Privacy Policy

About this policy

Biosphere respects your privacy and aims to be transparent about how information is handled when you use the platform.

This policy explains what information Biosphere collects when you browse, create an explorer account, play BioQuest, shop in the Store, or send us a message, feedback or an issue report — and the choices available to you.

It covers the Biosphere website and its features. It doesn’t cover external websites that Biosphere links to, which have their own privacy practices.

Information we collect

Information you provide

Account details: Display name, username, email address, country or region, and a password (stored only in protected, hashed form). Optionally, a profile image and an explorer frame.
BioQuest activity: Your quest answers, discovered and documented species, XP, level, achievements and activity streak, and a log of the XP you earn and why.
BPE wallet: If you choose to link a blockchain wallet: its public address, the network and when you verified it, plus the one-time sign-in message you signed. Biosphere never asks for or stores your recovery phrase or private keys.
Preferences: Profile and discovery visibility, and your email preferences.
Orders: For Store purchases: your name, email address and phone number, the delivery address (when the order is shipped), the products, the delivery option and the payment method you choose. For bank transfers you may add a payment reference.
Messages and reports: What you write in the Contact form, Feedback and Report an Issue, and any optional details you add, such as your name, email address, a rating or a screenshot.
Newsletter: Your email address if you subscribe to the Biosphere Journal newsletter.

Information collected automatically

Sign-in sessions: When you log in, Biosphere records your IP address, your browser’s user-agent (browser and device type), and when the session was created and last active. You can see your active sessions in Settings.
Form protection: When you send a contact message, feedback or an issue report, Biosphere stores your browser’s user-agent and a keyed hash of your IP address (not the address itself) to prevent spam and duplicate submissions.
Issue report context: Issue reports include your device type, screen size and browser language, and the Biosphere page you were reporting from (you can remove the page before sending). The form shows this before you send it.
Server logs: The server logs each request’s method, path (without query parameters), status and response time for operating and debugging the service.

How we use your information

Create and maintain your explorer account, sign you in and keep your account secure.
Provide profile and BioQuest features, such as saving discoveries, XP and achievements, and showing the explorer leaderboard.
Process Store orders: confirm payments, prepare and deliver purchases, and show you your order.
Send service emails, such as account verification, password reset and newsletter confirmation messages.
Read and respond to contact messages, review feedback and investigate reported issues.
Protect Biosphere: prevent spam and abuse, limit repeated attempts and diagnose technical problems.

Biosphere doesn’t use your information for advertising, and doesn’t use automated decision-making that has legal or similarly significant effects on you.

Accounts & explorer profiles

You can browse Biosphere and buy from the Store without an account. An account is needed to save BioQuest progress and to see your orders in one place.

Verification. After you register, Biosphere emails you a verification link.
Leaderboard. Logged-in explorers can see the BioQuest leaderboard, which shows the display name (or username) and XP of explorers whose profile is public.
Visibility. Profiles are public by default, which today means appearing on the leaderboard. Biosphere doesn’t have public profile pages. You can make your profile private in Settings → Privacy.
Profile image. If you upload a profile image, it is stored on Biosphere’s server.
Social sign-in. Where signing in with Google, Facebook or LinkedIn is available and you choose it, Biosphere receives your name, email address, account identifier and profile picture from that provider.
Linked wallet (BPE). Linking a wallet is optional. Blockchain addresses and transactions are public and permanent: anyone can see them on the blockchain, and Biosphere cannot change or delete them. Deleting your Biosphere account removes the link between your account and your wallet, not the tokens or the transactions on the blockchain. You can unlink your wallet in Settings → Wallet.

Keep your password confidential, and use Forgot password if you think someone else knows it.

Impact actions

If you submit an action on Impact Actions (a cleanup, a species observation or a restoration), we store the photos you upload, the date, the place you describe, an optional approximate location and the details you enter, together with the review decision and its history.

Photos are private. Only you and Biosphere reviewers can see them. When we store a photo we resize it and remove its metadata, including any GPS position.
What we read from the original photo. Before removing the metadata, we read the capture date, the camera model and the GPS position (rounded to about 1 km), and we calculate fingerprints of the image. We use them only to help reviewers detect reused photos or inconsistent dates and places.
Approximate locations. Locations are rounded to about 1 km, or about 10 km for threatened species, and are never shown publicly.
Deleting. You can withdraw an action while it is pending. Deleting your account deletes your actions and their photos; any BPE reward already recorded stays in the reward ledger, and anything recorded on the blockchain can’t be deleted.

Store, cart & orders

Cart: If you’re not logged in, your cart (products and quantities) is saved in your browser’s local storage. If you’re logged in, it is also saved to your account, and a cart from before you logged in is merged into it.
Checkout: Biosphere collects your name, email address and phone number to process and contact you about the order, and the delivery address when the order is shipped.
Orders: Orders are stored with their products, totals, delivery details, payment method and status. Logged-in customers can see them in My orders. Guest orders can be reopened from the same browser tab using a private access key.
Delivery: Biosphere uses your delivery address to deliver your order.

Payments

Bank transfer, wallets and QR: Biosphere shows you its account details and the amount to pay. You make the payment from your own bank or wallet app; Biosphere doesn’t receive your bank or wallet login details. When you confirm a transfer, you can add a payment reference, which is stored with the order. Payments are then confirmed manually.
Cards (when available): Card payments are processed by Mercado Pago. Your card details are sent from your browser directly to Mercado Pago, which returns a one-time token; Biosphere never receives or stores your full card number or security code. To process the payment, Biosphere sends Mercado Pago the token, the amount, your email address and, when requested, your identification document. Biosphere stores only the card brand, type, last four digits, installments and payment status.

Mercado Pago handles the information it receives according to its own privacy policy.

Contact, feedback & issue reports

Contact: Your name, email address, the type of message, subject and message, and optional organization and country.
Feedback: The category, an optional rating and your message. Name and email are optional, so feedback can be anonymous.
Issue reports: The category, the part of Biosphere, your description and optional details such as what you expected, whether it happens again, and a screenshot. Name and email are optional.

Submissions are stored by Biosphere and are not shown publicly or to other users.
They are also sent by email to the Biosphere team so they can be read and acted on.
Screenshots are stored privately on Biosphere’s server and are not published.
Biosphere uses your email address to reply only if you sent a contact message or ticked “Contact me about this feedback/issue”. Not every submission receives a reply.

Cookies & similar technologies

Biosphere uses only its own (first-party) cookies and browser storage, for features you use: staying signed in, social sign-in, placing orders, remembering your cart and loading faster. It doesn’t use advertising or analytics cookies.

Cookies and browser storage used by Biosphere
Name	Type	Category	Purpose	Duration
bs_session	Cookie · first-party	Essential	Keeps you signed in to your explorer account. Page scripts can’t read it. (when you log in)	Until you close the browser, or 30 days if you choose “Remember me”
bs_oauth	Cookie · first-party	Essential	Protects social sign-in against forged requests. (only when you use social sign-in)	10 minutes
bs_checkout_key	Session storage · first-party	Essential	Prevents the same order from being placed twice. (when you place an order)	Until you close the tab
bs_order_…	Session storage · first-party	Essential	Lets you reopen a guest order you just placed. (when you place an order as a guest)	Until you close the tab
bs_cart_v1	Local storage · first-party	Functional	Remembers the products and quantities in your Store cart. (when you add a product to your cart)	Until you empty your cart or clear your browser data
workbox-precache-…	Cache storage (service worker) · first-party	Functional	Stores Biosphere’s own app files (code, styles and icons) so pages load faster. It contains no personal information. (when you visit biosphere)	Until Biosphere is updated or you clear your browser data

The Cookie Policy explains each of these in detail and what happens if you block or delete them.

Analytics

Biosphere doesn’t currently use a third-party analytics service, and doesn’t send your browsing activity to any analytics provider.

Third-party services

Resend: Email delivery (account, contact and notification emails), as described above.
Anthropic (Claude): Photo identification in the BioQuest Field Scanner, only when the service is enabled and you choose to identify a photo. Before sending, Biosphere resizes the photo and removes its metadata (including GPS); Biosphere does not save the photo; recent results are kept only temporarily in server memory so the same photo isn’t analysed twice.
Mercado Pago: Card payment processing, when card payments are available.
Google, Facebook, LinkedIn: Social sign-in, when available and only if you choose it.

Each provider handles information under its own privacy policy.

How long we keep information

Sign-in sessions expire after 1 day, or 30 days with “Remember me”. Signing out ends the session.
Email verification links expire after 24 hours, and password reset links after 1 hour.
When you delete your account, your email address, username, display name and password are removed. Your discoveries, achievements, profile, profile image, linked sign-in accounts and saved cart are deleted, and your sessions are ended.
Orders are kept as records of the purchase, including after an account is deleted.
Other information, such as messages, feedback, issue reports and newsletter subscriptions, is kept until it is no longer needed or you ask us to remove it.

How we protect information

Biosphere takes reasonable measures designed to protect your information, including:

Passwords are stored only in hashed form, never as plain text.
Sign-in cookies can’t be read by page scripts and are restricted to same-site requests; session tokens are stored in hashed form.
Information sent to Biosphere is validated on the server, and repeated attempts are rate-limited.
Card details go directly to the payment processor and never reach Biosphere’s servers.
Issue report screenshots are stored outside the public website.

No method of transmission or storage is completely secure, so Biosphere can’t guarantee absolute security. Please keep your password confidential.

Your privacy choices

You can manage much of your information directly in Biosphere:

Update your details: Change your display name, username, country, profile image and password in Settings.
Control visibility: Make your profile private in Settings → Privacy to stop appearing on the leaderboard.
Email preferences: Turn email notifications and weekly expedition emails on or off in Settings → Preferences.
Sessions: See where you’re signed in and sign out other sessions in Settings → Security.
Delete your account: Delete your explorer account in Settings → Danger Zone. This can’t be undone.
Browser data: Clear your cart or your browser’s site data at any time.

For anything else, such as a copy of your information or the removal of a message or newsletter subscription, contact Biosphere.

External links

Biosphere links to external websites, such as scientific sources in Biodiversity Resources and Biosphere’s social media profiles. Those websites have their own privacy practices, and Biosphere isn’t responsible for them.

Changes to this policy

Biosphere may update this policy when its features, practices or legal requirements change. The current version is always available on this page.

Contact us about privacy

If you have a question about this policy or about your information, contact Biosphere through the Contact page.