Privacy

Every Organism is a non-commercial, open project: a map of every known species. You can use all of it without an account. This page says plainly what we keep if you do sign in, and what happens when you just browse.

If you just browse

• We do not use analytics, advertising or tracking scripts, and we set no cookies for guests (starting a sign-in sets a short-lived security cookie that expires within minutes).
• Your colour theme, collections, bookmarks, recently viewed taxa and view settings are kept in your browser’s local storage. They never reach our servers, and clearing your browser’s site data removes them.
• Like every website, our host (Vercel) receives your IP address and browser details with each request and keeps short-lived request logs to run and protect the service.
• Photos are loaded directly from Wikimedia Commons and iNaturalist’s photo hosting, so those services also see your IP address when your browser fetches a photo. Article text is fetched from Wikipedia and Wikidata by our server, not by your browser.

If you sign in

Signing in is done with your Google or GitHub account; we never see or store a password. When you sign in we store:

• your name, email address and the URL of your profile picture, as Google or GitHub provide them;
• the account ID Google or GitHub gives us for you, so the same account signs you in next time;
• a session record for each device you sign in on, with its expiry time, the IP address and the browser’s user agent it was created from (these help spot sessions you do not recognise);
• a role (“user”, or “admin” for the site’s operator).

If the same verified email address is on your Google and GitHub accounts, both sign you in to the same Every Organism account. You can edit your display name on your account page.

We use this information only to sign you in and show your profile. We do not sell it, share it for advertising, or send you marketing email.

Cookies

• Session cookie (signed in only): keeps you signed in for 30 days, renewed while you use the site. It is HTTP-only, so page scripts cannot read it.
• eo_signed_in (signed in only): a hint with no personal data, readable by the page, so it can show your account menu without waiting for the server.

Signing out removes both.

Deleting your account

On your account page, “Delete account” removes your user record, all your sessions and your linked Google and GitHub sign-ins immediately. Nothing is kept afterwards, apart from what may remain in our providers’ routine backups until they expire. You can also disconnect Every Organism from your Google or GitHub account settings at any time.

Who processes data for us

• Vercel: hosting and request logs.
• Neon: the database holding accounts and sessions.
• Google and GitHub: sign-in, under their own privacy policies.

Data credits and licences

The tree and its facts come from open sources: the Catalogue of Life, the Open Tree of Life, iNaturalist (each photo under its own Creative Commons licence, credited on the taxon), Wikimedia Commons, Wikipedia and Wikidata. See the terms for how they may be reused.

Changes and contact

If this policy changes, the new version will be posted here with a new effective date. Questions or requests: michael.mm.may@gmail.com.