Privacy policy

Who is responsible

Piccolo Paradiso, Collie, Western Australia

Custode is a project of Piccolo Paradiso, an olive and fruit grove near Collie, Western Australia. It runs this website (www.custode.au) and the Custode iOS app, which is currently in a closed beta through Apple TestFlight. Questions and requests about your information go to hello@custode.au.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), whether or not the Act strictly requires it of a project this size.

This website

Static pages, no tracking

www.custode.au is a static site served through Cloudflare. It sets no cookies of its own, runs no analytics, and carries no advertising or social-media scripts.

• Cloudflare handles the connection and keeps ordinary request logs (IP address, browser type, pages requested) for security and performance, under its own privacy policy.
• Google Fonts supplies the typefaces. Your browser fetches them from Google's servers, which see your IP address in the process.
• If you email hello@custode.au, we keep the correspondence for as long as it is useful to answer you.

The app

What the Custode app collects

• Sign-in details. Sign-in is handled by Innisfallen ID (idp.innisfallen.io), an identity service run by the same owner as Custode. You can sign in with Apple, with Google, or with a one-time code sent to your email. Custode never sees or stores a password. It receives an account identifier and your email address, or the relay address Apple provides if you choose to hide your email.
• Photographs. The tree photographs you take in the app. They stay on your device until you choose to sync, then upload to private storage.
• Location. With your permission, the coordinates of each capture. Custode uses them only to tell closely spaced trees apart. It never records your location in the background, and it never uses location for anything except the observation you are making at that moment.
• Tree records. The tree number, species, cultivar, row and position, health scores, feed and treatment events, and notes you enter.
• Service logs. The servers keep ordinary request logs, including IP address and request details, for 90 days.

The app contains no third-party analytics, advertising, or crash-reporting libraries. During the TestFlight beta, Apple may collect crash reports and usage statistics under the TestFlight terms you accepted when you installed it.

Why

How the information is used

Everything collected serves one purpose: building the per-tree health record that is the point of the app. In particular:

• AI assessment. Each photograph is resized and re-encoded, which strips its embedded metadata including any GPS tag, and is then sent to an AI vision model (Anthropic Claude, run through Amazon Bedrock in Amazon's Sydney region) to produce a structured health assessment. Amazon states that Bedrock does not store customer content or use it to train models.
• Change detection. Assessments, scores and your own observations are kept in the tree's record so the app can show whether a tree is getting better or worse over time.
• Account and security. Your account identifier links records to you, and logs are used to keep the service running and to investigate abuse.

Your information is not used for advertising, is not sold, and is not used to build profiles of you for any other purpose.

Where and with whom

Storage and sharing

• Amazon Web Services, Sydney region (ap-southeast-2), hosts the app's backend. Photographs sit in a private bucket with server-side encryption; records sit in a database in the same region. Connections use TLS.
• Cloudflare provides DNS, the content network for this website, and the app's API edge.
• Apple or Google receive a sign-in request only if you choose their sign-in option, under their own privacy policies.
• Innisfallen ID holds the sign-in record and its own audit log of sign-in events.

No other organisation receives your information unless the law requires it.

How long

Retention

Tree records and photographs are kept for as long as the grove they belong to is being tracked, because the whole value of the record is its history. Service logs are deleted after 90 days. When an account is closed, or on request, its records and photographs are deleted from live storage and drop out of backups on their normal cycle.

Your choices

Access, correction, deletion

Email hello@custode.au to ask what we hold about you, to have it corrected, or to have it deleted. We will answer within 30 days. You can withdraw camera or location permission at any time in iOS Settings; the app will keep working for anything that does not need them.

If you are not satisfied with how a request is handled, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

When this page changes

The effective date and version at the top change whenever the substance of this policy does. If a change materially affects how your information is handled, users of the app will be told in the app before it takes effect.