Privacy Policy

1. Who we are

RiverKin is a citizen-science app for the IEEE OneAquaHealth Global Hackathon 2026, operated by Xphora AI Technology Pvt Ltd (the “data controller”). For any privacy request, contact privacy@riverkin.app. This policy follows the EU General Data Protection Regulation (GDPR); EU law governs user data.

2. The data we collect, by role

• Visitors (just browsing): no personal data, no account.
• Guests: a random anonymous identifier stored on your device, plus any observations you choose to make (answers, photos, the site you checked). Guest contributions are marked pending and do not count toward shared data until you sign in.
• Keepers / Crew Leads / Researchers (adult accounts, 16+): your email address and display name. If you sign in with Microsoft, we receive only your email and name from Microsoft — never your password.
• Crew members (students): no personal data at all. Students take part only through a teacher-issued pseudonymous handle (e.g. “Scout 3”) — no name, email or date of birth.

3. Lawful bases (Art. 6)

Consent for adult accounts; the school’s lawful basis for teacher-led crews (we process only pseudonymous handles); and legitimate interest for operating the public map of monitored sites. You may withdraw consent at any time.

4. Photos and location

Photos are stripped of embedded metadata (including GPS) before storage, and we blur recognisable faces where detected. Your device location is used once to confirm you are near the site, then snapped to the site’s identifier — we do not keep raw GPS or build any per-user location history. Photograph from the bank only; never include bystanders.

5. Children

No personal accounts for anyone under 16. Under-16s participate only as pseudonymous members inside a Crew Lead’s (teacher’s) crew, under the school’s responsibility and GDPR Art. 8. This single rule meets the digital-consent ages of all five project countries.

6. Who we share with

Verified, de-identified observations may be shared with OneAquaHealth and local water authorities for river-health research. We use Microsoft for optional sign-in and Microsoft Azure for hosting. We never sell your data or use it for advertising.

7. Retention

Raw photos are kept up to 24 months; account data until you delete your account; anonymous guest data until you clear it from your device. Aggregated, de-identified research data may be kept indefinitely.

8. Your rights

You have the right to access, correct, delete, export or restrict your data, to object to processing, and to withdraw consent — from the Me screen or by emailing us. You may also lodge a complaint with your national data-protection authority.

9. Security & transfers

Connections use HTTPS; passwords (where used) are bcrypt-hashed; access uses short-lived signed tokens. Data is hosted on Microsoft Azure; where data leaves the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Changes

We will update this policy as the product evolves and post the new date above. See also our Terms of Service.