TreeScribe Privacy Policy

Updated October 16, 2026

TreeScribe is a field data collection app for perennial crop breeding programs. Access is by invitation only: opening authorized trials requires an access code issued by the organization running their breeding program. TreeScribe is operated by the Savanna Institute.

What the app records, and where it goes

The app records what you deliberately enter while working in a trial: phenotype scores, notes, photos, harvest records, measurements made at the lab bench, and surveyed plant positions. Field records and lab measurements save on your device first and are sent to the crop's upload folder in your organization's Google Drive. Load the trial before working offline. Photos and audio files, notes, and daily measurement sheets become part of the program's breeding records. Your access code identifies you as the observer on the records you create, so your organization knows who recorded what. TreeScribe uses Cloudflare servers to relay sign-ins, database reads and Drive requests. Native photo uploads send their file bytes directly to Google Drive using an upload address supplied by our server. Servers temporarily cache some Drive records and summaries to support shared trial views. Upload errors are logged with their status and error message. The message may contain details returned by Drive.

Your database sign-in

The app reads trial and plant information from your organization's plant breeding database, a registered Breedbase server reached through the Breeding Application Programming Interface (BrAPI), using your own account there. Your password is stored only on your device, and then only if you ask to stay signed in.

When you sign in, your password passes through our own server on its way to your database. That step exists because the database will not accept a sign-in sent straight from a browser on another site. Our server uses it for that one request and keeps no copy of it, in a log or anywhere else, and it is sent to no one but the database you chose.

The field and lab apps do not write observations to Breedbase. Our separate desktop review console does, when somebody at your organization reviews what was collected and chooses to write it, and it does so under their own database account and their own permissions.

Location, camera, microphone, and Bluetooth

The app uses your location, while you are using it, to find the plant you are standing near and to record where each record was made: a surveyed plant, a photograph, a bur count, or a spoken note. It uses the camera and photo library for the plant photos you take, and the microphone for a spoken note you choose to record, which is filed with the trial as audio and is stored without automatic transcription by the recording feature. It uses Bluetooth to read position and quality data from a Global Navigation Satellite System (GNSS) survey receiver when you connect one. The native receiver and correction connection can continue while the phone is locked; this does not guarantee that every collection screen keeps running. Uploads of what you recorded can also continue while the phone is locked. When you start internet corrections, the chosen correction provider receives its sign-in details and periodic receiver positions. If you record receiver messages in Diagnostics, those messages and recording details save locally and can be sent to Drive for review.

At the lab bench, you can turn on Listen in Form view and then say a measurement field and its value, or a row and plant to find a bag. When Read back what I enter is checked, the app reads each confirmation aloud through the browser's speech output. Your browser handles recognition and may send audio to its speech service, such as Google's service in Chrome; TreeScribe does not keep that audio. Listening stops when you turn it off or leave Form. Keyboard dictation is handled by the keyboard or operating system and may use its own speech service.

Phone pairing at the lab

Pairing sends the lab and phone names, a fingerprint of your access code, temporary pairing credentials and scanned label text through Cloudflare to the paired desktop. Sessions expire after eight hours or when ended. The server removes session details and scan records at expiry, keeping only the access-code fingerprint and an expired marker so the same code cannot be reused. An unpaired phone reader decodes labels locally without sending them to a lab.

The optional assistant

The assistant is off unless your access code allows it. Before you use it, a permission screen explains what is sent and asks you to agree. An AI model run by Anthropic, a company outside the breeding program, answers your questions. Each question sends the question as text, the crop and trial, and the trial information on this phone through the TreeScribe server to Anthropic. This includes plant names and positions, accessions and parentage, traits, recorded observations and who recorded them. It also includes the plant selected on screen, your observer name, the time of the question and the TreeScribe version. We do not promise how long Anthropic keeps this information.

The phone's speech service turns a spoken question into text. On an iPhone that service is Apple's, and on Android it is the phone's own, usually Google's. It works on the phone when it can and otherwise on its own servers. Anthropic receives the question as text and never the audio. In a browser, the browser's speech service turns speech into text. Answers are read aloud only with an installed offline voice. Answer text stays on the phone during read-aloud. Listening stops after sixty seconds, when you leave the assistant, or when the app enters the background. Leaving the screen discards what was heard. A spoken question is sent when you press Send spoken question or Ask.

The assistant does not change records. Answers can be wrong, so check the trial records before acting on an answer. Choose Stop sharing with the assistant from the assistant's menu to withdraw permission for future questions. This permission applies to every phone that uses your access code. A newer notice requires agreement again. Withdrawal does not delete information already sent or cancel a question already being answered. Our server stores consent and usage records and keeps completed replies for retry recovery.

No tracking

TreeScribe contains no analytics, no advertising, and no trackers. We do not sell data or use it for advertising. Data is sent to the services described above to provide the functions you use. Records belong to the organization whose trial they were collected in.

Deleting your data

Uninstalling the native app removes its local records, including unsent photographs and recordings. Browser data is separate and can be removed through the browser's site-data controls. Signing out clears sign-in details but keeps collected records. Copies exported or uploaded elsewhere are not removed by signing out or uninstalling.

Records you sent are kept in the Google Drive of the breeding program whose staff issued your access code: photographs, spoken notes, written notes, scores, counts and survey points, with your observer label and any position recorded with that record. They are part of that trial's research records and are kept as long as the trial's data are kept.

To have your records deleted or your access code revoked, email info@treescribe.app with your name and the trials you worked on. The program's data stewards will revoke your code and delete the photographs, recordings and notes you sent. Measurements that have already been reviewed into the program's breeding database are research observations of the plants, and they are kept.

For any other question about this policy, write to the same address.