Privacy notice

Who we are

Treenor is a product of Wonder Media Ltd, a company registered in England and Wales under company number 06489006. Our registered office is 48 Church Avenue, Harrogate, North Yorkshire, HG1 4HG. Our VAT number is 983 5674 67, and we are registered with the Information Commissioner’s Office under registration number ZA902438.

Wonder Media Ltd is the controller of the personal data described in this notice. If you have any questions about it, please contact us at privacy@treenor.com.

Our approach

Treenor is funded by its members. We do not show advertising, we do not track you across other websites or apps, and we do not sell or share your personal data for marketing. We collect only what we need to provide Treenor and keep it safe, and we keep it only for as long as we need it.

Information we collect

When you claim a handle on treenor.com

• The handle you choose, your name as you would like it to appear, and your email address.
• The country you claimed from, as a two-letter country code provided by our hosting provider, Cloudflare. We do not store your IP address.
• If you arrived through a member’s invite link, which member invited you.
• If the link you arrived from carried a campaign tag (for example “?from=traitors”), that tag. Tags are labels we set on our own links and contain no information about you.
• Your personal invite code, and the dates and times you claimed your handle, confirmed your email address and were last emailed by us. We also record the order in which handles were confirmed. This is not shown anywhere.

We do not ask for your phone number, location or date of birth.

When you use the Treenor app

The app is not yet available. This section describes how it will process personal data, and will be reviewed before it launches.

• Account details: your email address, handle and name and, if you use Sign in with Apple, the identifier Apple provides (and Apple’s relay email address, if you choose to hide yours). Your profile picture and bio, if you add them.
• Content you create: your posts and replies, which are public, and your private messages.
• Membership and trees: whether your membership is active, a transaction reference for each payment, the price and the country of your app store account, which Apple or Google provide to us. Payments are taken by Apple or Google; we never receive your card details. We record the project and Tree-Nation reference for each tree your membership funds.
• Age assurance: the result of the age check you complete when you first use the app (whether or not you are 18 or over). We do not receive the information the age-check provider uses to reach that result.
• Safety records: reports you make, reports made about your content or account, and the action we take.
• Notifications: if you allow notifications, a device token provided by Apple or Google so that we can send them.

The app does not request access to your location, contacts, camera or microphone, and can only access the single photo you choose as your profile picture.

Website analytics and security

treenor.com does not use cookies or advertising pixels. We use Cloudflare Web Analytics, which records the pages viewed and the referring website without cookies and without storing IP addresses. We also keep daily totals of how many visitors reach each step of claiming a handle; these totals contain no personal data.

To protect our forms from automated abuse we use Cloudflare Turnstile and limit how often a form can be submitted from one connection. That limit is held briefly in memory and is not stored.

How we use your information and our lawful bases

Under the UK General Data Protection Regulation (UK GDPR), we may only use personal data where we have a lawful basis to do so. We rely on the following:

• To provide Treenor to you, including holding your handle, running your account, membership, posts, messages, trees and notifications, and sending you the emails the service needs. Lawful basis: contract.
• To check that members are 18 or over, to report child sexual abuse material to the National Crime Agency, to keep tax and accounting records, and to respond to valid requests from courts, regulators and law enforcement. Lawful basis: legal obligation.
• To share information with the police or emergency services where we believe someone’s life or safety is at risk, or to help prevent or detect crime. Lawful basis: recognised legitimate interest.
• To keep Treenor safe and secure, including moderating content, preventing spam and abuse, and preventing removed accounts from rejoining; and to understand which countries, invites and campaigns bring people to Treenor. Lawful basis: legitimate interests. Our interests are running a safe service and planning where to make it available; we have assessed that they do not override your rights.
• To send you notifications, and any emails beyond those the service needs. Lawful basis: consent, which you can withdraw at any time in your phone’s settings or by contacting us.

We send an email to confirm your address when you claim a handle, and another when the app opens in your country. We will resend your confirmation link if you ask. We may also email you about your handle, including before we release an unused one, and about significant changes to Treenor or to this notice. We will not send you marketing emails unless you choose to receive them.

Automated decisions

Age checks and profile picture checks are carried out automatically. If an automated check prevents you from doing something and you believe the result is wrong, you may ask for it to be reviewed by a person by contacting privacy@treenor.com. The age check also offers alternative methods if it cannot confirm your age automatically.

Who we share information with

We use the following service providers to operate Treenor. They process personal data only on our instructions and under contracts that require them to protect it:

• Cloudflare, for hosting, our database (stored in the European Union), bot protection and website analytics.
• Mailgun (EU service), for sending email.
• Proton (Switzerland), for receiving email.
• Apple and Google, for app distribution, payments, Sign in with Apple and notifications. They also act as controllers of personal data under their own privacy policies.
• An age assurance provider and an image moderation provider, which we will name in this notice before the app launches.

Tree-Nation, our tree-planting partner, receives no personal data from us.

We will disclose personal data to the police, regulators or other authorities where the law requires it, or where we believe it is necessary to protect someone’s life or safety. If Wonder Media Ltd or Treenor were sold or reorganised, personal data would transfer with the service, and we would notify you before it did.

International transfers

Our database is located in the European Union. Some of our service providers are based in the United States or Switzerland. Where personal data is transferred outside the UK, we rely on the UK’s adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or on the International Data Transfer Agreement or Addendum approved by the ICO.

How long we keep information

• Unconfirmed handle claims are deleted 48 hours after the most recent attempt.
• Confirmed handles are kept until the app opens. If you have not joined within 30 days of the app opening in your country, we will delete your details and release your handle, after notifying you by email.
• Account information is kept for as long as your account exists, including while your membership is paused.
• When you delete your account, it is hidden immediately and permanently deleted after 30 days. Signing in during that period cancels the deletion. Backup copies are overwritten within a further 30 days.

After an account is deleted, we keep the following for the reasons and periods stated:

• Records of the trees the account funded, with no name, email address or handle attached, so that Treenor’s total remains accurate. Trees funded by an invitation remain on the inviting member’s count.
• Payment records, with no name, email address or handle attached, for six years, as required for tax purposes.
• Where an account was removed for breaching our terms, a hashed copy of its email address for one year, to prevent it from rejoining.
• Where we have reported content to the National Crime Agency, the report reference for five years, and the content and related account information for one year, as the law requires.
• Information relevant to an ongoing complaint, legal claim or law enforcement request, until it is resolved.

Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, encryption at rest by our providers, and restricted administrative access. Private messages are not end-to-end encrypted. They are reviewed only where a message has been reported or where we are required to by law. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

Your rights

Under data protection law you have the following rights, depending on the lawful basis we rely on:

• The right of access: to ask for a copy of your personal data.
• The right to rectification: to ask us to correct information you think is inaccurate or incomplete.
• The right to erasure: to ask us to delete your personal data.
• The right to restriction of processing: to ask us to limit how we use your personal data.
• The right to data portability: to ask us to provide your personal data in a format you can take to another service.
• The right to withdraw consent: where we rely on your consent, you can withdraw it at any time.

Your right to object. Where we rely on legitimate interests, you have the right to object to our use of your personal data. We will stop unless we have compelling grounds to continue.

In the app you will be able to download your data and delete your account yourself. To exercise any of these rights, contact privacy@treenor.com. There is no charge. We will respond without undue delay and in any event within one month. Deleting your details before the app opens releases your handle.

Children

Treenor is only for people aged 18 and over. If we learn that someone under 18 has an account, we will close it and delete their personal data.

Complaints

If you have a concern about how we use your personal data, please contact us first at privacy@treenor.com. We will acknowledge your complaint within 30 days and let you know the outcome.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the European Union, you may complain to the data protection authority in your country.

Changes to this notice

We will update this notice when our practices change, and the date below will show when it was last revised. We will notify you by email, or in the app once it is available, before any significant change takes effect.

Last updated 16 October 2026.