Privacy Policy

Last Updated: May 2, 2026 (13:19 Pacific Time)
Effective Date: May 3, 2026 (00:00 Pacific Time)

The previous version of our Privacy Policy remains in effect until the Effective Date.

Reef Advocates (“we,” “us,” or “our”) is a nonprofit organization based in the United States of America (“U.S.”) working to support ecological conservation, scientific research, and education. To advance this mission, we may engage in a range of activities (“Mission Activities”), including developing, using, and sharing data, tools, and services; conducting programs and initiatives; engaging with communities and stakeholders; forming partnerships and collaborations; and conducting revenue-generating activities that support or sustain our mission.

This Privacy Policy explains what information we collect, how we use and share it, how long we retain it, and the rights and choices available to you. In this Privacy Policy, “you” and “your” refer to anyone who accesses or uses the Platform or our communications or otherwise provides information to us.

This Privacy Policy applies to the Reef Advocates platform (the “Platform”), including our website (reefadvocates.org), our mobile applications, and other communications or services through which we may collect information. The Platform is intended for users in the U.S. We operate the Platform from the U.S. and direct its services to U.S. users. We do not currently direct the Platform to users in jurisdictions where offering the Platform would require compliance with additional legal requirements outside the U.S.

Your use of the Platform is also subject to our Terms of Use (https://reefadvocates.org/terms-of-use). By accessing or using the Platform or submitting information to us, you agree to the practices described in this Privacy Policy.

Reef Advocates is the data controller responsible for determining how and why personal data collected through the Platform is processed.

Categories of Information We Collect

We collect and process several types of information. These categories may overlap, meaning the same information may fall into more than one category.

Personal Data

Personal Data is information that identifies you or is linked with your account. This may include your name, email address, username, profile information, device identifiers and system information, Internet Protocol (IP) address, and records of your interactions with the Platform. It may also include communications you send to us.

Submitted Data

Submitted Data are observations, recordings, and related information captured, collected, or generated through the Platform and transmitted or submitted to us for possible inclusion in datasets or other information resources supporting our Mission Activities and other uses permitted under our Terms of Use. This may include photographs, videos, audio recordings, geographic location information, device or sensor data, user notes, and related metadata such as timestamps or camera settings.

Submitted Data may also include datasets or information derived from such data, including aggregations (including with data from other Platform users), maps, models, analyses, and visualizations.

User-Retained Media

User-Retained Media refers to photographs, videos, or other media captured using the Platform that you retain, within the Platform or otherwise, for your own use. Some User-Retained Media may also be transmitted or submitted to us and included in Submitted Data.

Sensitive Data

Sensitive Data is Personal Data that is particularly private or sensitive. This may include financial account information used for donations or payments, encrypted authentication credentials such as passwords, or precise geographic location data. Precise location data may also be submitted to us as Submitted Data.

Use of Shared Devices

In some cases, the Platform may be used on devices owned or managed by us or by third parties, such as dive operators or research organizations. These devices may be configured for use by multiple individuals. When you use the Platform on a shared or organization-managed device:

certain permissions (such as camera, location, or sensor access) may already be enabled on the device before you begin using the Platform, and your ability to view, control, or disable these permissions may be limited by the device owner or administrator;
information generated while you use the Platform, including User-Retained Media, notes, or data entries, may remain accessible on the device or synced devices and may be visible to these devices’ owners, administrators, or later users;
you may use the Platform as a guest and may not be able to access features that require a registered user account; and
the ways we collect, use, share, and retain information described in this Privacy Policy still apply, although the Platform features available to you may differ from those available when you use the Platform on a personal device.

If you are using a shared device and wish to reduce the likelihood that others can access information stored on the device, you should remove that information, where possible, before returning the device or avoid storing personal notes or media on the device. However, removing information from the device may not fully prevent later access because copies of information may exist on synced devices, in backups, or through automatic uploads or other system processes.

Information generated by any individual using a shared or organization-managed device may become associated with accounts (on our Platform or third-party services) used on that device.

How We Collect Information

We collect information when you interact with the Platform or communicate with us. The information collected through these methods may include Personal Data and other categories described above.

Information You Provide

You may provide information directly when you interact with the Platform or communicate with us, including when you:

create or update an account, where account features are available;
capture or submit observations or media;
add notes or descriptions to observations;
make donations or transactions;
respond to surveys or feedback requests; and
communicate with us through the Platform, email, or other channels.

How We Collect Submitted Data

When you use the Platform in data capture modes, such as Dive Mode, certain information may be processed or recorded automatically. This may include captured media, environmental readings, device, app, or camera settings, location information, and device motion, orientation, and sensor data. The Platform may automatically detect elements within captured media, such as text, codes, or human body parts, and may record where and what elements appeared.

Because accurate location readings may not be available underwater, the Platform may process and record location data before and after a data capture session to estimate dive location.

Information collected during or in connection with data capture sessions may be transmitted to us automatically as part of the Platform’s normal operation. For example, previously collected data may be uploaded when network connectivity becomes available, including after a capture session has ended or while the application is running in the background.

Once transmitted to us, this information becomes Submitted Data, which may be incorporated into datasets used for our Mission Activities. In addition to automatically captured information, certain information you manually enter in the Platform may also become Submitted Data. Except for settings related to data capture modes, the Platform interface will generally indicate which manual inputs or fields may be included in scientific datasets.

Some Submitted Data may also remain visible to you within the Platform (including within your account, if you have one) as part of your personal records or dive logs.

Information Generated Through Platform Use

When you use the Platform, certain information may be generated during normal system operation. This may include activity logs, device or system information, and records of interactions with Platform features.

Information Collected Automatically

When you access the Platform through a device, app, or browser, certain information may be collected automatically. This may include your Internet Protocol (IP) address, device type, operating system information, browser characteristics, technical identifiers, and information about how the Platform is accessed or used. We may also automatically collect geographic location information from your device if location services are enabled.

Our Platform and communications may also use cookies, web beacons, tracking pixels, or similar technologies to support functionality, maintain sessions, understand how the Platform is used, improve performance, and measure the effectiveness of communications. Depending on device or browser settings, you may be able to control or disable some of these technologies. Disabling certain technologies may affect how the Platform functions.

Information Processed Locally

Some information used to support observation capture or media processing may be processed locally on the device you use to access the Platform. In some cases, this information may remain on the device unless you choose to submit it to us.

However, media and other information our Platform saves to the device may also be subject to syncing, backup, or sharing through device operating system features or third-party services configured on the device, which we do not control.

How We Use Information

Depending on how you interact with the Platform and the features you use, we may use the information we collect for the following purposes.

Operating the Platform

We use information to provide and maintain the Platform and its features. This includes creating and managing user accounts (where account functionality is available), enabling observation capture and submission, enabling recording of User-Retained Media, associating metadata with the data you capture or create, diagnosing technical issues, detecting spam or misuse, and maintaining system reliability. We may also use geographic location information (including approximate location inferred from your device’s IP address) to determine the availability of certain Platform features or to support compliance with applicable legal or operational requirements.

Supporting Mission Activities

Submitted Data may be used to create and maintain datasets that support our Mission Activities. This may include aggregating observations from multiple contributors, generating ecological datasets, analyzing environmental trends, and producing derived outputs such as maps or models. We may also develop new uses of Submitted Data consistent with our Mission Activities, including providing access to, sharing, or licensing datasets, derived outputs, and tools and generating revenue to support and sustain our mission.

Improving the Platform

We may use information to analyze how the Platform is used in order to improve functionality and processes, develop and test new tools or features, and evaluate the effectiveness of Platform services.

Communications

We may use Personal Data to communicate with you about your account, respond to questions, provide updates about the Platform, and notify you of opportunities related to our Mission Activities.

Transactions

If you make a donation or financial transaction, we may use information to process payments, maintain records, and comply with financial and legal requirements.

Legal Compliance and Platform Protection

We may process information when necessary to comply with legal obligations, enforce our Terms of Use or other agreements or policies, investigate Platform misuse, maintain security, or protect the rights, safety, or property of Platform users, our organization, or others.

User-Initiated Sharing

Some Platform features may allow you to voluntarily share information publicly or with third-party services. For example, you may choose to display achievements, attribute submissions to your identity, invite follow-up discussion about your submissions, or share information with our collaborators. These features are optional to use and may in some cases be disabled through account settings.

How We Share Information

We may share information we collect in the circumstances or for the purposes described below.

Sharing Submitted Data

Submitted Data may be incorporated into datasets that combine data from many Platform users. These datasets may be shared with researchers, academic institutions, conservation organizations, or other partners or licensees in connection with our Mission Activities.

Submitted Data may be shared either as Identified Submitted Data, which remains associated with a contributor or account, or as Anonymized Submitted Data, meaning we have taken reasonable steps to remove or obscure information that directly identifies the contributor. These steps may be automated. Certain information important for scientific value, such as environmental measurements, timestamps, or geographic coordinates, may remain in anonymized datasets.

Before sharing Identified Submitted Data, we will take reasonable steps to help ensure the information is used for our Mission Activities, which may include requesting that recipients apply reasonable technical or organizational safeguards.

We may also make Anonymized Submitted Data publicly available to support our Mission Activities.

Although we take reasonable steps to remove identifying information, anonymization techniques cannot guarantee that re-identification will never be possible. You should avoid including personal identifiers in observation notes or other open text fields unless specifically requested by the Platform.

User-Initiated Sharing

The Platform may allow you to share information publicly or with third-party services. If you choose to share information in this way, it may become visible to others and may be copied or retained by third parties outside our control. When you share information with third-party services, their privacy practices govern their use of the information.

Some Platform features allow you to submit information that becomes part of publicly visible Platform features. For example, you may suggest a new dive site location by submitting a name, location, or other descriptive information. Information submitted through such features may be reviewed, approved, or published for use by other Platform users.

If you later withdraw from the Platform’s optional attribution or sharing features, we may remove attribution or public display associated with your identity where feasible while preserving the underlying Submitted Data or submission to Platform functionality. However, prior sharing or distribution may not be fully reversible, and previously released datasets or externally shared information may continue to contain information you previously chose to disclose.

Service Providers

We may share information with service providers that perform services on our behalf, including hosting services or infrastructure management (such as Amazon Web Services), cloud infrastructure or storage services (such as provided by Apple), analytics (such as Google Analytics), payment processing (such as Stripe), donation management (such as Donorbox), and application distribution (such as the Apple App Store). These providers may process and retain information as necessary to perform services for us and are expected to protect it using reasonable safeguards. When we share information with service providers, we aim to disclose only the information reasonably necessary for them to perform their services.

Legal Requirements

We may disclose information if we believe disclosure is necessary to comply with applicable law, respond to legal requests, enforce our agreements, detect and investigate Platform misuse, or protect the rights, safety, and property of Platform users, our organization, and others. We aim to only disclose what is reasonably necessary for the applicable purpose.

Organizational Changes

If we undergo or consider a merger, restructuring, bankruptcy, financing transaction, asset transfer, or similar organizational change, information associated with the Platform may be shared with or transferred to relevant parties involved in evaluating or completing that process, subject to applicable privacy protections.

Data Security

We implement reasonable technical and organizational measures designed to protect Personal Data from unauthorized access, loss, misuse, alteration, or disclosure. However, no method of transmission or storage can be guaranteed to be completely secure.

Retention of Information

We retain information for as long as necessary to operate the Platform, support our Mission Activities, comply with legal obligations, and resolve disputes.

If you have an account, your Personal Data is generally retained while your account remains active. If you request deletion of your account or information associated with your account, we will take reasonable steps to delete or anonymize the applicable Personal Data except where retention is required for legal, security, or operational reasons. We may delete accounts that remain inactive for extended periods, with prior notice where feasible.

We may retain Submitted Data and information incorporated into public Platform features for extended periods, including indefinitely, because long-term records increase the scientific, conservation, and historical value of ecological datasets and related research products. If accounts are deleted or Personal Data is removed, we may retain Submitted Data or information incorporated into public Platform features while taking reasonable steps to disassociate that information from your account or identity where feasible.

We may also retain limited operational information such as technical logs, backups, or security records to maintain system performance and integrity, prevent and identify misuse, and improve our services. Retention periods may depend on operational needs and the nature of the data.

We may retain relevant information as long as necessary to comply with legal obligations, resolve disputes, enforce our agreements, or protect the rights, safety, or property of Platform users, our organization, or others.

If the Platform or any portion of its services is discontinued, we may archive, transfer, or delete information in a manner consistent with this Privacy Policy and applicable law.

Your Rights and Choices

You have choices regarding how your information is collected, used, and shared through the Platform. Certain rights may also be available under applicable U.S. law. These rights apply whether or not you use the Platform through a registered account.

Access and Updates

If you have an account, you may access or update certain Personal Data associated with your account, including through your account profile and settings. Some information or preferences may also be accessed or managed without an account where such options are available, or by contacting us.

Account Deletion

If you have an account, you may request deletion of your account at any time. When your account is deleted, we will handle associated information as described in the Retention of Information section of this Privacy Policy. If you do not have an account, you may still contact us to request deletion of Personal Data associated with your use of the Platform.

Withdrawal from Optional Sharing

If you have chosen to make information publicly visible, shared with third parties, or attributed to your identity, you may withdraw that permission where such controls are available. However, prior sharing or distribution of information may not be fully reversible.

Device Permissions

You may control or disable device permissions such as microphone, camera, photos, or location access through device settings, unless your ability to do so has been restricted by the owner or administrator of a shared or organization-managed device you are using. Limiting or disabling permissions may reduce the functionality of the Platform.

Communications

You may opt out of non-essential communications such as newsletters by following the unsubscribe instructions included in those messages or by contacting us. We may still send administrative or service-related communications necessary to operate the Platform or maintain your account.

Cookies

If you access the Platform through a web browser, you may control or disable cookies through browser settings. However, doing so may affect Platform functionality.

Children’s Privacy

Our website contains informational content accessible to the public. However, Platform services such as account creation and submission of information are intended only for individuals who are 18 years of age or older. We do not knowingly collect Personal Data from individuals under the age of 18 (minors).

If we learn that Personal Data from a minor has been collected without appropriate authorization, we will take reasonable steps to delete that information or otherwise address the situation in accordance with applicable law. If you believe a minor has provided Personal Data through the Platform, please contact us using the contact information in this Privacy Policy.

International Data Transfers

The Platform is operated in the U.S. Personal Data collected through the Platform is primarily stored and processed in the U.S., but it may also be transferred to or stored, processed, or accessed in other countries (which may not provide the same level of data protection) by our service providers, collaborators, or others with whom information is shared as described in this Privacy Policy.

When we share Personal Data with third parties, we take reasonable steps, where required by applicable law, to do so in a manner consistent with this Privacy Policy and applicable legal protections.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date and may provide additional notice through the Platform or other communications. Your continued use of the Platform after an updated policy becomes effective indicates your acknowledgement of the revised policy.

The most current version of this Privacy Policy will always be available on our website.

Contact Information

If you have questions about this Privacy Policy or our data processing practices, or if you wish to exercise rights available under applicable data protection laws, you may contact us at:

Reef Advocates
2660 NE Hwy 20
Suite 610, #403
Bend, OR 97701
United States
Email: privacy@reefadvocates.org

We will respond to requests within the timeframes required by applicable law and may take reasonable steps to verify your identity before responding.