TerraFlow
Loading...
Loading...
Last updated: February 2026
TerraFlow is committed to protecting your privacy. This policy explains exactly what we collect, how we use it, and the controls you have. We collect only what’s needed — nothing more.
TerraFlow ("we," "our," or "us") collects only what's needed to run the platform. When you create an account we store your phone number (hashed with SHA-256) or email address and display name. When you submit an environmental report we capture the GPS coordinates of that specific report, the photos you upload, the category and description you provide, and the timestamp of submission. We also collect basic device information and usage analytics to improve performance.
Your personal information is never sold to third parties for marketing purposes. Full stop. Environmental reports may be shared publicly on the accountability dashboard with personal identifiers removed — the location, category, severity, and community verification status are public; your identity is not, unless you choose otherwise. Anonymized, aggregated datasets may be shared with academic institutions for environmental research under formal data-sharing agreements.
TerraFlow captures your GPS coordinates only at the moment you submit an environmental report. We do not track your location in the background, do not monitor your movements, and do not store your home or office address. The location attached to a report is the location of the pollution incident — it becomes part of the public record for that report. Outside of active report submission, no geolocation data is collected.
We use httpOnly cookies to maintain your authentication session securely. These cookies are never accessible to JavaScript and cannot be read by third-party scripts. We use privacy-respecting analytics (no cross-site tracking, no advertising pixels) to understand how the platform is used in aggregate. You can disable cookies in your browser settings; authentication will stop working but all public data remains accessible.
All data is encrypted in transit via HTTPS/TLS. Passwords are hashed with bcrypt. JWT refresh tokens are stored in Redis with automatic TTL-based expiry. Photo uploads go directly to Cloudflare R2 via presigned URLs — they never pass through our API server. We conduct regular security reviews and follow industry-standard practices for vulnerability management.
You can request a copy of your personal data, correct inaccurate information, or delete your account and all associated data at any time from Settings → Data & Privacy. Account deletion removes your profile, contact information, and authentication credentials. Public environmental reports you submitted remain on the platform with your attribution removed — the environmental record itself is part of the public interest. To exercise any of these rights, contact us at hello@terraflow.in.
TerraFlow is not intended for use by children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately at hello@terraflow.in and we will delete the information promptly.
We may update this Privacy Policy as the platform evolves. We will post the updated policy on this page, update the "Last updated" date below, and send an email notification for significant changes that affect how your data is used. Continued use of TerraFlow after changes become effective constitutes acceptance of the revised policy.
Reach us at hello@terraflow.in for any privacy-related inquiry.
By using TerraFlow, you acknowledge that you have read and understood this Privacy Policy. View Terms of Service →