Legal
Privacy policy
We built Airleaf around a number you can verify. The same honesty applies to your data — so here is exactly what we collect, why we need it, and how to make us delete it. In plain English, not legalese.
Last updated 18 September 2026
The short version
Five things worth knowing
- You can use the whole map without an account, without signing in and without telling us who you are.
- Sharing your location is a choice your browser asks you to make. Say no and the map still works — it just starts somewhere else.
- We don't sell your data, and we don't buy it. There is no data broker in this business model.
- We never see or store card numbers. There is no card payment on this site.
- Ask us to delete your data and we will, at the email address at the bottom of this page.
This summary is here for speed, not to replace what follows. The sections below are the actual policy.
Who we are
Airleaf measures the tree canopy and air quality around any point on Earth from satellite and sensor data, and plants native trees to close the gap. This policy covers this website and everything you can do on it.
For anything to do with your data — a question, a correction, or a deletion request — write to talha.tariq866@gmail.com. A person reads it.
What we collect, and why
We collect as little as the job allows. Nothing here is gathered “just in case” — each item below exists because something on the site stops working without it.
The places you analyse
Latitude, longitude and the radius you picked.
It's the whole product — we can't measure canopy without a point on the map. Results are cached so the same spot loads instantly next time instead of re-reading satellite imagery.
Your account, if you make one
Your email address, the name you give us, and a password stored only as a cryptographic hash.
So you can sign back in and see your order history. We never store the password itself and cannot recover it — only reset it.
Your order, if you place one
Name, email, phone number, city and delivery address, plus what you ordered and the total.
We can't survey a site, plant a tree or deliver a plant without somewhere to send it and a way to reach you.
Messages you send us
The name, email, optional subject and message you type into the contact form.
To read your message and reply to it. Nothing more — writing to us doesn't sign you up to anything.
Basic usage analytics
Pages visited, rough region, device and browser type — collected by Google Analytics, only when analytics is switched on for the site.
To see which parts of the site people actually use. We look at totals and trends, never at individuals.
Your cart
What you've added, held in your own browser's local storage.
So your cart survives a refresh. It stays on your device and only reaches us if you complete a checkout.
You can browse the map, run an analysis and read the Journal without ever giving us a name, an email address or an account. Identity only enters the picture when you choose to order something, write to us, or sign up.
Your location, specifically
Location is the one piece of data this product genuinely revolves around, so it deserves its own section rather than a line in a table.
It is always your choice. Your browser — not us — asks whether to share your position, and you can refuse. If you refuse, or simply ignore the prompt, the map opens on a demo neighbourhood instead and every feature still works. You can also just search an address or tap the map, and never use GPS at all.
We store the point, not the person. When an analysis runs we save the coordinates, the radius and the result so that the next request for the same spot is served from our database instead of re-reading satellite imagery. Those coordinates are rounded before they are stored and are not attached to your account, your name or your device.
Analysing a place is not a public act. Searching or analysing a location never posts anything to the community feed and is never shown to other users.
What becomes public
Most of what we hold is private. Two things are deliberately not, and you should know which before you act:
- Orders appear in the community feed. Placing an order adds an entry to the public “just planted” list and the leaderboard. For individuals we abbreviate the surname, so a full name is never published. Organisations are shown by name, since that is usually the point of a sponsored planting.
- Planting photos are public. Photos on the community feed are published by our planting team as verification that a funded tree went into the ground.
Your email address, phone number and delivery address are never published, never shown to other users and never shared with advertisers.
Who else sees your data
We do not sell personal data, and we do not share it for anyone else's marketing. The only third parties involved are the ones that make the product function — and there is an important distinction between them:
Google Maps Platform
Draws the map, powers address search and turns coordinates into place names.
Runs in your browser, so Google receives your IP address, device information and what you search for.
Google Analytics
Aggregate usage statistics, when enabled.
Runs in your browser: IP address (truncated by Google), pages viewed, device and browser.
Google AdSense
Serves the ads that help keep the analysis free, when enabled.
Runs in your browser: IP address, device, and cookie-based advertising identifiers.
Open-Meteo, AWS Earth Search, Sentinel-2, World Bank, BigDataCloud, OpenStreetMap Nominatim
Air quality, satellite imagery, national forest cover and fallback place names.
Nothing about you. Our server makes these calls, not your browser — so these providers see a request from Airleaf carrying a coordinate, never your IP address, cookies or device.
That last row is a deliberate design decision. Our satellite, air-quality and forest-cover lookups all happen on our server rather than in your browser, which means those providers never learn who asked — only that Airleaf asked about a coordinate.
We may also disclose data where the law genuinely requires it, or to protect the safety and rights of people using the site.
Advertising
Where ads are enabled, they are served by Google AdSense so the analysis can stay free to use. Some standard disclosures apply:
- Google, as a third-party vendor, uses cookies to serve ads on this site.
- Google's use of advertising cookies enables it and its partners to serve ads based on your visit to this and other sites on the internet.
- Third-party vendors and ad networks may also serve ads and use their own cookies, which we do not control.
You can turn off personalised advertising in Google Ads Settings, and opt out of many other vendors at aboutads.info. Doing so does not remove ads — it makes them less relevant.
How long we keep things
We keep data for as long as it is doing a job, and no longer:
- Analysis results — Cached and refreshed periodically. They describe a place, not a person.
- Account details — Until you ask us to close the account.
- Orders — Kept while we plant and care for the trees, and afterwards where tax or accounting rules require it.
- Contact messages — Kept while we handle your enquiry, then cleared out once it is resolved.
- Analytics and ad data — Retained by Google under its own retention settings.
Your rights and choices
Wherever you live, we will honour these requests — we would rather hold less data, not more. If you are in the UK, the EU or another region with comparable law, these are rights you hold by statute.
Get a copy
Ask us what we hold about you and we'll send it to you.
Correct it
Tell us anything that's wrong and we'll fix it. Account details you can edit yourself.
Delete it
Ask us to erase your account, orders and messages. We'll keep only what the law requires us to keep.
Object or restrict
Tell us to stop using your data in a particular way, including for analytics or advertising.
Take it elsewhere
Ask for your data in a machine-readable format.
Complain
If we get it wrong, you can complain to your local data protection authority.
Email talha.tariq866@gmail.com and we will respond within 30 days. We will not charge you, and we will not ask why.
How we protect it
Passwords are stored only as salted cryptographic hashes — we could not read yours if we wanted to. Sign-in relies on an httpOnly session cookie that JavaScript on the page cannot touch, and every state-changing request carries a CSRF token so another site cannot act as you.
Our database is not reachable from the public internet, and card details never enter the picture because this site does not process card payments. No system is perfect, but we would rather not hold data than have to defend it.
Children
Airleaf is not directed at children under 13, and we do not knowingly collect their personal data. School and class planting projects are welcome — we just ask that a teacher, parent or guardian places the order. If you believe a child has given us personal data, tell us and we will delete it.
Changes to this policy
When this policy changes we will update the date at the top of the page. If a change materially affects how we use your data, we will say so clearly rather than quietly editing a paragraph. The version you are reading was last updated on 18 September 2026.
Contact us
Questions, corrections, deletion requests, or a paragraph here that does not match what you have observed on the site — all of it goes to the same inbox, and we would genuinely like to know about the last one.