Privacy Policy

01The short version

02What we do not do

• No cookies. The site sets none, of any kind. This is why you see no cookie banner — there is nothing to consent to.
• No analytics. No Google Analytics, no Plausible, no self-hosted counter. We do not know how many people visit, or which pages they read.
• No tracking pixels, no advertising, no fingerprinting.
• No browser storage. Nothing is written to localStorage, sessionStorage, or IndexedDB.
• No accounts, forms or sign-ups. The staking calculator on the home page runs entirely in your browser; the numbers you type are never sent anywhere.

You do not have to take our word for it: open your browser's developer tools on any page of this site and look at the network and storage tabs.

03Hosting

The site is hosted on Cloudflare Pages. Like every web host, Cloudflare processes the technical information your browser sends in order to deliver the page — your IP address, user agent, and which file you requested — and may retain it briefly in server logs for security and abuse prevention.

We do not have access to an analytics dashboard for this data and do not use it to identify anyone. It is handled under Cloudflare's own privacy terms.

04Third parties your browser contacts

Three, and only three:

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — every page loads the site's typefaces from Google, which means Google receives your IP address and user agent as part of that request. This is the only third party contacted on most pages.
• Helius (mainnet.helius-rpc.com) — on the transparency page only, your browser reads public Solana chain data directly through this RPC provider. The requests contain public token and wallet addresses, not anything about you beyond the connection itself.
• Block explorers (Solscan, Solana Explorer) — only if you click a link to one. Those are ordinary outbound links; their sites have their own policies.

05The Sapling Network app

The Sapling Network app for Android lets you fund trees from your own Solana wallet, follow the trees you funded, and record a planting at an event. It has no accounts, no sign-up, no analytics and no advertising.

What stays on your phone

• Planting sessions: the photographs you take in the app, the position of each one, your track while a session is open, and the session code — in the app's private storage until you delete the session. A practice session never leaves the phone.
• The app lock: a salted hash of your passcode (never the passcode) in Android's secure storage. If you use fingerprint or face unlock, Android checks it; the app only learns whether it matched and never receives biometric data.
• Small settings: your language, whether you have seen the introduction, and the versions of the purchase terms and of this notice you accepted.

What leaves your phone, and only when you act

• A planting package, when you send it to the Sapling Network desk: its photographs, their positions, the track, the time readings, your wallet address and signature, the lead's signature if any, the version of this notice you accepted, and the phone's operating system and app version.
• A purchase: a transaction your wallet signs and sends to Solana. Like every Solana transaction it is public and permanent: your wallet address, the amount, and a memo with the number of trees, the price and the terms version. The app never holds your keys or funds.
• A lead's sign-off happens phone to phone with QR codes; nothing goes through our servers.
• A crash report is never sent by itself; you can choose to share one (the error and the app version) with whoever you pick.
• An identity check (closed beta testers only), when you start it under Community → Rewards: your wallet address and a message your wallet signs go to sapling.network, which opens the check at Didit for that wallet. The document photo and the selfie are taken in your browser, on Didit's page, not by the app. See Identity checks.

Who the app contacts

• sapling.network (Cloudflare): the published files the app reads, and a relay for public Solana data. Lookups of your wallet's balances, history and certificates go through this relay, which forwards the request but not your IP address to our blockchain data provider (Helius).
• sapling-network.pages.dev (Cloudflare): the same site at Cloudflare's own address. The app uses it only when your network cannot reach sapling.network, for the same requests.
• Didit (verify.didit.me): only if you start an identity check, in your browser, under Didit's own privacy policy.
• Helius image service (cdn.helius-rpc.com): token logos in the wallet view, loaded directly, so it receives your IP address.
• Solana's public devnet endpoint while purchases run on the test network.
• Expo (u.expo.dev): checks for updates to the app's own code, with the platform, app version, channel and a random installation identifier not linked to you or your wallet.
• Your wallet app (for example Phantom), on your phone, under its own privacy policy.

The app's typefaces are built in; it does not contact Google Fonts.

Permissions

• Camera: to photograph a planting and scan QR codes.
• Precise location: from the moment a session opens until it is sealed, only while the app is on screen. The app has no background location permission.
• Biometrics: only if you turn on fingerprint or face unlock.

06Why the app's data is processed, and for how long

Purpose. Planting data is processed to show that specific trees were planted at a specific place and time, to check that claim before anything is published, and to revisit the trees during the three years they are monitored. Purchase data is processed to record and fulfil your order.

Legal basis. Recording and checking a planting you chose to record, and fulfilling an order you placed, are necessary for what you asked us to do (KVKK art. 5(2)(c); GDPR art. 6(1)(b)). Keeping the evidence honest and preventing false records is our legitimate interest (KVKK art. 5(2)(f); GDPR art. 6(1)(f)). Positions and photographs are not special-category data. We do not rely on consent for this, because the record must stay checkable; you are told what is recorded before your first session, and you can stop at any time by not recording.

What becomes public. The batch record: species, number of trees, planting date and one coordinate for the whole site, to about a kilometre. Selected photographs of the site and saplings, with their hidden metadata (including any GPS tag) removed; photographs showing a person are not published. Survival checks, without positions. The public record contains no personal data; the position of a single tree is never published.

Retention.

• A package that is rejected: deleted 90 days after it arrives.
• An accepted package: kept while its trees are monitored — three years after planting, plus six months — because the positions are needed to find the trees again. Then every photograph and position that was not published is deleted.
• Data on your phone: until you delete the session or the app.
• Payments: on the public blockchain, permanently; no one can delete them.

Where it is processed. Packages are processed at the Sapling Network desk in Turkey. The website and the app's lookups are served through Cloudflare, Helius and Expo, which may process your IP address outside Turkey and the EU under their own safeguards; beta identity checks are processed by Didit; the legal entity, once registered, will put transfer agreements in place with each of them.

Who is responsible. Until the legal entity described in the Terms is registered, the data controller is the project's founder named there, reachable at info@sapling.network.

07On-chain data is public and permanent

If you ever interact with SAPN — holding, transferring, staking — that activity is recorded on the Solana blockchain. Blockchain records are public, permanent, and outside anyone's control, including ours. They cannot be edited, hidden or deleted, by us or by you.

Wallet addresses shown on the transparency dashboard are public chain data. We label the project's own wallets deliberately; we do not attempt to attach names to anyone else's.

08Closed beta applications

You can apply for the closed beta on this website at sapling.network/apply, or with the Apply form in our Discord server. Both send the same things, and only what you type:

• What: the name you want us to use (or, from Discord, your Discord name and user id), the e-mail of the Google account on your Android phone, your Solana wallet address, the country you live in and your phone model.
• Why: to decide on your application (age, country and one wallet per person are rules of the beta), to add your e-mail to the Google Play test track, and to write to you about the beta. Legal basis: taking the steps you asked for before an agreement (GDPR 6(1)(b), KVKK 5/2-c).
• Where: the application goes from our server at Cloudflare to a private channel of our Discord server that only the founder and our bot can read; Discord stores it for us as a processor, in the United States, under its own safeguards. The website keeps no copy.
• Against spam: the web form allows one application a minute from the same connection. For that, a one-way hash of your IP address is held in Cloudflare's cache for 60 seconds and then disappears. Nothing else about your device is used.
• How long: applications that are not accepted are deleted when the beta ends; the rest are deleted with the other beta data, within 90 days after the beta rewards are paid.

09Identity checks (KYC)

Closed beta. Testers verify once, so that rewards reach one adult person per wallet in a country where they may be paid. The check is run for us by Didit, with your consent, in its own flow in your browser.

• From the result we use only what our rules need: that you are 18 or older, the countries on your document and your connection, and whether you appear on a sanctions list. We use them once to decide and do not keep them.
• As soon as the check is decided, the whole session is deleted at Didit — document photos, selfie, liveness recording and the data read from them. We never download or keep a copy of your document or your selfie.
• We keep the result (which rewards the wallet may receive) and two one-way, salted fingerprints — one of the document number, one of the name with the date of birth — so the same person cannot verify a second wallet. Neither can be turned back into the number, the name or the date.
• On chain, the wallet's attestation holds only the answer: no name, country or date of birth.
• Everything we keep is deleted within 90 days after the beta rewards are paid. The full terms are on the closed beta page.

Token sale. No sale is open. When a sale runs, KYC/AML checks are performed by the sale venue under its own privacy policy, not by us. Sapling Network stores the minimum necessary to meet its obligations, does not sell or share member data, and does not operate a marketing database.

10Your rights

Under the GDPR and comparable laws you have rights of access, rectification, erasure, restriction, portability and objection over personal data held about you.

The website itself holds no personal data, so there is nothing to retrieve or erase from it. For a planting package you sent to the desk, you can ask for a copy, a correction, or its deletion; we delete our copy of the package, while the public batch record, which contains no personal data, stays as published. Payments on the blockchain cannot be changed or deleted by anyone.

Under KVKK you may also apply to the Personal Data Protection Authority (KVKK) after applying to us; under the GDPR, to the supervisory authority of your country.

To raise a question or a request, contact us through the channel in Section 8.

11Contact and changes

Write to info@sapling.network, or reach the project at @Sapling_Network on X. We answer requests about your data within 30 days.

This policy is updated whenever what the site does actually changes — not as boilerplate. The date at the top reflects the current version.