Privacy

The controller of your data is the person who provides the service. For any question about your data, write to this address.

For an account we keep your email address, your name if you give it and an encrypted password. If you sign in with Google or Apple, we keep the identifier they give us, not a password.

We also keep what you add: the places you mark on the map, the species you follow, your province if you give it, the language you opened the account in and what you agree to receive by email.

The areas you mark on the map are yours and are never published. A mushroom spot is sensitive information and is treated as such.

If you apply to join the affiliate programme, we keep what you send in the application to consider it and reply to you.

When you open an account we keep how the visit you opened it in began: the site that sent you, the campaign tags on the link (utm) and, if you came from an ad, the click identifier the ad network adds (Google, Meta, Microsoft or TikTok). It tells us which channels bring people and which are not worth spending on.

That identifier only leaves us with your permission, which we ask for when you open the account and you can change in your profile: with it we tell the ad network that the click led to a sign-up or a subscription, to measure the ad. We send only the click identifier and what happened — never your email, your name or your places.

If you came through someone’s link — a friend or a creator we work with — we also keep whose it was: the friend gets their days of Pro and the creator is paid a share of what you pay. The creator only learns how many accounts and payments their link brought, never who you are.

We count which pages are visited and what is used — opening the map, saving a place — with PostHog, on its servers in the European Union, which processes this data on our behalf. No cookies and nothing stored in your browser: a visitor without an account is recognised for one day only, by a code computed from the date, the IP address and the browser; the code changes every day.

With an account, events are tied to your account number — never to your email or name — along with your plan, your language and how you found us. PostHog receives the IP address to work out the approximate country and city. If you close your account and want its statistics deleted too, write to us.

For accounts we also keep an activity log of our own: which pages you opened, what you saved or changed and what you pressed on the map, with the time, the IP address and the browser. We use it to answer your support questions, find bugs and protect accounts from abuse. Each entry is kept for 180 days and then deleted.

We write to confirm your account, to recover your password, to tell you when your Pro trial starts and ends, and about your subscription. These are service emails, part of what you signed up for.

The weekly digest and the alerts reach you only if you tick them, and you can unsubscribe without losing your account. Email is sent through an outside provider, which sees your address because it has to deliver the message.

If you subscribe, payment is handled by Link (Stripe), which acts as the seller and processes your payment data as a controller, under its own privacy policy (link.com/privacy). We never see or store your card details.

From Stripe we receive only what we need to give you Pro: a customer and a subscription identifier, the plan, its status and its dates.

The account, the trial, the subscription and their emails rest on the contract you accept when you sign up. The weekly digest and the alerts rest on your consent, which you can withdraw at any time. Usage statistics and the account's origin rest on our legitimate interest in knowing what works, with as little data as possible. The activity log rests on our legitimate interest in supporting the service and protecting accounts. Telling an ad network that its click led to a sign-up rests only on your consent.

We do not sell data and there is no advertising. An ad network receives only the identifier of one of its own clicks, and only with your permission.

We keep the data while you have an account. When you close it, it is really deleted, with everything attached to it, except the activity log: its entries run their 180 days, in case a question or a dispute needs them, and are then deleted. Records of the charges are kept by Stripe, as the seller, for as long as the law requires.

Some providers, such as Stripe, may process data outside the European Economic Area; they do so with the safeguards the GDPR requires.

You can ask for a copy of your data, correct it, take it with you, object to a use of it or have it deleted by writing to us. The account can also be closed from your profile.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).