Last updated: 26 September 2026
This Privacy Policy explains how Mushby ("Mushby," "we," "us," or "our") collects, uses, and shares information when you visit https://mushby.app (the "Website") or use the Mushby mobile and web applications (collectively, the "App"). Mushby is an AI-powered mushroom identification companion that offers photo identification, chat, insights, and personalized features.
By accessing or using the App or Website, you agree to this Privacy Policy and our Terms of Use. If you do not agree, please do not use Mushby.
1. Information We Collect
- Account and Profile Information: Email, username, and password when you register. We also support OAuth sign-in via Apple and Google; we receive identifiers needed to authenticate but do not obtain your social media content. We also support anonymous accounts that may later be converted to registered accounts.
- Authentication Data: We maintain an authentication token to keep you signed in. On mobile, this token is stored in secure device storage.
- Identification Photos and Location: When you identify a mushroom, we upload the photo you take or select to our backend and to a third-party AI model provider for analysis. With your permission, we also read your device's precise GPS location at the moment of identification and store those coordinates together with the photo and result in your identification history, linked to your account, so you can revisit where a find was made. You can deny location access and still identify mushrooms; the coordinates are simply omitted.
- Content You Provide: Chat messages, prompts, conversation titles, notes, likes/collections, and any images you send in chat.
- Device and Usage Information: Device model, OS version, app version, IP address, language, in-app events, and general interaction data.
- Crash and Performance Diagnostics: Crash reports, error traces, and performance data (via GlitchTip) to help us troubleshoot and improve stability. These are linked to your account ID so we can reproduce account-specific issues.
- Push Notification Tokens: If you enable notifications, we collect a device push token (Firebase Cloud Messaging) to deliver them. You can disable notifications in your device settings.
- Purchase Information: Subscription and purchase status, entitlement information, and related identifiers necessary to provide paid features and restore purchases, managed through RevenueCat. In-app purchases are processed by Apple App Store or Google Play. Mushby does not receive full payment card details.
- Install Attribution: We use Tenjin to understand which marketing campaign led to an app install. On iOS this relies on your device's advertising identifier and requires your consent through Apple's App Tracking Transparency prompt; you can decline it at any time in your device settings.
- Advertising and Identifiers: We show ads through Google AdMob. AdMob may collect or access advertising identifiers (e.g., IDFA/GAID), general device identifiers, and a coarse, IP-based location estimate to select and measure ads. Where required, we request consent and honor your platform ad settings.
- Cookies and Similar Technologies (Website): We use cookies and similar technologies on the Website for essential functionality, analytics, and preference storage. Your browser may offer controls to manage cookies.
2. How We Use Information
- Provide, operate, and improve the App and Website
- Authenticate users, maintain sessions, and secure accounts
- Deliver chat and personalization features
- Process purchases, manage entitlements, and restore access
- Measure performance and usage (analytics) and improve quality (crash logs)
- Show ads (where applicable) and measure ad performance, subject to consent where required
- Send service communications, updates, and, where permitted, marketing messages
- Comply with law, enforce terms, and protect the rights, safety, and security of users and the service
3. Legal Bases (EEA/UK users)
Where GDPR or similar laws apply, we rely on one or more of the following legal bases: performance of a contract, legitimate interests (e.g., to secure and improve the App), consent (e.g., cookies/ads where required), and compliance with legal obligations.
4. Sharing and Disclosures
We do not sell your personal information. We may share information with:
- Service Providers: To host, process, and operate the App (e.g., backend, analytics, crash reporting, messaging, ads, payments/subscriptions).
- Backend: Our API and database services, built on PocketBase, to store accounts, chats, identification history (including photos and, where you allow it, GPS coordinates), and content.
- Third-Party AI Model Providers: We send the photos you submit for identification (through OpenRouter, our AI gateway) to third-party AI model providers so they can analyze the image and return an identification. These providers process the photo to generate the result and do not use it to build a profile about you.
- Analytics: Google Firebase Analytics to measure usage and improve the App. Analytics events are linked to your account ID.
- Crash and Performance Monitoring: GlitchTip to record crash reports and performance diagnostics, linked to your account ID so we can troubleshoot issues you report.
- Advertising Partners: Google Mobile Ads (AdMob) to show and measure ads, which may receive advertising and device identifiers and a coarse, IP-based location estimate (subject to consent where required). We use industry-standard consent tooling where applicable.
- Attribution Partners: Tenjin, to attribute an app install to the marketing campaign that led to it, using your device identifier (on iOS, only after you grant App Tracking Transparency permission).
- Subscription and Purchase Processing: RevenueCat to manage entitlements, link purchases to your account, and restore access.
- Authentication: Apple and Google for optional sign-in.
- Legal/Compliance: If required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset transfer.
5. Cookies and Choices
On the Website, you can manage cookies via your browser settings. Mobile platforms provide settings to reset or limit advertising identifiers (IDFA/GAID). We do not respond to "Do Not Track" signals. In supported regions (e.g., EEA/UK), we use consent dialogs for non-essential cookies/analytics and ad personalization where legally required. You can update your choices at any time via the Website's cookie preferences link.
6. Data Retention
We retain information as long as necessary to provide the App, comply with law, resolve disputes, and enforce agreements. Retention varies by data type, account status (e.g., active vs. deleted), and legal requirements.
7. Your Rights
Depending on your location, you may have rights to access, correct, delete, or port your data; object to or restrict certain processing; and withdraw consent where processing is based on consent. You can permanently delete your account and its data at any time in the App under Profile > Account > "Delete Your Account", or by contacting us at the email below. If you delete your data, some features may no longer work. You may also have the right to complain to a supervisory authority.
8. Security
We use technical and organizational measures appropriate to the risk (e.g., secure storage for tokens, encryption in transit) to protect your information. No method of transmission or storage is fully secure.
9. International Transfers
We may process and store information in countries outside your own. Where required, we implement appropriate safeguards for cross-border transfers, such as the European Commission's Standard Contractual Clauses for transfers to countries without an adequacy decision.
10. Children's Privacy
Mushby is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). If you believe a child has provided information, contact us and we will take steps to delete it.
11. Changes to This Policy
We may update this Privacy Policy. We will post updates here and update the "Last updated" date. Material changes will be communicated as required by law.
12. Contact Us
If you have questions or wish to exercise your privacy rights, contact us:
Email: [email protected]
Links: Terms of Use, Privacy
13. California Privacy Rights (CPRA)
California residents have the right to know, access, correct, delete, and port certain personal information, and to opt out of the sale or "sharing" (cross-context behavioral advertising) of personal information. We do not sell personal information. To the extent our use of advertising partners constitutes "sharing," you may opt out by contacting us at [email protected] with the subject "CPRA Opt-Out." Where supported, we will honor applicable opt-out preference signals (e.g., Global Privacy Control) as required by law.