Oqio Terra's privacy policy. Last updated 27 October 2026. If we change it, we will tell you in the app.
This is one document, not two. There is a plain answer at the top of every section and the exact detail underneath it. The reasoning for that choice is at the end, under "Why this is written this way" — it is a decision about the law, not about tone.
You take a photograph of a place. We record where you were standing and when. If enough evidence builds up about that place, we may send it to an environmental regulator — and when we do, your name is not in it. You are a number and a made-up name that we generated. That is on purpose, because in several of the countries we work in, being known as the person who reported illegal mining is dangerous.
We have never sent a report to any authority. At the time of writing, the system is set to assemble reports and not deliver them. Changing that takes a recorded, deliberate decision by a person.
Oqio Inc operates Oqio Terra and decides how your information is used. In data protection law we are the controller.
Oqio Inc 867 Boylston St FL 5 Boston, Massachusetts 02116-2774 United States
We are a United States company. Our servers are in the European Union — Germany and Finland — and your information is stored there.
Plainly: your email address, a password, the name you want to show, and optionally an organisation.
We need the email address so you can get back in and so we can confirm you are a real person — one person opening many accounts could push a false report over the line, so this check protects other people as much as it identifies you. Your password is stored scrambled (bcrypt) and we cannot read it.
We also generate a pseudonym for you. It is what other people using Oqio Terra see beside your work. A report to an authority does not carry it: the record there is identified by the place, the time and its own fingerprint, and by nothing that points to you.
Your phone also makes a signing key the first time the app runs. Every photograph, clip and note you send is signed with it, so that we can tell a record was not altered after you sent it, and so that one phone counts as one source however many accounts it signs in with. The key names no hardware and leaves your phone only as its public half. Settings → Reset device key replaces it.
Plainly: your photograph or short video clip, exactly where you were standing, when, how accurate your phone thought its position was, the boxes you ticked and anything you typed, and your one-tap answer to What did you find?
that you were there — a report only counts within a set distance of the site, and an approximate position cannot show that.
person carries where you stood, not even roughly. A report to an authority carries the site's hexagonal cell (about a tenth of a square kilometre), not your coordinates; your exact position stays in the stored record, which leaves our systems only through the approvals described in section 3. That is deliberate: a precise pin next to a photograph can identify where a person was standing.
part of the clip and stays with it. If your phone refuses the microphone, the clip is recorded silent and the app says so. Nothing is recorded while the camera is closed.
working, muddy water and the rest) can go with the evidence to an authority, without your name. The words you type are shown to you alone and go to nobody. Your answer to What did you find? is shown to you alone and is used only to learn which labels were right.
which of a short list of root or jailbreak signs it found, if any, and the app and system version. A reviewer can see it; it changes nothing about you or your evidence, and it is not sent to any authority.
the position if your camera saved one) and we keep only those. We do not keep your device's serial number or the other identifiers cameras sometimes write.
not read the photos already on your phone. On Android 9 and older the camera library the app is built with declares an old storage permission; the app does not use it, and from Android 10 it is not requested at all.
If your phone cannot send a submission, it is kept on your phone, encrypted, and sent when a connection returns. It is not sent anywhere in the meantime.
would rather lose the submission than leave a photograph of a mining site sitting on a phone that may be shared.
Plainly: a photograph of a real detection can earn points; the app says when and why, and they are not money.
We keep a ledger of the points each account earned, when they were confirmed or voided, and why. Points become redeemable only when a partner funds verification and we announce the rate; until then no cash figure exists anywhere. The ledger is kept with the account's identifier even after the account is deleted, so that an account that has gone can never be paid.
We do not train models on your photographs. Our detection models read satellite imagery, and nothing in the training pipeline reads submitted evidence. If that ever changes we will ask you first, separately, and you will be able to say no and keep using the app — consent bundled into a privacy policy is not consent.
We do not track you around the internet. There is no advertising, no analytics company, and no third-party tracker in the app or on our site. The app never uses your location in the background — only while you have it open and are doing something that needs it.
They see: the pseudonym, the date, whether you confirmed or disputed, and a score the system calculated. People reading a site's case file (reviewers, and staff of organisations we work with) also see when you took the photograph, how strong its signature was, and whether your phone looked modified. They cannot see your photograph. They cannot see your notes or your answers. They cannot see your name, your email, or where you stood, not even roughly.
Plainly: if a site accumulates enough evidence, a package can be sent to a regulator — for example Ghana's Minerals Commission, Nigeria's NESREA, or Brazil's IBAMA.
That package contains the site's hexagonal cell (about a tenth of a square kilometre), the date and time, your yes or no, the boxes you ticked in a note, and the fingerprints of your photograph or clip. It does not contain your name, your email address, your pseudonym, your account, your exact coordinates or the words you typed. The photograph or clip itself is released to a named recipient only through the same two approvals, and every release is logged.
This only happens when the evidence passes a fixed threshold and two separate approvals are given, one of them by a person. The threshold cannot be lowered by anyone using the app.
One honest limit on that, stated rather than glossed. The two approvals are today produced by the same system using the same signing key, and are told apart by which name each one claims. That is a procedure, not a cryptographic guarantee: somebody holding that key could produce both. We are replacing it so the human approval is signed by a device only that person holds, and it will be in place before any report is ever sent. We would rather write this down than let you read "two approvals" as something stronger than it currently is.
We have never done this. The system is currently set to assemble a report and stop.
Our engineers can reach the database. Access to a stored photograph goes through a check and every single access is logged, including ours.
Plainly: where the satellite thinks something is happening is public. What you did about it is not.
Anyone can read the detection map without an account, including the coordinates of every detection, because a map of environmental risk that requires an account is a map that does not do its job. Those points come from satellite imagery, not from people.
Nothing you submit is in that public data. Not your photograph, not your notes, not your pseudonym, not where you stood, not whether you confirmed or disputed anything. The public map shows what a satellite saw. It does not show who went to look.
One thing worth knowing, because we would rather say it than have it noticed: publishing every detection also reveals, by omission, which areas we have not looked at. We accept that trade because the alternative is a map that only helps people who already have an account.
We do not sell anything to anyone. We do not share your information with advertisers, data brokers, or partners.
Plainly: your reports stay, even after you leave. Your identity does not.
are evidence. Other people's reports about the same site rely on them, and if a report has gone to an authority it must still be possible to prove where it came from, years later.
edited, including by us. That is what makes it possible to check later that a report was justified.
You can delete your account inside the app: Profile → Settings → Account → Delete your account. You can also ask us to do it without opening the app, from the address on the account. We ask for your password, because this cannot be undone.
What is removed: your name, email address, organisation, password and sign-in. Everything that says who you are, and two things that were yours alone: the contributors you chose to hide, and your answers to What did you find?
What is not removed: the ground reports you sent, with their photographs, clips, positions and the notes attached to them. They stop pointing to you, but other people's work and any report already sent depend on them. Three records are kept for a named reason: the public half of your phone's signing key, so that the same phone still counts as one source (fraud prevention); the points ledger, so that a deleted account can never be paid (fraud prevention); and any report you made about another submission, so that a report of abuse is not lost when the reporter leaves (security). None of them carries your name.
We will show you your pseudonym at the moment you delete. Afterwards it is the only handle you have on your own work, and nobody can look it up for you.
We are telling you this plainly because it matters: if you need everything you have ever sent to be gone, deleting your account will not achieve that. Write to us and we will tell you honestly what can and cannot be done.
A photograph of a mining site may show people who did not agree to be photographed.
We think you should know how we handle that, because it is the part of this platform that most affects someone who never chose to use it.
the machinery, the damage. Our field guidance says the same thing, and it is there for your safety as much as theirs.
photograph is: not published, not shown to other people using the app, reachable only through a logged access check.
inside the app and a person will look at it.
write to us. You have that right whether or not you use Oqio Terra.
Wherever you are, you can ask us to: show you what we hold about you, correct it, delete your account, or explain something in this policy. Write to the contact address in section 1 and we will answer.
If you are in the European Union, you also have the rights the GDPR gives you, including the right to complain to your national data protection authority.
The legal basis we rely on, in plain terms:
| What | Why we are allowed to |
|---|---|
| Your account | We need it to provide the service you asked for (contract) |
| Your reports and photographs | Our legitimate interest in documenting environmental harm, and the public interest in it being documented |
| Sending a report to a regulator | The public interest in environmental protection |
| Security and audit records | Our legal obligation and legitimate interest in being able to prove a report was justified |
Where we rely on legitimate interest, you can object. Tell us and we will consider it properly.
Oqio Terra is not for people under 18 and we do not knowingly collect their information. Registration asks you to confirm that you are 18 or over. We ask because a validator may go near suspected illegal mining, because evidence may reach a regulator or a police force, and because reports are kept after an account is deleted and points may one day become money: none of that should be asked of a child.
This policy covers what happens to your information. It does not cover who owns the photograph you take, what you may use the app for, or what we owe you if the service stops.
Those terms do not exist yet, and we are not going to pretend otherwise. There is no terms-of-service document. Until counsel has approved one, the position is the ordinary one: you keep the copyright in your own photographs. We hold them to do the things described above and nothing else — we do not publish them, license them, or sell them.
When terms are published, this policy will link to them and we will tell you in the app before they take effect.
You may have expected a longer document in denser language. Here is why you did not get one, stated openly because the choice was deliberate.
A plain document and a legally complete one are the same document, and the law says so. GDPR Article 12 requires information to be given "in a concise, transparent, intelligible and easily accessible form, using clear and plain language." Plainness is not a courtesy that a policy extends after it has satisfied the lawyers — it is one of the requirements. A document that is precise and unreadable has failed a legal test, not passed one.
So this is one document with two layers rather than two documents. Every section opens with the answer a person actually wants and then gives the detail that makes it exact. Nothing is in a separate "full version", because a separate full version is where the uncomfortable parts go to be unread.
What plain language costs, and why we accepted it. Writing this way makes the hard facts more visible, not less: that photographs are kept indefinitely, that deleting your account does not delete your reports, that a package can go to a police force. A denser document could have made those true and hard to find. This one cannot. We think a person deciding whether to walk to a mining site and photograph it is entitled to know that before they go, not after.