Privacy Policy

This policy explains what data Mushroom Minder collects when you use Mushroom Minder, why we collect it, who processes it on our behalf, and what control you have over it. We have tried to write it in plain language rather than legal boilerplate.

The short version: we collect what we need to run the software and bill for it, your grow records belong to you, we do not sell your data, and you can ask us to delete everything.

What we collect

Account information

Your email address, display name if you set one, a password hash or the identifier from the sign-in provider you chose, and your organisation or farm name if you enter one. If you are invited to someone else's account, we also store your role.

Your grow and business records

The content you enter: runs and their stage dates, contamination records, harvest weights, genetic lines, cultures and lineage, recipes and ingredients, label templates, product catalogs, sales records and their line items, notes and attachments. This is the data the Service exists to store.

Payment information

For paid plans, Stripe collects and processes your card details. We never see or store full card numbers. We store a customer and subscription identifier, your plan, billing period, billing country, the last four digits and card brand as returned by Stripe, and invoice records.

If you use point of sale features with your own Stripe or PayPal account, your customers' payment details are handled by those providers under their agreements with you. We store the sale record (items, amounts, timestamps, payment method type and a provider reference), not your customers' card data.

Technical and usage data

Server and error logs including IP address, timestamps, device and browser type, app version, and the pages or API endpoints requested. We use this to keep the Service secure and to diagnose faults. We keep the amount of analytics we collect deliberately small.

Support correspondence

If you email us, we keep the message and our reply so we have context next time you write.

Sensor data, where applicable

If you connect DIY environment monitoring hardware, we store the readings it sends: temperature, humidity, CO2 and device identifiers. This is measurement data about a chamber, not about a person.

Cookies and local storage

The application uses cookies and browser local storage that are necessary to keep you signed in and to remember basic preferences. This marketing website does not set advertising cookies and does not embed third-party tracking pixels. If we ever add analytics, we will update this policy and, where required, ask for consent first.

Why we process it

• To provide the Service — storing and displaying your records, printing labels, running reports. Basis: performance of our contract with you.
• To bill you — subscriptions and invoices. Basis: contract and legal obligation for tax records.
• To keep the Service secure and working — logs, backups, abuse prevention. Basis: legitimate interests.
• To support you — answering your questions. Basis: contract and legitimate interests.
• To send essential service email — billing notices, security alerts, material changes to terms. Basis: contract and legitimate interests.
• To send optional product email — only if you opt in, and every message includes an unsubscribe link. Basis: consent.

We do not sell personal information, we do not share it with data brokers, and we do not use your grow records to train models for other customers. We may publish aggregated, de-identified statistics (for example, typical contamination rates across all users) that cannot be traced back to you or your operation.

Who else processes your data

We use a small number of subprocessors. Each is bound by its own data processing terms and processes data only to provide its service to us.

Because Google Cloud and Stripe operate globally, your data may be stored or processed outside your country, including in the United States. Where required, these transfers rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism. We will tell you in this policy if we add a new subprocessor that handles your records.

We may also disclose data if we are legally required to, or to protect our rights, safety or property — and we will tell you unless we are prohibited from doing so.

How long we keep it

• Active accounts. Your records are kept for as long as your account exists, so that a run you logged four years ago is still there.
• After you delete something. Deleted records are removed from the live database immediately and fall out of encrypted backups within 30 days.
• After account deletion. Your account and records are deleted within 30 days of your request.
• Inactive free accounts. We may delete a free account with no sign-in for 24 months. We will email the address on the account at least 30 days before doing so.
• Billing records. Invoices and payment records are kept for as long as tax and accounting law requires, typically 6 to 7 years, even after account deletion.
• Server logs. Kept for up to 90 days, then deleted or aggregated.

Deleting your account

You can delete your account from your account settings in the app, or email support@mushroomminder.com from the address on the account and ask us to do it. We will confirm the request, complete the deletion within 30 days, and confirm when it is done.

Export first if you want to keep your records — deletion is permanent and we cannot restore an account afterwards. If you are a member of an organisation owned by someone else, deleting your own user does not delete that organisation's records; the account owner controls those.

Your rights

Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, and withdraw consent you have given. You also have the right not to be discriminated against for exercising these rights.

Email support@mushroomminder.com and we will respond within 30 days. We may need to verify that you control the account before acting on a request. If you are in the EEA or UK and are not satisfied with our response, you may complain to your local data protection authority.

Security

Data is encrypted in transit with TLS and at rest by our hosting provider. Access to production data is limited to the people who need it to operate the Service and is protected by multi-factor authentication. Database access rules restrict every record to the account that owns it. No system is perfectly secure, so if a breach affects your data we will notify you and any required regulator without undue delay.

Children

The Service is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will remove it.

Governing law

This policy is governed by the laws of [Your state/province and country], without prejudice to data protection rights you hold under the law of your own country.

Changes to this policy

If we make a material change — a new subprocessor handling your records, a new purpose for processing, or a longer retention period — we will email you or show a notice in the app before it takes effect. Minor clarifications will simply update the date below.

Contact

Privacy questions or requests: support@mushroomminder.com.

Last updated: August 14, 2026