Privacy Policy

The short version

• You don’t need an account. Spore has no sign-in and asks for no name or email address.
• Photos you identify are sent through our server to our identification provider, Kindwise. We don’t store them.
• Your journal, saved photos and the locations of your finds stay on your device. We never receive them.
• A random install ID and your IP address are used only to enforce daily usage limits and prevent abuse.
• Purchases are handled by Apple and verified by RevenueCat. We never see your payment details or Apple ID.
• No analytics, no advertising, no tracking across apps or websites, and we never sell your data.

Who is responsible for your data

The data controller is Björkén Media AB, a company registered in Sweden, which develops and publishes Spore (“we”, “us”, “our”). You can reach us about anything in this policy at hello@sporeapp.co.

What the app processes, and why

1. Photos you identify

When you ask Spore to identify a mushroom, the photo is compressed and sent over an encrypted (HTTPS) connection to our server, which forwards it to Kindwise (operated by FlowerChecker s.r.o., Czech Republic). Kindwise analyses the photo and returns a list of possible species, which Spore matches against its own species guide. Our server passes the photo straight through and does not save it. We do not send your location, name or any account details with the photo.

Kindwise processes the photo in order to provide the identification and keeps a record of each identification, including the photo, under its own retention rules. Its handling of images is described in the Kindwise privacy policy.

Legal basis: performance of a contract (GDPR Art. 6(1)(b)) — providing the identification you asked for.

2. Install ID and IP address (fair use and abuse prevention)

The first time you open Spore, the app creates a random identifier (an “install ID”). It is stored in the iOS Keychain on your device and is not synced to iCloud; because of how the Keychain works, it may remain if you delete and reinstall the app. The install ID and the app version are sent with identification requests.

Our server counts identification requests per install ID and per IP address for each day, so that we can enforce fair-use limits and protect the service from abuse and automated traffic. These counters are not linked to your name, Apple ID, email address or purchases, and they are never used for advertising, profiling or tracking. We delete them after no more than 30 days.

The free plan’s daily identification allowance is counted on your device and does not involve sending any additional data.

Legal basis: our legitimate interests (GDPR Art. 6(1)(f)) in keeping Spore secure, available and affordable to run.

3. Species we don’t recognise yet

When an identification suggests a species that isn’t yet in Spore’s guide, the app sends that species’ scientific and common name to our server so we know what to add next. We store only the species names — not your photo, location or install ID.

4. Purchases

Spore Premium is sold through Apple’s App Store. Apple processes the payment; we never receive your name, Apple ID, payment method or billing address. We use RevenueCat (RevenueCat, Inc., USA) to validate purchases and keep track of whether Premium is active. RevenueCat receives an anonymous user ID created by the app, your App Store purchase and subscription history for Spore, and basic technical information needed to process the request (such as app version, device platform, App Store country and IP address). See the RevenueCat privacy policy and Apple’s privacy policy.

Legal basis: performance of a contract (GDPR Art. 6(1)(b)) — giving you the Premium features you paid for.

5. Species guide, images and maps

The app downloads its species guide from our server, and species pictures from Wikimedia Commons (Wikimedia Foundation, USA) and from our own image storage on Cloudflare R2 (Cloudflare, Inc., USA). Maps are provided by Apple Maps. As with any internet request, these services receive your IP address and standard technical request information; the app does not send them any personal data about you. See the Wikimedia Foundation privacy policy and Cloudflare privacy policy.

6. Data that stays on your device

The following data is stored only on your iPhone. It is never uploaded to us, and we cannot see it:

• your journal: finds, notes, dates and photos you save;
• the location of your finds. Spore only uses location “While Using the App”, to tag a find and show it on your map. You can choose “Approximate” mode in Settings, which rounds saved coordinates to roughly 1 km. If you pick an existing photo from your library, Spore may read the location embedded in that photo to tag the find — again, on your device only. To show a place name for a find, Spore asks Apple’s geocoding service to look up the saved coordinates (already rounded to roughly 1 km in Approximate mode); Apple handles these lookups under its own privacy policy and does not link them to your Apple ID;
• finds saved while offline and waiting to be identified;
• your settings and the downloaded species guide.

We cannot access this data. It is deleted when you delete it in the app or uninstall Spore. If you back up your iPhone (for example to iCloud), the backup may include it; backups are handled by Apple under its own privacy policy. You can withdraw camera or location access at any time in iOS Settings.

7. Technical server logs

Like every web service, our hosting providers automatically process technical logs (IP address, time, requested address, app or browser version) to deliver requests, keep the service secure and troubleshoot problems. These logs are kept only for a short period under the providers’ standard retention.

Legal basis: our legitimate interests (GDPR Art. 6(1)(f)) in operating a secure service.

The sporeapp.co website and email

Waitlist and product updates

If you enter your email address on sporeapp.co to be notified about Spore, we store it with our email provider Loops (Loops.so, Inc., USA) and use it only to send you news about Spore. You can unsubscribe at any time using the link in every email or by writing to us.

Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time. We keep your address until you unsubscribe or ask us to delete it.

Cookies and analytics

The website does not use analytics, advertising or tracking cookies, and its fonts are served from our own domain. The site is hosted by Vercel (Vercel Inc., USA), which processes technical server logs as described above.

When you email us

If you contact us, we use your email address and message to reply and help you. We keep the conversation for as long as needed to resolve your request and no longer than 24 months afterwards, unless we need it to establish or defend legal claims. Legal basis: our legitimate interests (GDPR Art. 6(1)(f)) in answering your questions.

What we don't do

• We don’t sell or rent personal data to anyone.
• We don’t include analytics, crash-reporting, advertising or tracking SDKs in the app.
• We don’t track you across other companies’ apps or websites.
• We don’t receive, store or share your foraging spots.
• We don’t use your photos for anything other than returning the identification you asked for.
• We don’t make automated decisions about you that have legal or similarly significant effects.

Service providers we use

We share data only with providers that help us run Spore, and only what each needs to do its job:

• Vercel — hosting for our server (which relays identification requests and serves the species guide) and for this website.
• Neon — managed database where the species guide and the daily rate-limit counters are stored.
• Kindwise (FlowerChecker s.r.o., Czech Republic) — photo identification.
• RevenueCat — purchase validation and Premium status.
• Apple — App Store distribution and payments, Apple Maps, and place names for your finds.
• Cloudflare — storage and delivery of species images (R2).
• Wikimedia Foundation — species images and reference articles.
• Loops — waitlist and product-update emails (website only).

We may also disclose data if required by law or to protect the safety of our users or others.

How long we keep data

• Identification photos: not stored by us. Kindwise keeps its records of identifications, including the photo, under its own privacy policy.
• Install-ID and IP-address request counters: no more than 30 days.
• Technical server logs: a short period, under our hosting providers’ standard retention.
• Purchase records at RevenueCat: as long as needed to provide your Premium access and to meet legal obligations. Apple keeps its own records of your purchases.
• Waitlist email address: until you unsubscribe or ask us to delete it.
• Support emails: up to 24 months after your request is resolved.
• On-device data: until you delete it or uninstall the app.

International transfers

Some of our providers are based in, or process data in, the United States or other countries outside the EU/EEA. When personal data is transferred outside the EU/EEA, we rely on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework, for providers certified under it) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards at hello@sporeapp.co.

Your rights

Under the GDPR and similar laws, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our processing, including processing based on our legitimate interests;
• receive data you gave us in a portable format;
• withdraw your consent at any time (for example, by unsubscribing from emails).

To use these rights, email hello@sporeapp.co. We’ll respond within one month. Because Spore has no accounts, we usually cannot connect server-side data (such as rate-limit counters) to you as a person; those counters are deleted automatically within 30 days. Data on your device is fully under your control — delete it in the app or uninstall Spore.

You also have the right to lodge a complaint with a data protection authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You can also contact the authority in the EU/EEA country where you live or work.

If you live in California: we do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and you may exercise the rights above by emailing us.

Security

All connections between the app, our server and our providers use encryption in transit (HTTPS). We keep the data we hold to a minimum, restrict access to it, and protect our server against abuse.

Children

Spore is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data (for example, by signing up to our email list), contact us and we will delete it.

Changes to this policy

We will update this page if the way we handle data changes, and update the effective date at the top. If a change is significant, we will make it clearly visible on this page and, where appropriate, in the app before it takes effect.

Contact

Björkén Media AB, Sweden. Email: hello@sporeapp.co. See also our Terms of Use and Support page.