Privacy Policy

For the purposes of applicable data protection laws, the data controller responsible for your information is

Eluminate Labs. If you have any questions, concerns, or requests regarding this Privacy Policy or your

personal data, please contact us at:

Eluminate Labs

Email: info@lanternfly-track-and-smash.org

FlySmash offers a partial guest experience, but registration is required to access core community features, log data, or view crowd-sourced contributions.

Authentication Mechanism

To eliminate security risks associated with password management, FlySmash utilizes an Email Magic

Link system (powered by Supabase OTP). When logging in, you provide your email address and receive a

secure, temporary authentication link. The App never requests, collects, or stores passwords.

Account Profile Data Stored

When you create an account, we store the following profile elements securely in our database:

• Email Address: Used uniquely for your secure login and account communication.

• User ID: A system-generated, randomized Unique Universal Identifier (UUID) to bind data records to your session.

• Public Alias: A user-chosen display name (between 3 and 24 characters). If you do not choose one, your account defaults to "Anonymous."

• Timestamps: Record of when the account was initially established and last updated.

Because FlySmash is a geographic tracking and mapping utility, location processing is vital to its core

mechanics. However, our mapping protocols strictly favor user autonomy over pervasive tracking.

No Background Tracking: FlySmash does NOT collect, monitor, or transmit your device’s location when the app is minimized, closed, or operating in the background. The application utilizes foreground permissions exclusively.

When Location Is Accessed

Your geographic coordinates are evaluated or captured only in the foreground during these specific

triggers:

1. Manual Pin Placement (Primary Path): When you tap on the interactive map to submit a report, the map registers the specific coordinates of the pin you selected. This tracks the bug's location, not your physical path.

2. "Use My Location" Function: If you explicitly select this button while signed in, the App makes a one-time request to your device's native GPS to pinpoint your current location on the screen for easier report plotting.

3. NYC Boundary / Service-Area Check: At the start of an active session, the App executes a quick, one-time boundary evaluation to ensure your device is physically located within the five boroughs of New York City. If outside the operational bounds, the app screen locks to protect database integrity.

What Location Data Is Retained

Upon submitting a verified lantern fly sighting report, the following information is committed to our cloud database:

• The precise Latitude and Longitude (decimal degrees) of the placed pin.

• The specific NYC Borough, which is computed automatically on our secure servers by comparing your coordinates against official NYC municipal boundaries.

We do not compile or store historical breadcrumbs or timelines of your movements.

Data contributed to the App is integrated into a unified dataset to power community mapping assets and gamified metrics. The visibility rules are structured as follows:

The Public Sighting Map

Verified, confirmed sightings are visible to all authenticated users as interactive map pins. Each public pin reveals exclusively:

• The pinpoint geographic coordinates (Latitude and Longitude) and server-verified Borough.

• The volume of lantern flies crushed in that instance (0–100 range).

• The observed biological life stage (Egg, Nymph, or Adult).

• The date and time of submission (`reported_at`).

To preserve participant anonymity, map pins do not display your personal email address, account UUID,or public alias in the user interface or API response payloads.

The Public Leaderboards

The app features a global ranking system accessible to authenticated users. The tables are configured to limit exposure:

• Individual Rankings: Displays your rank, your chosen public Alias (or "Anonymous"), and your all-time tally of confirmed smashes. It never exposes your email address, system UUID, or the specific locations where your logs occurred.

• Borough Metrics: Displays completely aggregated counts per geographical borough (total counts,total reports, and cross-borough rankings). No individual user identity is parsed on this screen.

We believe in maintaining a lean architecture that limits the footprint of external SDKs inside your device.

Zero Third-Party Product Analytics or Crash-Trackers: FlySmash does not integrate specialized behavioral tracking or analytical suites. No data is collected by or passed to third parties such asSentry, Firebase Analytics, Crashlytics, Amplitude, Segment, PostHog, or Facebook.

Service Providers:

Supabase: Authentication, cloud database storage, and core API hosting. Stores emails, UUIDs, aliases, chronological sighting metrics, and validation logs safely via encrypted servers.

Google Maps Platform: Interactive map tile rendering across iOS and Android environments. Processes standard network data requests for map tiling in accordance with standardGoogle platform privacy frameworks.

Google Fonts: Dynamic font asset delivery (EB Garamond & Special Elite typography). Processes system font-delivery handshakes. No tracking metadata is captured for core user profiles.

Expo / EAS : Application packaging and deployment framework. Bridges compilation metadata. Handles developer build mechanics rather than real-time end-user interactions.

No Commercial Monetization

We do not lease, trade, barter, or sell your personal information or mapping data to advertising agencies, data brokers, or monetization networks. Your information is purely leveraged to enrich the collective citizen-science dashboard.

ItYour personal details and data configurations are protected through Supabase’s robust architectural

layers, utilizing secure transport encryptions and server-side row-level security policy protocols to block

unauthorized network sniffing or exfiltration. We retain your account data for as long as your account

remains active within our platform to maintain leaderboard history and community statistics maps.em description

IYou have full ownership over your identity within FlySmash. You may sign out of your user account profile

at any time through the primary navigation elements of the application drawer.

FlySmash Privacy Policy • June 2026 Page 4If you wish to purge your profile, remove your public footprint, or delete your records from our systems

entirely, our automated interface systems may be undergoing structural changes. To ensure immediate

execution, please submit a deletion request directly via email:

Please email info@lanternfly-track-and-smash.org with the subject line "Account Deletion Request" using the email address tied to your account. We will purge your profile records within 30 days of verification.

FlySmash is intended for general audiences interested in public citizen-science initiatives. We do not

knowingly compile or harvest identifiable metrics from children under the age of 13. If we discover that a

child under 13 has inadvertently bypassed barriers and provisioned personal details via an email link, we

will swiftly remove those credentials from our master production servers.

We reserve the right to revise or adjust this Privacy Policy as our app ecosystem shifts or as legal standards require. Any updates to this policy will be announced on our master web portal at eluminatelabs.com, and the "Effective Date" at the top of this document will be updated accordingly.