1. What Hydroscape is
A freshwater biodiversity recording platform. A species sighting, a water quality observation, a roost or colony count, a deterrent action: all of them recorded from a phone at the bank, in 23 languages, with no account and no charge.
Every record is made the same way whatever it is of. The same two fields are fixed by the server, the same rules refuse the same things, photographs are handled identically, and identity is separated from the observation by the same process. That is what this page describes, and it holds for a kingfisher and a water sample exactly as it holds for a cormorant.
The streams differ only in how much is in them. As at 11 October 2026 the cormorant register held 12,798 reports covering 75,302 birds, the biodiversity register 174 records and the water quality register 7. The cormorant figures are much the larger because that is where the reporting effort has gone so far, not because those records are made or treated differently.
Outputs from the platform are used in evidence. Natural England accepts them as supporting information for a licence application, which is acceptance and not endorsement, and the distinction is theirs. The Environment Agency has described the platform as a helpful tool. A European roost and colony count is under discussion for the coming winter.
The platform is built and run by Hydroscape-Group Ltd, a company registered in England and Wales and registered with the Information Commissioner's Office. Data is held in Google Cloud in London.
2. What this page is
Two fields on a Hydroscape record are fixed by the server and cannot be set by the person submitting it. Everything else is what the observer says they saw. This page is about which is which, and about what follows from that.
It sits underneath the two method notes rather than beside them. Hydro-Vericount and HydroRoost each describe how a figure is derived from records. This describes how a record is made in the first place, what the platform fixes, what it refuses, what it checks automatically, and what it cannot establish at all.
It is written for people deciding whether to point their counters, their members or their staff at the platform, and for anyone who needs to say in writing what the data is worth.
3. The five forms
| Form | Unit recorded | Photograph |
|---|---|---|
| Biodiversity sighting | Individuals of any species | Required |
| Water quality | Observed conditions and instrument readings | Optional |
| Cormorant sighting | Birds seen, with activity | Optional |
| Roost and colony count | Birds at a roost, or nests at a colony | Required |
| Deterrent log | Action taken, and the response | Optional |
The biodiversity sighting and the roost and colony count will not submit without a photograph. A species claim and a site claim are the two things a photograph can actually corroborate, so those are the two forms where it is a condition of filing rather than a request. A bird counted at two hundred metres across open water often has nothing worth photographing, and refusing those reports would lose the count to gain an unusable image.
All five run in a browser in 23 languages, work without a signal and upload when one returns, and require no account. A person can create an account to keep their own records together, and nothing about the record changes if they do not.
4. Who supplies each field
This is the distinction that matters most and it is the one most platforms leave vague.
| Field | Source | Can the submitter choose it |
|---|---|---|
| Submission time | Server clock, at the moment of write | No |
| Account identifier | The authenticated session | No |
| Observation date and time | Observer | Yes, within limits |
| Position and what3words | A tap on the map, at the subject | Yes |
| Count, species, activity, conditions | Observer | Yes, within limits |
| Photograph | Observer | Yes |
| Automated species reading | Written by the server after submission | No |
| County | Derived server-side from the position | No |
The position is placed by hand. The form can locate the device and still asks for a tap on the map, because the record is of where the birds were and not of where the observer was standing when they filled the form in. A pin dropped at home later would be a wrong record, and the deliberate tap is what stops the easy version of that happening by default.
The submission time is pinned to the server clock on every one of the five forms, so a record cannot be back-dated by changing a device clock. The observation time is a separate field and is whatever the observer states. Both are kept and both are shown, which is the point: a report of something seen three weeks ago that was submitted today is visible as exactly that.
5. What the server refuses
Validation is enforced in server-side rules rather than in the page, so it applies to anything that writes to the database and not only to someone using the form as intended.
- A record whose submission time is not the server's own time is refused.
- A record attributed to an account other than the one submitting it is refused.
- An observation dated in the future is refused. People were reporting birds they had not yet seen.
- A count above a ceiling is refused: 10,000 on the cormorant forms, 100,000 on biodiversity.
- Per-activity counts that do not add up against the total count are refused.
- A record arriving with the automated reading, the county or the stored image already filled in is refused. Those fields are the server's to write.
None of this makes an observation true. It makes the record internally consistent and stops the fields the platform is responsible for being supplied by whoever is submitting. The honesty of the observation itself is covered in section 11.
6. The photograph
A photograph is stripped of its embedded metadata before it leaves the phone. The image is redrawn through a canvas and re-encoded, which discards the EXIF block and with it any GPS coordinates the camera wrote into the file. The position on the record is the one the observer gave, not one lifted silently from the image.
On the server the file is typed from its own first bytes rather than from the type the submitting device declared. A device can claim anything; the bytes cannot.
7. What Hydro-Vision AI confirms
Where the observer allows it, the photograph is passed to Hydro-Vision AI. Hydro-Vision AI is Hydroscape's name for this step rather than for the model behind it: the assessment is made by an outside AI service acting on Hydroscape's instructions, and the privacy notice names that service and sets out what it receives. A primary model does the assessment with a second standing by, and which one produced a given verdict is recorded against that record and carried into any report that prints the column. A verdict can therefore always be traced to the thing that made it, and two verdicts made months apart can be told apart. Nothing is sent where the observer declines, and the record is accepted either way.
The reading answers one question: is the species visible in this photograph. Where a report prints it as a column, the column carries an asterisk and this footnote:
Confirms the species identified and its presence in the photograph supplied with the report.
What it does not do is as important. It does not confirm that the photograph was taken at the place the record gives, or on the date the record gives, or that the number of birds in the photograph is the number the observer counted. A photograph showing one cormorant alongside a count of forty is not a contradiction, because the observer was counting a flock and photographing part of it.
On the forms where a photograph is optional, a record filed without one is recorded as having no photograph. It is not recorded as a negative result and it is not treated as a lesser record. A phone camera at two hundred metres produces nothing worth assessing, and a count is still a count.
The reading never alters a submitted count and never overwrites an observer figure. Both are stored and both are shown.
8. Identity
Reporter name, email address and mailing name are moved out of the world-readable record into a separate restricted collection by an automatic process, and a nightly sweep re-checks for any that were missed. The ecological record, meaning position, count, species, date and photograph, stays public. The identity does not.
An email address is only captured at all when the person ticks the box asking for it. Untick it and the address is not sent, not stored and not added to any list.
Addresses are masked in the platform's own logs.
What remains attached to a public record is the account identifier of the person who filed it, where they filed it from an account. It carries no name and no contact details, and it is stable, which means two records from the same account can be seen to be from the same account. That is a deliberate trade: it is what lets a coordinator trace a figure back to the reports behind it, and it is stated here rather than left for someone to discover.
9. What is deliberately not published
Roost and colony locations are not shown on the public map and will not be. A communal overnight roost can be emptied in a morning by anyone who knows where it is, and publishing a national map of them would do more harm than the openness is worth.
Roost and colony records are held, counted and reported. They are provided to coordinators, researchers and statutory bodies on request. They are simply not drawn on a public page.
Sightings tagged with roosting behaviour are a different thing and are published. In the sighting sense roosting means a bird sitting about during the day after feeding, which discloses nothing about where it spends the night.
10. Records that can be changed, and the trail
A submitted public report cannot be edited by the person who filed it. Corrections are made by asking.
Licence return records, which are the ones that go to a regulator, are locked on submission and can only be amended by an administrator. Every amendment is written to an append-only trail as a before and after comparison, including amendments made directly in the database rather than through the application. The trail is readable by the licence holder and by an administrator, and is writable by nobody.
11. Limitations
These apply to every figure the platform produces. The per-method limitations are listed separately on the Hydro-Vericount and HydroRoost pages and are not repeated here.
- The observation date, time and position are supplied by the observer and the platform cannot verify any of them. The server submission time is recorded alongside, so a back-dated report is visible as a gap, and that is the whole of the control.
- Coverage follows reporting effort. An area with no records means nobody reported there, which is not the same as nothing being there, and the two are indistinguishable in the data. This is about the gaps, not the pins: the positions that exist were placed deliberately at the subject.
- Observer skill varies, is not assessed and is not corrected for. No detection probability is applied to anything.
- Water quality instrument readings are whatever the observer's device reported. Hydroscape does not calibrate, check or certify them, and they are stored as supplied.
- The automated reading is evidence about a photograph and nothing else. It is not evidence about the record the photograph is attached to.
- A report produced on a given day cannot currently be re-verified against the records as they stood on that day. Records can be added or corrected after a report is generated, so two reports run months apart over the same period may differ. Stable record identifiers and a manifest are planned and do not yet exist.
- Hydro-Vericount takes the highest figure in each cell within a calendar month and adds those across cells. Those highest figures are not necessarily from the same day, so the total is a minimum for the month rather than a count of birds present at any one moment.
- The account identifier on a public record is stable, as set out in section 8.
12. How the platform is checked
An automated audit runs against the live production infrastructure and tests access control, transport security, headers, authentication and data handling. It is written and run by Hydroscape, so it is a self-assessment rather than an independent one, and the distinction matters. What makes it worth anything is that it is reproducible: it probes the live site rather than a checklist, it reports every assertion including the ones that fail, and the script can be handed to anyone who wants to run it themselves. The current report is available to any organisation that asks.
The two derivation methods are published in full with their parameters, their calibration and their failure modes, and are served unminified so anyone can read the implementation and argue with it.
13. Getting the records
There is no charge. Not for the apps, not for an account, not for the data, and there is no paid tier that unlocks anything described on this page.
Contributors export their own records at any time. Aggregate figures are published on the live data map. A coordinator running an organised count is issued a group identifier so their returns can be retrieved cleanly while still contributing to the same dataset, and the identifier is never written to the record. Where a research group, national organiser or statutory body needs the underlying records, those are supplied on request at no cost and in whatever format is useful.
14. Citation
Hydroscape-Group Ltd (2026). The Hydroscape record standard, version 1. Available at https://www.hydroscape-group.co.uk/record-standard.html
Figures taken from Hydroscape should be quoted with the period and area stated, and with the qualification set out in whichever method note produced them.