, access status and relevant timestamps. We use these to show your books, authorize downloads and study images, and prevent an order from being claimed by multiple accounts.
• Technical and security data: hosting and authentication providers process request information such as IP address, browser/device details, timestamps, requested paths and errors. Our claim-rate limiter uses an account identifier and a keyed hash of the connection IP to deter repeated guessing. Requests for a chosen study set contain the selected species identifiers; infrastructure logs may record request paths or query strings.
• Support: information you send by email or Etsy message, including your contact details and message, is used to respond, resolve purchase problems and consider corrections. The feedback form only opens an email draft; it does not submit or save that draft on our server. Sending it shares it with us and the email providers involved.

Account confirmations, password recovery and purchase/service messages are operational emails, not a newsletter subscription. If you join the email list, we keep your email address and the page where you signed up so we can send occasional emails about new collections. Sign-ups are stored with our website host, Netlify. You can unsubscribe at any time from any email or by contacting us, and we will delete your address from the list. The site has no advertising pixels. Do not send payment-card details, passwords, private download links or unnecessary sensitive information in feedback.

What stays in your browser

Sign-in session information is stored in your browser so you can remain signed in. Study & Play also saves round progress, notebook records and saved-species preferences locally where those features are available. This practice data is not currently an account-synced notebook: it can differ between browsers, devices, site addresses and private-browsing sessions.

Signing out does not erase local practice history. On a shared device, use the practice-data clearing option where available, or clear this site's data in your browser. Clearing site data can remove saved rounds and sign you out; it does not delete your account or server-side purchase records. Downloaded PDFs remain on your device until you remove them.

Our site code does not include behavioral advertising or analytics scripts. Hosting, authentication, payment and externally loaded image services can still process technical requests and use their own necessary storage or cookies. Browser Do Not Track signals do not change the site's existing data flows; the current site has no cross-site advertising-tracking feature to switch off. Any future optional tracking or account-sync features will need their own disclosures and choices before introduction.

Who receives information

We use providers to operate the service, not to make your library or practice history public:

• Netlify: website hosting, server functions, request delivery and operational/security logs.
• Supabase: accounts and authentication, purchase/access records and private file storage.
• Stripe: website checkout, payment processing, receipts and transaction support.
• Etsy: marketplace purchases and messages, and verification of eligible purchases from our shop.
• Resend: account and service email delivery, including recipient addresses, message contents and delivery records.
• Google/Gmail: correspondence sent to our published support email.

Some Field Guide photographs are loaded from Wikimedia or another credited source; that image host receives the technical request needed to show the image. Other images are served by our hosting/storage providers. Following an external reference, Etsy link or a sharing action takes you to a service with its own privacy practices. Sharing a score is optional and does not grant another person access to your purchased pack.

We may disclose relevant records when reasonably necessary to comply with law, investigate fraud or security incidents, resolve disputes or obtain professional advice. We do not operate a sale of customer data or a cross-context behavioral-advertising program through this website. Provider links explain their own practices; they do not replace our responsibility for information we control.

We operate in the United States. Providers may process information in the United States or other countries, whose privacy laws may differ from yours. Contact us with questions about the providers or safeguards relevant to your information.

Retention and security

Account and purchase-access records support your continuing library access. Transaction, fraud-prevention and support records may also need to be retained for accounting, legal obligations and dispute handling. Retention depends on the type of record, the service purpose, unresolved issues and applicable obligations; there is not a single deletion period for every record. Browser-local practice data remains until cleared or removed by the browser.

Private content requests use authenticated access checks and downloads use short-lived links. These measures reduce risk but cannot guarantee perfect security. Treat your login, order number and signed download links as private. Report suspected unauthorized access through the contact address above.

Your choices and requests

You can browse the free Field Guide without creating an account. Account-based purchases and private online content require the information needed to provide those features. You can sign out, manage site storage in your browser, and contact us to request access to, correction of, a copy of, or deletion of personal information we control.

Requests are handled manually; there is no self-service account-deletion button at present. We may ask for proportionate verification before changing account or purchase records. Do not email identity documents unless we have first explained a necessary, appropriate verification method. We will explain relevant limits, including records we must retain and the effect of account closure on online access. Deleting browser data alone is not an account-deletion request.

Depending on where you live and which laws apply, you may also have rights to object to or restrict processing, withdraw consent for consent-based processing, appeal a request decision or complain to a privacy regulator. Contact us to exercise applicable rights. Where a legal basis is required, service delivery and purchase fulfillment, security and support interests, legal obligations, or consent where required are the relevant purposes/bases. This notice does not waive your legal rights.

Young users

Online accounts are for people aged 13 or older. Users under the age of legal adulthood must have a parent or guardian's permission; purchases must be handled by an adult. If local law requires a higher age or additional parental consent, those requirements still apply.

Children under 13 must not create accounts or submit personal information through the website or support channels. Adults can obtain printable materials for offline learning. We do not currently offer child accounts or a verified parental-consent service. If you believe an under-13 child has submitted personal information, contact us so we can investigate and take appropriate steps, including deletion where required. Please do not include the child's details in a public comment.

Changes to this notice

We will update this page as the service or its information practices change, with a new date above. Material changes may also be highlighted on the website or communicated to affected account holders where appropriate or required. We will obtain additional consent when the law requires it. Planned features are not treated as already active.