Open the app →Privacy policy
In short: no adverts, no tracking cookies, no third-party analytics, and your locations are never sold or shared with other users. We keep simple first-party visit counts (see section 2). Your finds and private points stay on your device, and in your own account if you sign in, where only you can read them. To work out conditions, the app sends the coordinates you choose to public data services. Those requests don’t include your name or email.
1. Who is responsible
MycoField (“we”) is the data controller for the personal data described here. Contact: help@mycofield.com.
2. What we collect and why
| Data | Why | Legal basis (UK GDPR) |
|---|---|---|
| Your email address | To sign you in and link your paid access to you | Contract |
| Your saved areas, finds and blanks, including any private coordinates you attach | To back them up and sync them between your devices, but only if you sign in | Contract |
| Payment record (Stripe checkout ID, amount, date, email) and your access end date | To give you access, handle refunds and keep accounts | Contract; legal obligation (tax records) |
| Photos you identify with “Snap to identify”, the result, and (if you leave the option on) the device location when you took it | To identify the mushroom and keep your finds in your account so you can track them. Photos and pins are stored privately: only you can see them, no other user and not us in the console. The photo is re-encoded in your browser, so location data inside the image file is removed; the pin is only what you choose to attach | Contract; your choice for the pin |
| If you buy spot credits: your credit balance and expiry, and which spots you revealed and when | To give you the credits you paid for, show you your spots, and keep each spot to 5 people a week | Contract |
| If you bought the earlier spot pack: the postcode or place you gave and the spots picked | Kept only so you can still see those spots; your pack was converted to credits | Contract |
| Simple visit statistics: which steps of the app are used (for example opening a spot, signing in, viewing the price), a random session id, the device type and the website you came from. When you are signed in, they are linked to your account. They never include your location, photos or notes | To see whether the app works and where people get stuck, and to keep it running | Legitimate interests; we delete these after 90 days |
| Basic technical logs kept by our hosting and database providers (IP address, time, request) | Security and keeping the service running | Legitimate interests |
We don’t collect card details (Stripe handles them), and we don’t use third-party analytics, advertising or tracking cookies. We do count visits and key steps ourselves (see the visit statistics row above). The app stores your data and sign-in session in your browser’s local storage so it works offline. These are strictly necessary for the app to work and aren’t used for tracking.
3. Services that receive data
- Supabase stores accounts, synced data and access records, and sends sign-in emails from our own mailbox, hosted by Spacemail (Spaceship).
- Stripe takes payments. See Stripe’s own privacy policy.
- postcodes.io turns a postcode you give us for “a spot near you” into a map position. We keep that email and postcode with the spot we pinned for you for 14 days, so it can open when you sign in, then delete it on request.
- Kindwise identifies mushrooms from a photo. When you use Snap to identify, the photo is sent to Kindwise through our server (never with your name, email or location) and is not stored by us for this purpose beyond your saved find. See Kindwise’s own privacy policy.
- Anthropic (Claude) answers questions in the in-app assistant. Only when you ask a question, we send it with a snapshot of what the app is showing you: your areas’ names, scores, weather forecast, terrain and habitat notes, your recent field records (date, result, area) and the names, dates and areas of your recent photo finds. Your photos, coordinates and email are never sent. Anthropic doesn’t use it to train its models. We keep a daily count of questions per account to limit use.
- Vercel hosts the app.
- Data services that receive coordinates only: when you analyse a spot or search, your browser sends the coordinates or search text to Open-Meteo (weather and elevation), OpenStreetMap (map tiles, Overpass habitat, Nominatim search), postcodes.io, Natural Resources Wales (DataMapWales), Natural England / Defra / Rural Payments Agency and NatureScot (map services hosted by Esri ArcGIS). Like any website, these services see your IP address. We don’t send them your email or account.
- Map imagery: OpenStreetMap serves the street map, Esri (ArcGIS) the satellite imagery, OpenFreeMap the place names shown over it, and AWS Open Data the terrain tiles. Your browser fetches these directly, so like any online map they see your IP address and which areas you look at, but nothing about your account.
- Google Fonts serves the app’s fonts. Overpass (OpenStreetMap), Open-Meteo, Esri, OpenTopoMap, Nominatim and postcodes.io receive the map area, point or place you ask about in order to return weather, habitat, map images and search results.
Some of these providers process data outside the UK, including in the USA. Where they do, the transfer is covered by UK adequacy regulations or standard contractual clauses.
4. How long we keep it
- Account and synced data: until you delete your account (Account tab → Delete my account, or email us) or it has been inactive for three years.
- Payment records: six years, as UK tax law requires.
- Data on your device: until you clear it or uninstall the app.
5. Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it. The app can export all your records at any time (History → Export). Email help@mycofield.com for anything else, and we will reply within one month. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
6. Children
MycoField is not aimed at children under 13, and paid accounts are for adults.
7. Changes
If we change this policy, we’ll update the date above and, for significant changes, tell signed-in users in the app.