What we collect, and who reads it.

Who we are

Carbon Capture Shield, Inc. is based in San Antonio, Texas. Carbon Capture Shield, Inc. is a Delaware company. In this page, “we” and “CCS” mean that company.

Our websites and the Brother Nature app are for adults and businesses: growers, carriers, processors and the people who work with them. They are not made for children.

Every user gets the same full privacy and data handling, whether or not they pay. A paid plan only adds features or modules, and may add more relays or encrypted cloud storage for packages. A paid feature that sends data to us says so where it is described, and applies only when you use it. Nothing on a paid plan makes privacy on the free app weaker.

Questions about this page, or a request to see or delete what we hold about you: [email protected].

In short

The kinds of personal information we collect:

• From the contact and fund forms: your name, email address or mobile number, your message, your IP address, your country, the first 200 characters of your browser's identifying string, the page you came from, and on the fund form the docket you picked.
• From the app: only what your phone puts on the relay, all of it sealed: hand-on and receipt records, files sent by link, and the bundles a processor's phone sends back to a grower. We can't read what is inside any of it. A file sent by link shows a few facts about itself without its passphrase: its size and type, a fingerprint of its contents, when it was sealed, and the sender's account (below). A farm on a paid licence also sends calculation requests, which we read only to work out the answer (below). Not running yet: the paid calculation is not on platform.carboncaptureshield.com today. The calculation sentences describe it once it ships.

We do not sell personal information, and we do not use it for advertising.

This website

Cloudflare Pages hosts carboncaptureshield.com. Like any web host, Cloudflare receives each request your browser makes, including your IP address.

The site's own code sets no cookies and loads no analytics script. If you switch between light and dark, your browser keeps that choice under the name ccs-theme. The Just Add Water film page also keeps one value, ccs-jaw-ab, so that you keep seeing the same one of its three designs, picked at random on your first visit. Neither is ever sent to us.

Some pages load typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com): the Just Add Water pages. Your browser then asks Google for the font files, so Google receives your IP address and the page's address.

Film trailers load from YouTube's no-cookie address (youtube-nocookie.com) only when you press play. Until then, nothing is fetched from YouTube.

Printed QR codes for the film go through carboncaptureshield.com/qr/. Each scan stores which code was scanned, the time, and the country Cloudflare reports. No IP address is stored.

The contact form and the fund form

The form on Connect, and the interest form on the Just Add Water fund page, send what you type to us: your name, your message, and an email address or a mobile number. The fund form also sends the docket you picked, and its name. With it, we keep the time, the page you sent it from, the country Cloudflare reports, the page that linked you there, the first 200 characters of your browser's identifying string, and your IP address.

That record goes to three places:

• A private Cloudflare R2 storage bucket that only CCS can read. It holds everything listed above.
• An email to CCS, sent through Resend, an email delivery service. The email holds the time, the page, the docket if there is one, your name, email or mobile, country and message.
• A Telegram message to Darryl J. Nicke II, CCS's CEO, with the same lines as the email.

Darryl J. Nicke II reads these. Your IP address is also kept for a short time, to limit how many messages one address can send.

We keep form records until you ask us to delete them: ask at [email protected].

The Brother Nature app

The app runs in your phone's browser at platform.carboncaptureshield.com. It has no account with us and no password. Your records stay on your phone, in the browser's own storage, and on the phones of the farm and the people you hand loads to. What leaves the phone is listed below. Hand-ons, receipts, files sent by link and bundles sent back to a grower pass through the relay (below) sealed: the relay keeps only the sealed bytes, their size and when they were written, and we hold no readable copy of any record. There are no analytics in the app, and its typefaces come with the app, not from Google.

What stays on the phone only:

• Your lots, weights, field work and the other records you make.
• The email address on your contact card is never sent to us and is not in the card's code. When you hand a load on, it goes in the hand-on code to the phone that takes the load, phone to phone, so that phone can email you the records about it. A carrier's phone passes your email on in its own hand-on code to the phone it delivers to.
• Your settings: roles, language, light or dark, the names you give lots.

What leaves the phone, and when:

• A hand-on and its receipt. When you hand a load on, or take one in, the phone seals that one signed record and puts it on the relay (below), so the other phone can fetch it. We hold nothing that opens it.

  The phones in the hand-on chain can open the record: the sender, the carrier, the receiver, and later holders of the load whose phones trace it back through earlier hand-ons. They read these fields:

  • the kind of record (a dispatch or a receipt), the movement's id, and the accounts of the two parties (for a phone that joined a farm, that is the farm's account);
  • the signing phone's identity and signature, and the earlier records this one follows from;
  • the load's weight, or its count and the count's unit; whether it was not weighed; a scale note; the moisture instrument and how sure the reading is; a docket's code and a kept sample's id;
  • on a receipt: whether the load was received or refused, whether a difference was noted, who holds a refused load (the carrier or the receiver), and whether it was taken in by a carrier;
  • a refusal's reason and its note;
  • the driver's name, when a farm's own driver carries a load;
  • the name each phone gave itself under Name on this phone, if one was set;
  • on a receipt: the receiving farm's list of phones. That is each phone the farm has added or removed, the name the farm gave it, and the codes that check its signature. The phone that sent the load uses the list to check that the receipt really came from that farm. Anyone who holds the receipt's code can read the list. Once the paid calculation runs (below), CCS's calculation service also keeps the farm's list of phones.

  Two of these are typed by a person and can hold anything: the refusal note and the count's unit. The refusal reason, the moisture instrument and the driver's name are also kept as text.

• A request to join a farm. A new phone makes a file that identifies it. You hand that file to the farm yourself. It does not go through us.
• A file you send. See below.
• A calculation on a paid licence. A farm on a paid licence sends a lot's records, its land file and the list of phones enrolled in the farm to CCS's calculation service, which sends the result back. We use the lot's records and land file only to calculate the answer, and don't keep them after we return it. We keep the farm's list of enrolled phones, including any phone the farm removed, so that a removed phone can't ask again. We keep that list with no end date. Your IP address and the farm's account are also counted for a short time, to limit how often one caller can ask. The relay also keeps the farm's licence, which names the farm's account, so the farm's phones can fetch the newest one. Not running yet: the paid calculation is not on platform.carboncaptureshield.com today. The calculation sentences describe it once it ships.
• Map pictures. When you draw a paddock's border, the phone loads aerial pictures of that area from the NSW and Queensland government map services, and in some versions from Esri. Those services see which area you looked at, and your IP address.

The relay: files and records passed between phones

The relay is a small service on platform.carboncaptureshield.com, run by CCS on Cloudflare. It stores what phones hand to it in a private Cloudflare R2 bucket and gives an item back to a phone that asks for it. It keeps no account, and our code does not log who asked, for what, or what was sent. Cloudflare, as the host, still receives each request and your IP address.

A file you send. The phone seals the file with a passphrase. You send the sealed file as an attachment from your own email app; it does not go through us. The passphrase is never sent with it: you give it to the person yourself, by text or a call. Anyone who has the attachment, without the passphrase, can see the file's name, size and type, a fingerprint of its contents, when it was sealed, and the sender's account when the phone signed it. They can't see what is in it.

A small file is sent by link instead. Only the sealed file goes to the relay, with its name left out. Anyone with the link, without the passphrase, can see its size and type, a fingerprint of its contents, when it was sealed, and the sender's account, but not its name or what is in it. A larger file, or one the relay can't take, still goes as an email attachment.

Records sent back to a grower. A processor's phone can email a grower a link to the records about their load: the acceptance or refusal, quality feedback, or lab papers. The sealed bundle sits on the relay, and the key that opens it is part of the link, so anyone holding the whole link can open it.

Hand-on and receipt records sit on the relay sealed. The relay keeps only the sealed bytes, their size and when they were written: no field of the record, and not the code that names it. A receipt's sealed record includes the receiving farm's list of phones described above, which anyone holding the receipt's code can read.

The relay deletes nothing by itself, so what it holds stays there.

Services that handle this information

• Cloudflare hosts both sites and the relay, and runs the R2 storage that holds form records and relay files.
• Resend delivers the email each form message sends us.
• Telegram carries the copy of each form message sent to Darryl J. Nicke II.
• Google Fonts serves typefaces to some pages of this site.
• YouTube serves a film trailer when you press play.
• The NSW and Queensland government map services, and Esri, serve map pictures when you draw a paddock's border in the app.

Each of these handles the information under its own privacy terms.

Do Not Track

Our sites and the app run no analytics and do not follow you across other sites, so they work the same whether or not your browser sends a Do Not Track signal. The services above may treat that signal in their own way.

Changes to this page

When what we collect changes, we change this page and say what changed at the top of the page.