THE FIELD GUIDE · OUR RESPONSIBILITIES
Privacy Policy
Last updated:
1. Who is responsible
The operator of Toadstool (toadstool.info) is responsible for the personal data processed to run this service. For privacy questions or requests, contact support@toadstool.info. This notice describes the current website and private field notebook.
2. Information used by the service
Accounts: your email address, authentication identifiers and session information. Supabase handles authentication and stores password hashes rather than readable passwords.
Notebook: species or working names, dates, place descriptions, nearby trees and notes you choose to save. The current notebook does not upload personal photographs or automatically attach device coordinates. Place descriptions you write can still identify where you have been.
Searches: mushroom names, search filters, a postcode you enter, and coordinates from a map selection or optional device-location request. You can use the map without creating an account.
Support and operations: messages you send us, and technical information such as IP addresses, request times and browser details processed by hosting and security services. Please do not add sensitive personal information about yourself or others to your notes.
Online counter: a random, short-lived browser identifier and activity timestamp are shared through a public Supabase Realtime channel to estimate how many browsers are exploring now. No account identifiers, email addresses, locations, searches or notes are included. Other clients can receive these anonymous presence values; the site displays only the total. We do not save a visitor history in our database. Supabase receives normal connection information, including your IP address.
3. Location and external requests
Device location is requested only after you choose Use my location and grant browser permission. The search centre is rounded to three decimal places before nearby and weather searches. This reduces precision but does not make a location anonymous.
Your postcode is sent through our server to Postcodes.io. Our server requests observations, habitat data and weather from the relevant providers using the search area. Those server-side requests do not deliberately forward your browser’s IP address to the data provider.
Map tiles from Esri and source-hosted photographs load directly in your browser. Those providers receive your IP address and normal request information; requested tiles can reveal the area of the map you view. Opening source links takes you to websites with their own privacy practices.
Searches are not automatically saved in your notebook. Search state is held for the current page session; provider responses may be cached on the server, and infrastructure may retain technical request logs. Avoid entering a private address or sensitive place unless needed.
4. Why we process personal data
We process account and notebook data to provide the service you request (performance of a contract). We use technical and support information for our legitimate interests in operating, securing and troubleshooting the service and answering enquiries. We may also process information when necessary to meet a legal obligation.
Device-location access is optional and controlled by your browser permission. You can revoke it in your browser settings and use a postcode or map selection instead. The site does not use your notebook for advertising or make it public.
5. Cookies and local storage
Authentication uses cookies to maintain and refresh your sign-in session. The site stores your light or dark theme preference in local storage under fungi-finder-theme. Clearing these may sign you out or reset your preference.
The current application does not include advertising trackers or an analytics script. External map, image and linked services operate under their own privacy notices. If we introduce optional tracking, we will explain it and obtain consent where required.
The public online counter uses local storage under toadstool-presence to avoid counting multiple tabs as separate visitors. The random identifier expires after 30 minutes without a refresh and is replaced on a later visit; an expired storage entry may remain on your device until replaced or cleared. Browsers with storage blocked may be counted per tab. Visible, recently active visits contribute to the approximate total; idle visits expire after three minutes and disconnected visits drop out as connections close.
6. Providers and public observations
Vercel hosts the website and server requests. Supabase provides authentication and stores account and notebook data; the project’s primary database region is London. Cloudflare provides DNS and routes support email. Support messages are also processed by the receiving email service. GoDaddy is the domain registrar; the application does not send it your notebook.
Data and imagery providers receive the requests described above. Public observation records may include observer names, credits, dates and locations already published by their source; these are separate from your private notebook. We may disclose information where required by law or necessary to protect rights and security.
7. Processing outside the UK
Although the primary notebook database is in London, hosting, delivery, support and external data services may process information in other countries. A UK database region does not guarantee that all processing stays in the UK. Contact us for information about the providers and transfer arrangements relevant to your data.
8. Retention and deletion
Saved notes, including archived notes, remain associated with your account until permanently deleted. Archiving changes their visibility in your own notebook and does not erase them. Ask support@toadstool.info to delete notes or your account.
We keep support correspondence and operational records only for as long as needed to resolve enquiries, maintain security and meet applicable obligations. Infrastructure logs, cached responses and any backup copies follow the relevant provider’s configured retention and deletion processes; deletion from the live notebook is not a promise of immediate removal from every backup. Contact us for retention details relevant to a request.
9. Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction or a portable copy of your personal data, and object to processing based on legitimate interests. Email support@toadstool.info. We may need to verify your identity; we normally respond within one month and will explain if a lawful extension is needed.
You can edit your notes and export the currently loaded entries in the notebook. Ask us for a complete export if you have more than the 500 entries loaded by the interface. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.
10. Security and children
The website uses HTTPS and account-based access controls. Notebook database policies restrict routine app access to the account that owns each entry. Authorised service administration may require access for support, security or legal obligations; no online service can guarantee absolute security.
Toadstool accounts are not intended for children under 13. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.
11. Changes and contact
We will update this notice when the service or its data practices change and explain significant changes on the site. Contact support@toadstool.info for privacy questions, corrections or requests.