RootFlare is made and run by Trail10 (“we”, “us”). This policy covers the information we handle about people who visit rootflare.app and people who use RootFlare (“you”). Our guiding principle is to collect only what we need to run the service, and to never sell it: we never have, and we never will.
The assessments you record often include information about your own clients, such as their names, contact details and property addresses. We hold that information on your behalf, to provide the service to you, and use it for nothing else. You decide what goes in, and you're responsible for having your clients' permission or another lawful reason to record it. If you're one of our customers' clients and have a question about your information, please contact the arborist or company who recorded it.
What we collect and why
Your account
When you sign up or are invited to a team, we ask for your name, email address and password (stored only as a secure hash), and your business's name. You can add more in Settings: your business address and logo, a profile photo, your signature, and your credentials with any badge images. Most of these appear on your reports, which is why we ask for them.
Billing
If you subscribe, your card details go directly to our payment processor, Stripe, and never reach our servers. We keep a record of your plan, billing period, subscription status and your card's brand and last four digits, so we can show you your billing and invoices. Your invoices are fetched from Stripe when you look at them.
Your assessments
We store what you create in RootFlare so the service can work: trees, assessments, clients, inventories, photos and the markings you draw on them, the reports you generate, and the emails you send reports by. This includes location data: the coordinates you give a tree, and the location a phone saved inside a photo, which we read so a tree can be shown on a map. If you import a client's tree inventory, we keep the columns from that file as you uploaded them.
Sign-in and security records
For each signed-in session we record the IP address and browser it came from, so we can keep your account secure and spot misuse. We also keep a history of changes to your records (who changed what, and when), which lets us help if something is changed or deleted by mistake.
Messages you send us
When you write to us through Help & Support, the Contact page or email, we keep your message and email address so we can reply and refer back to it if you get in touch again.
Visiting the website
We don't use analytics, advertising or tracking scripts, and we don't follow you around the web.
AI analysis and tree identification
AI analysis is off unless your account adds its own Anthropic API key in Settings → AI. There is no shared key, and nothing is ever sent to Anthropic without one.
When you run an AI analysis, RootFlare sends Anthropic the tree's photos and the assessment details entered so far, such as species, dimensions, targets, conditions and failure modes, as context for the analysis. It never sends your client's name, the site address, your business details, or anything identifying the assessor or the person running the analysis.
When you identify a tree, RootFlare sends Anthropic the photos you choose, the month each was taken, roughly where (rounded to about 10 km), your account's country and any notes you type for Claude. Never the exact location or date, or anything identifying you or your clients. Your identifications stay in your history until you clear them; photos you add to a tree stay in its gallery.
An AI analysis does include every free-text field you fill in: photo captions, location and species notes, notes on the assessment, its conditions and failure modes, limitations, target and mitigation descriptions, and a tree's own notes. They are sent exactly as you wrote them, so anything you type into one of them, a name or an address included, goes with them.
Your API key belongs to your account. It's stored encrypted, only ever shown as a short hint so you can tell keys apart, and never logged or sent to a phone. Anthropic handles what it receives under your own agreement with Anthropic.
Data on your phone
Field mode is built to work without signal. While you work, the assessments and trees you open and the photos you take are stored on that phone or tablet, in the browser's own storage, tied to your signed-in account, until they sync to our servers. They can stay there after you close the app, for as long as it takes to get back online.
“Remove data from this device” in field mode clears what field mode stored on that device, and signing out warns you first if anything hasn't synced yet.
Cookies and third-party content
We use one essential cookie to keep you signed in; the service can't work without it. When you add or change a card, Stripe's own script runs on that page and may set cookies of its own to help prevent fraud. Maps in RootFlare load their tiles directly from OpenStreetMap and the U.S. Geological Survey, which see your IP address when your browser asks them for a tile.
Who helps us run the service
We use a small number of service providers, each only for its own job:
- Amazon Web Services hosts the application, its database and your files, in the United States.
- Stripe processes payments.
- SendGrid (Twilio) delivers the emails the service sends: password resets, invitations and the reports you email.
- Honeybadger receives error reports when something breaks, with technical details of the request; passwords, email addresses and keys are filtered out first.
- Anthropic receives AI analysis and tree identification requests, only from accounts that add their own key (see above).
When we access or disclose your information
No person at Trail10 looks at your content except for these reasons:
- To help when you ask. If you ask for help, we may sign in to your account to see what you see. Every time we do, it's recorded.
- To fix something that broke. If an error stops something from working, such as a report or an import, we may need to look at the records involved to fix it. We look at as little as we can, and fix the cause so it doesn't happen again.
- To protect the service. We look at logs and records to keep the service secure and to investigate misuse.
- When the law requires it. Trail10 is a U.S. business and the service's data is stored in the United States. We disclose your information to authorities only when compelled by valid legal process, such as a warrant, subpoena or court order, and where we're allowed to, we'll tell you first.
If Trail10 or RootFlare is ever acquired or merges with another company, we'll tell you before your information is transferred or becomes subject to a different privacy policy.
Your rights
We apply the same rights to everyone, wherever they live:
- To know and to access what we hold about you and how it's used.
- To correct it. Most of it you can change yourself in Settings.
- To take it with you. You can download your reports as PDFs, and your trees as CSV or GeoJSON from Settings → Data.
- To delete it, subject to what the law requires us to keep. Deleting your account means we can no longer provide the service to you.
- To object to or restrict how we use it.
- To be treated the same whether or not you use any of these rights.
- To complain to a data protection authority where you live.
To use any of these rights, email us. We may need to confirm it's really you before we act on a request.
How we secure your data
Everything between your browser and our servers travels over an encrypted connection (TLS). Your database, files and backups are encrypted at rest, and your Anthropic key has an extra layer of encryption of its own. Access to the servers is limited to the people who run the service.
Deletion and retention
Most things you delete in RootFlare are deleted right away. An assessment that a report was made from is archived instead, so a report you've already sent keeps the record it came from, and the photos a report uses are kept for as long as the report is.
If you cancel your subscription, your account becomes read-only at the end of the period you've paid for: you can still see and download everything, and you can resume at any time. We keep your data while the account exists. To delete your account and its data, email us: we'll remove it from our active systems within 30 days and from our backups within 90 days.
Where your data is
RootFlare is operated in the United States and your data is stored there. If you use it from elsewhere, your information is transferred to and stored in the United States.
Children
RootFlare is a professional tool and isn't meant for children. We don't knowingly collect information from children.
Changes to this policy
We may update this policy as the service changes or the law requires. When we make a significant change, we'll update the date at the top of this page and email account owners before it takes effect.
Questions
Email us at contact@rootflareapp.com or use the Contact page, and a person will read it.
Adapted from the Basecamp open-source policies / CC BY 4.0.