Privacy Policy
1.Introduction
This Privacy Policy describes how OnEarth ("OnEarth", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use our mobile application (the "App") and related services including the website at getOnEarth.com and the B2B licensing marketplace (collectively, the "Service").
OnEarth is operated by OnEarth Ltd. (the "Company"), and we are the data controller for personal information processed through the Service unless explicitly stated otherwise.
By creating an account or using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
2.Information we collect
2.1. Information you provide to us
| Category | Examples |
|---|---|
| Account data | Phone number, email, name, username, profile photo, biography, country, preferred language. Authentication is handled by Firebase Authentication (Google, Apple, or phone OTP). |
| User-generated content | Videos you record or upload, captions, categories you assign, comments, replies, reactions, likes, follow relationships. |
| KYC / payout information | If you opt to receive payouts: name, address, government ID, tax form (e.g., W-9 / W-8BEN), bank or IBAN details. This information is collected and stored by Stripe — we receive only the status of your account. |
| Support communications | Messages you send to support@getOnEarth.com or via in-app reporting. |
2.2. Information collected automatically
| Category | Details |
|---|---|
| Location | Precise GPS coordinates and timestamp are attached to each video you record so it can be placed on the 3D globe. We do not track your continuous background location. Location is collected only while the app is in the foreground and only when you record or live-stream. |
| Camera & microphone | When you grant permission, we access the camera and microphone to record video and audio that you choose to upload. We do not access them passively. |
| Device & technical info | Device model, OS version, app version, language, time zone, IP address, mobile carrier, network type, app installation ID, and device-signed cryptographic timestamps used to verify the source of recordings. |
| Usage data | Screens viewed, videos watched and for how long, content liked or shared, search queries, taps and swipes, ad impressions and clicks, session duration, crash logs. |
| Cookies & similar technologies | On the web (getOnEarth.com, B2B portal) we use first-party cookies for authentication, session management, and aggregate analytics. |
2.3. Information from third parties
If you sign in with Apple or Google, we receive a unique identifier and your email address. If you choose to share OnEarth content to other apps, those apps may share back basic interaction data (e.g., that you posted a link).
3.How we use your information
We use the data we collect to:
- Operate the Service — let you record, upload, watch, comment on, and discover videos; show videos at the correct location on the 3D globe and regional maps.
- Verify content authenticity — combine GPS, device-signed timestamps, network signals and AI moderation to detect manipulated or AI-generated video before it reaches the feed.
- Personalize discovery — recommend videos based on your location, language, and what you've watched. You can disable personalization in Settings.
- Power the B2B licensing marketplace — make eligible verified videos discoverable to newsroom buyers, process license sales, and pay creators their revenue share.
- Process payouts — transfer earnings to creators via Stripe Connect.
- Serve advertising — show in-feed ads (delivered by Google AdMob). You can opt out of personalized ads in your device settings.
- Send notifications — push notifications about nearby events, new followers, comments, licensing offers, and account activity. You can disable categories in Settings.
- Trust & safety — detect and act on policy violations, fraud, abuse, illegal content, and security threats.
- Comply with legal obligations — respond to lawful requests, enforce our Terms, and meet tax / record-keeping requirements.
- Improve the Service — aggregate, anonymized analytics to understand which features work and how to make the app faster and more useful.
Legal basis (EEA / UK / Turkey): we process your data on the basis of (a) performance of our contract with you (running the Service), (b) your consent (where collected, e.g., for precise location and push notifications), (c) our legitimate interests (safety, fraud prevention, product improvement), and (d) legal obligations (e.g., tax, anti-money-laundering for payouts).
4.How we share your information
We do not sell your personal information. We share data only in the following situations:
- Publicly — your username, profile photo, bio, follower counts, the videos you publish, your captions, the categories you assign, and the precise GPS location and timestamp of each video are public by design. This is the core function of the Service: a live map of real-life events.
- With newsroom buyers — if you opt your video into the B2B licensing marketplace, eligible newsrooms can see and license it. The license they buy and the price are visible in your in-app Earnings dashboard.
- With our service providers — listed in section 5 below. These vendors process data on our behalf under contractual obligations and may not use it for their own purposes.
- With law enforcement and authorities — when we receive a valid legal request (subpoena, court order) and only to the extent required. We publish an annual transparency report.
- In connection with a business transfer — if OnEarth is acquired, merged, or sold, your data may be transferred. We will notify you in advance.
5.Third-party services we use
We work with carefully selected service providers. Each has access only to the data necessary to perform its function:
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare (USA) | Video transcoding, live-streaming, CDN delivery, security/WAF | Uploaded videos, IP, request metadata |
| Google Firebase (USA) | Authentication (phone OTP, Google, Apple), push notifications (FCM), Remote Config | Phone, email, device tokens |
| Mapbox (USA) | 3D globe and map tiles | Anonymized telemetry of map use, IP |
| Stripe (USA / Ireland) | Creator payouts (Stripe Connect), premium subscription billing | Identity, banking, tax forms (collected directly by Stripe) |
| Google AdMob (USA) | In-feed advertising | Advertising ID, device, ad interactions |
| PostHog (USA / EU) | Product analytics (aggregate) | Pseudonymous user ID, events |
| Sentry (USA / EU) | Crash & error monitoring | Crash logs, app version, OS version |
| Hive Moderation (USA) | AI content moderation (NSFW, deepfake detection) | Frames of uploaded videos |
| MaxMind (USA) | IP geolocation (cross-checks against GPS) | IP address |
| Hosting (Hetzner — Germany) | Backend servers, primary database | All user data, encrypted at rest |
6.Your rights and choices
You have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Correction — update or correct your profile information at any time in the app (Profile → Edit).
- Deletion — delete your account and all associated content. See getOnEarth.com/data-deletion or in the app:
Settings → Account → Delete account. - Portability — request a machine-readable export of your videos, comments, and account data.
- Object / restrict processing — object to processing based on our legitimate interests (e.g., personalized recommendations).
- Withdraw consent — disable location, camera, microphone, and notifications in your device settings at any time.
- Opt out of personalized ads — use your device's "Limit Ad Tracking" (iOS) or "Opt out of Ads Personalization" (Android) setting.
- Lodge a complaint — with your local data protection authority. EU residents can find their authority at edpb.europa.eu. Turkey residents can contact KVKK at kvkk.gov.tr.
To exercise any of these rights, email us at privacy@getOnEarth.com. We will respond within 30 days.
7.Data retention
| Data | Retention period |
|---|---|
| Account profile | Until you delete your account. |
| Videos you publish | Until you delete them or your account. Videos already licensed to a buyer remain available to that buyer under their license — but are removed from public view. |
| Precise location of past videos | Same as the video itself. |
| Server logs (IP, requests) | 90 days, then aggregated and de-identified. |
| Payout / tax records | 7 years (legal/tax obligation), separately from your active profile. |
| Moderation decisions | 2 years, for audit and appeal purposes. |
8.Security
We take reasonable technical and organizational measures to protect your data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Access control on a need-to-know basis with audit logging.
- Secrets stored in HashiCorp Vault, not in source code.
- Regular dependency scanning (Snyk, Dependabot) and code review.
- Annual third-party penetration testing.
- SOC 2 readiness program from Month 12.
No method of transmission or storage is 100% secure. If a data breach affecting you occurs, we will notify you and the relevant authorities within 72 hours where required by law.
9.International data transfers
OnEarth is a global service. Your data may be transferred to and processed in countries other than your country of residence — primarily Germany (our primary hosting region), the United States (where many of our service providers are based), and other regions where we operate.
For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by technical safeguards (encryption, pseudonymization).
10.Children's privacy
OnEarth is not directed to children under 16. We do not knowingly collect personal information from anyone under this age. If you believe a child under 16 has provided us with information, please contact us at privacy@getOnEarth.com and we will delete it.
In jurisdictions where the digital age of consent is higher (e.g., certain US states, certain EU member states), we apply that higher threshold.
11.Regional notices
11.1. European Economic Area / United Kingdom (GDPR / UK GDPR)
If you are in the EEA or the UK, you have the rights described in Section 6, plus the right to lodge a complaint with your supervisory authority. Our EU representative is appointed under Article 27 GDPR; contact details available on request.
11.2. Turkey (KVKK)
If you are in Turkey, your personal data is processed under Kişisel Verilerin Korunması Kanunu (Law No. 6698). You have the rights set out in Article 11 of the law. Our Data Controller Representative is registered at verbis.kvkk.gov.tr.
11.3. California (CCPA / CPRA)
California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information. To exercise your CCPA rights, email privacy@getOnEarth.com or use the in-app account deletion flow.
11.4. Brazil (LGPD)
If you are in Brazil, your personal data is processed under Lei Geral de Proteção de Dados (Law No. 13.709/2018). Our Data Protection Officer (DPO) can be reached at dpo@getOnEarth.com.
12.Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via in-app banner and/or email at least 30 days before the changes take effect. The "Last updated" date at the top of this page always reflects the current version.
Previous versions are archived and available on request.
13.Contact us
OnEarth Ltd.
Privacy questions: privacy@getOnEarth.com
Data Protection Officer (DPO): dpo@getOnEarth.com
General support: support@getOnEarth.com
Web: getOnEarth.com
Delete my data: getOnEarth.com/data-deletion