Privacy Policy

Earth Online is an online service for Player identities, Co-creator profiles and real-world collaboration tasks. This policy covers Earth Online Website 2.0, Player accounts, Co-creator profiles and Bounty Hall V1.

The service operator is Earth Online Institute, Canada, a Canadian federal non-profit corporation. A private residential address is not published in this policy; whether a public mailing address must be provided remains subject to legal review.

• Account and authentication data: email address, CloudBase Auth UID, email-verification state, authentication provider and session data, and creation, update and recent-login timestamps. Passwords are handled by CloudBase Auth; Earth Online business pages do not read or return your password.
• Player profile data: display name, HTTPS avatar URL, preferred language, account status, join date and update time.
• Co-creator profile data: country or region code, city, time zone, bio, availability, skills, domains, languages, HTTPS portfolio URL, directory visibility and leaderboard choice.
• Private project contacts: login or project email, WeChat, phone, other contact details and the primary-contact flag.
• Bounty Hall data: tasks, applications, invitations, membership and lead relationships, Work Packages, assignments, leave and handover requests, submissions, reviews, revision feedback, notifications and timestamps.
• Reward and settlement data: contribution allocations, CP/GP ledger entries, optional Offline Project Benefit text, and historical/internal amount, currency, recipient, payment date and notes where a real offline cash settlement exists.
• Files: public assets and private submission attachments, including original filename, type, size, storage path, owner and linked task.
• Security and integrity data: roles, consent records, audit events and server error codes. The V1 business database has no dedicated IP, device fingerprint or browser-profile fields, and the site has no third-party analytics or advertising tracker integration.
• Where applicable, the separate Certified Player module stores a Player ID, certification names, date of birth, journey/certificate dates, certification status, public-name consent and internal notes. Legacy records stay in their separate module; the new Player Account is the primary account. After checking record ownership, an authorised administrator can link a certificate number to one existing UID, retaining restricted verification evidence and an audit record. This does not automatically migrate the legacy database, dates of birth or private contacts.

• To create and secure accounts, maintain sessions, verify email and provide Chinese or English experiences.
• To operate Player and Co-creator profiles and show public profile or leaderboard information according to your choices.
• To run applications, invitations, collaboration, submissions, reviews, notifications and handovers for Solo, Project and Open Call tasks.
• To record contributions and settle equal CP/GP, and to retain necessary descriptions or internal records where a task has a separate non-standard offline benefit or real settlement arrangement.
• To preserve the integrity of projects, submissions, reviews, rewards and audit records, and to address security, abuse and disputes.

An active Player's display name and avatar URL are safe public identity fields and may appear with tasks, leads, members or public identity views. Co-creator directory fields are public only when the profile is active and directory visibility is set to Public. Not listed removes the profile from the directory.

Co-creators only is an existing profile option, but V1 does not yet have a separate Co-creator-only directory reader. Until that exists, the selection is not treated as public directory data. The CP leaderboard shows only the display name, avatar and CP total of active Co-creators who opt in.

Email, phone, WeChat, other project contacts, GP, historical cash records, application text, submissions and review feedback are not public profile fields. Offline Project Benefit text is also omitted for visitors, unauthenticated users, ordinary Players and suspended Co-creators; it is available only to active Co-creators, administrators and backend-authorised project managers where applicable.

Activating a Co-creator profile requires at least one valid project contact and one primary method. These details support legitimate Earth Online collaboration and are never added automatically to the public Co-creator directory.

You can view your own contacts. Earth Online administrators may view the full profile and contacts where necessary for platform administration. From the moment you submit an application for a task, project or role, the authorised Lead or Publisher for that application may view your private contact details to assess the application, contact you and arrange collaboration. Authorised Leads and Publishers may continue to access them while an actual member relationship exists. Contact access creates an audit event.

Before a user submits an application or an actual member relationship exists, candidate search uses only permitted professional discovery fields and never returns private contacts. Ordinary Players, unrelated Co-creators, public directories and leaderboards do not receive those contacts.

A phone number or WeChat ID supplied here is a project contact only, not a sign-in credential. Any future phone or WeChat sign-in would be a separate authentication feature with separate notice and configuration.

Visitors can view public tasks and safe public identities. Applications, invitations, participation, team membership, assignments, leave or handover requests, submissions and reviews are available only according to ownership, task relationship and management permissions.

Submission attachments are stored in the private bounty-submissions bucket. The uploader, an administrator, the task publisher and anyone the backend determines may read that attachment can open it through controlled temporary access. A file linked to a submission cannot be directly deleted by an ordinary user.

Each approved contribution reward point creates one CP and one GP. CP and GP ledger entries are account contribution records readable by the user and administrators. The public CP leaderboard shows only an opted-in user's display name, avatar and CP total. GP details are not public.

Offline Project Benefit is optional, non-standard task text, not a wallet, currency or CP/GP conversion. Where a real offline cash payment occurs, private/internal settlement records may retain the actual amount, currency, recipient, date and note. Existing cash ledgers remain available only to the user and administrators and are not a public standard reward.

V1 has no advertiser, data-broker or data-sale workflow and does not use private data for targeted advertising.

• Visitors: public tasks, safe public Player identity, Co-creator directory fields made public by visibility choice, and opted-in CP leaderboard information.
• The account holder: their own account, Co-creator profile, private contacts, consents, notifications, participation, submissions, CP/GP and any private legacy or real settlement record concerning them.
• Project leads and publishers: from submission of a relevant application, application, collaboration, submission, review, reward and necessary contact data within a genuine task relationship and current permissions.
• Administrators: full profiles and contacts, plus account, collaboration, security, audit and settlement information within current backend administrative permissions.
• Infrastructure providers: Tencent Cloud's Hong Kong region provides website hosting and application/API processing. Tencent Cloud CloudBase in Singapore provides Auth, PostgreSQL, permission/RPC and Storage processing.

During ordinary use, information is retained as needed to provide accounts, collaboration, security and settlement. After a verified deletion or deactivation request, public profiles, directory data, private contacts and other removable account data should be deleted, hidden or anonymised as a priority.

Necessary project relationships, submissions and reviews, CP/GP/cash ledgers, consents and audit records may be retained or de-identified to preserve collaboration, settlement and security integrity. Where retained, public names, avatars and identifying profile details should be replaced where practicable with a label such as Deactivated Player. Cash records may also be subject to finance or tax retention duties.

Attachments are assessed case by case according to whether they were submitted and whether collaboration evidence, disputes, settlement or another necessity requires retention. Unsubmitted private files without a retention need may be deleted. Retained attachments should have restricted access and identifying filenames should be removed where appropriate. Exact periods, legal exceptions and anonymisation standards remain subject to legal review and later engineering work.

V1 uses session-based authentication, PostgreSQL row-level security, backend permission functions, private no-store responses, private buckets and audit events to limit access. No system can guarantee absolute security.

The production architecture uses Tencent Cloud's Hong Kong region for website hosting and application/API processing, and Tencent Cloud CloudBase in Singapore for Auth, PostgreSQL, permission/RPC and Storage processing. Because these services operate in different regions, information may be processed in Hong Kong and Singapore. Cross-border disclosure wording for the Canadian operator and Hong Kong/Singapore cloud processing remains subject to legal review.

You can edit your display name, avatar URL, preferred language and permitted Co-creator fields, choose directory visibility and opt in or out of the public CP leaderboard. You may request correction, deactivation, deletion or anonymisation, although some project, ledger and audit records may be retained for integrity.

For privacy, account deletion, access, correction or contact-data questions, email privacy@earthonline.institute. We will first verify account ownership and then follow the final reviewed process.

This draft is designated Privacy Policy v1.0. Earth Online should publish a new version and obtain renewed consent when data use, permissions, authentication or service scope changes materially. Typographical, formatting and non-substantive clarifications do not automatically require renewed consent. The final material/non-material test remains subject to legal review.

The live site records the current version shown on this page only when you actively confirm acceptance. Existing records are not automatically accepted, backdated or rewritten. Test-environment consents and signatures are not imported into production.