Privacy Policy

Versi Bahasa Malaysia. Last updated: 6 November 2026. This policy covers both the Wildlife of Borneo website (wildlifeofborneo.com) and the Wildlife of Borneo Android app. It is our notice under Malaysia's Personal Data Protection Act 2010 (PDPA).

Who we are

Wildlife of Borneo is operated by Neofelis Digital (business licence no. TMPR/2026/B9B2DDE0), Mini Peti Surat 04, Kiulu, 89250 Tuaran, Sabah, Malaysia ("we", "us"). Neofelis Digital is the "data user" for the personal data described below. Contact: wildlifeofborneo@gmail.com.

The short version

There are no accounts and no logins. We do not sell data, we do not show adverts, and we do not use any third-party analytics or advertising SDKs. Your sightings list and trip plans stay on your device unless you choose to send them. The one exception is the enquiry form: if you use it, we pass your details to the tour operator you chose (see "Tour operator enquiries" below).

Data stored on your device only

The following are saved in your browser or app storage on your own device. We cannot see any of it, and it is not transmitted anywhere:

• Your sightings checklist — which species you have marked as seen, plus any location and dates you add.
• Photos you attach to a sighting, or your own photo on a species page, in the Android app — stored only on your device, never uploaded, and deleted if you remove them (species photos) or clear your sightings list (sighting photos).
• Your trip planner list — the regions and species you have added.
• Your language preference (English, Malay or Indonesian).

Clearing your browser data, using the in-app "Clear list" button, or uninstalling the app will delete this information permanently. We hold no copy of it and cannot restore it.

Information we do receive

Tour operator enquiries

For some operators and locations, "Enquire now" opens a form on our site, and the "Email your trip plan" button in the Trip Planner works the same way when the recipient is a listed operator. If you send one, we receive and forward what you enter: your name, your email address (or the phone number you gave), your message, and, if you filled them in, your travel dates, group size and the species or trip plan you attached.

• Why: solely to deliver your enquiry to the operator so they can reply to you, and to send you a confirmation email.
• Who receives it: the tour operator you chose, and any booking agent that handles that operator's enquiries (for Deramakot Forest Reserve this is Adventure Alternative Borneo, which is copied on every Deramakot enquiry); us (we are blind-copied on the enquiry so we can check it was delivered and help if something goes wrong); and our email delivery provider, Resend (resend.com), which processes the message on our behalf. Resend is based in the United States, so your data is transferred outside Malaysia for this purpose. Once an operator has your enquiry, they handle your details under their own privacy practices.
• What we keep: we do not keep your enquiry in a database. Our enquiry log records only the location or operator, the operator's business email address, and the date and time, with no name, no email address and no message. Copies of the email stay in our enquiry mailbox only for as long as we need them to confirm delivery and help with problems, and are then deleted.
• It is voluntary. You do not have to use the form. If you prefer, email the operator directly, or use the Contact page. Not providing the details marked as required means we cannot pass on your enquiry.

Where the enquiry button instead opens a draft in your own email app, the message goes directly from you to the operator and does not pass through us. In that case we log only the location/operator and the time, as above.

We are not the tour operator, we do not take bookings or payments, and any contract for a tour is between you and the operator.

Other information

Anonymous usage analytics. We record which pages get read, what people search for, how far a page is scrolled and for how long, and which button features get used. We do not record whether you have visited before, and nothing is kept on your device between visits. This is grouped by a random id that lives only for the length of one browser tab — it is not a cookie, it does not persist, and it cannot be used to identify you or connect two separate visits. We do not use any third-party analytics provider or SDK for this; it goes directly to our own server.

Contributing photos or trip reports. The "Contribute a photo" button takes you to the shared contribution form on wildlifeofeverywhere.com. What you send there is covered by the Wildlife of Everywhere privacy policy, run by the same operator.

Contact form. The "Send message" button on our contact page opens a pre-filled draft in your own email app. Nothing is submitted to us until you choose to send it, at which point we receive whatever you wrote, from your email address, in the ordinary way any email works.

Security

The site is served over HTTPS and enquiries are sent to our email provider over an encrypted connection. Access to the enquiry mailbox is limited to Neofelis Digital. No system is perfectly secure; if a breach of personal data we hold ever occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected people as the PDPA requires.

Standard server logs

Our hosting provider, Cloudflare, processes requests to the site and keeps short-term technical logs — including IP addresses — for security and abuse prevention. This is standard for any website. See Cloudflare's privacy policy at cloudflare.com/privacypolicy.

Third-party services

A small number of features load content from outside services. When they do, those services necessarily see your device's IP address, as they would for any website:

• Esri / ArcGIS — supplies the background map tiles on the regions and trip planner maps.
• unpkg — hosts the mapping and PDF-export libraries the site uses.
• Google Fonts — supplies the typeface used across the site.

None of these are analytics or advertising services, and we do not pass them any information about you.

The Android app specifically

The app carries a set of species photographs inside it so the guide works with no signal. Photographs not carried in the app are fetched from wildlifeofborneo.com when you are online, or can be downloaded in bulk using "Download Full Pack" and stored privately on your device.

The app asks for camera access — only requested if you choose to attach a photo to a sighting in My Sightings, or your own photo to a species page. Photos you attach are stored only on your device, never uploaded anywhere, and are deleted if you remove them or clear your sightings list.

The app asks for two further permissions: internet access, and — on Android 13 and above — permission to show notifications, used solely for the progress bar while the photo pack downloads. Declining the notification permission does not stop the download working. Beyond camera and notifications, the app does not request access to your microphone, contacts, files or location.

The Share button in My Sightings, the Trip Planner, and species pages opens the Android system share sheet with a text summary or image you can send to any app you choose (WhatsApp, Instagram, email, and so on). We never see what you share or who you send it to — that exchange happens entirely between you and the app you pick.

Submitting a species photo to us. On a species page, if you attach your own photo and tick "Also send this photo to Wildlife of Borneo," the app opens your phone's mail app with the photo already attached and addressed to wildlifeofborneo@gmail.com — this is the one place in the app where something you provide is sent to us, and it only happens if you explicitly opt in and then actually send the resulting email yourself. We use submitted photos only as described in the consent text shown at the time (possible use on this website, this app, and related future apps), and you can ask us to delete a submitted photo at any time — see Contact below.

Children

This is a general-audience wildlife guide. It is not directed at children and we do not knowingly collect information from anyone, including children.

Your rights

Under the PDPA you may ask us to tell you what personal data of yours we hold, to correct it, to delete it, or to stop using it, and you may withdraw consent for any use at any time. Email wildlifeofborneo@gmail.com from the address you used and we will respond within 21 days. Because we keep so little, this usually means finding and deleting the enquiry email copies. We cannot delete copies already delivered to a tour operator, so you would need to ask them directly.

Visitors in the EU, EEA and UK

If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or UK GDPR may also apply. Our legal bases are: your consent, when you send an enquiry, a photo or an email (you can withdraw it at any time); our legitimate interests, for anonymous usage statistics, keeping the site secure and stopping spam; and legal obligation, where the law requires us to keep or disclose data. You have the rights listed above, and also the right to object to processing based on our legitimate interests. Our providers (Cloudflare, Resend) protect data sent outside your region with standard contractual clauses. You may complain to your local data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk).

Related terms

Use of the site is also covered by our Terms of Use.

Changes to this policy

If this policy changes, the "last updated" date above will change with it.

Contact

Questions about privacy, or want a record deleted? Email wildlifeofborneo@gmail.com.