Privacy Policy

Revision of August 12, 2026

1. General

This Privacy Policy describes how SAMPLIFY FZCO (the Operator) collects, uses, and protects personal data of users of Mushroom Checker at https://checker.skyforest.ai.

Operator address: UAE, Dubai, Dubai Digital Park, Dubai Silicon Oasis, Building A2, office 101. By using the Service you consent to this Policy.

2. Data we collect

• Name and email address
• Payment metadata processed by Stripe (PCI DSS Level 1). We do not store card numbers.
• User content: photos you submit for mushroom identification
• Technical data: IP address, browser, device type, session information
• Cookies and similar technologies. Analytics cookies exist only on the website; the mobile app stores none

3. Purposes

• Providing and improving the Service
• Processing subscription payments and account management
• Customer support and security
• Analytics on the website: understanding which pages are used and where they fail. The mobile app has no analytics at all (see section 4.3)

4. Who we send data to

We do not sell or rent your personal data, and we do not share it for advertising. The Service does, however, rely on other companies: hosting, payments, mushroom recognition, maps, weather, analytics. All of them are listed below — what is sent, why, and whether it is sent by our server or straight from your device. That difference matters: when the request comes from your device, the recipient also sees your IP address.

4.1. Sent by our server

Here the request comes from our server, so the recipient does not see your IP address.

• Supabase (EU, United States) — database, sign-in, and file storage. Everything you save in the Service lives here.
• Vercel (United States) — website and backend hosting. Your IP address and request records end up in technical logs.
• Kindwise (Czech Republic) — mushroom identification — without it the app has no purpose. Only the photo itself is sent: our server strips the image metadata, including GPS coordinates, before it leaves us. Your name, email, and user ID are not sent.
• iNaturalist (United States) and GBIF (Denmark) — reference data and photos about the species you identified.
• Apple and Google — verification of subscription receipts: the purchase identifier and your identifier in that store.
• Google (Gmail mail service) — sending transactional email: the recipient address and the message itself.
• Stripe — card payments on the website (PCI DSS Level 1). We never receive or store card numbers.

4.2. Contacted directly by your device

These requests leave your device, so the recipient sees your IP address and details about your browser or app.

• Supabase — the app reads and writes your own data directly, without a middleman.
• Yandex Metrica and Google Analytics — analytics, and only when you use the website in a browser. The mobile app does not load them at all; see section 4.3.
• Google and Apple — if you sign in with their accounts. They pass us the email address and name from that account.
• App Store and Google Play — when you buy a subscription inside the mobile app.

4.3. Analytics

On the website we run two analytics counters: Yandex Metrica (Yandex LLC, Russia) and Google Analytics (Google LLC, United States). They receive your IP address, an identifier stored in your browser cookies, information about your browser and device, and which pages you opened, which links you followed, and where on the page you clicked. Both derive an approximate location — city level — from your IP address.

Session recording (Yandex Webvisor) is switched off. Yandex Metrica is able to record a whole session — cursor movement, scrolling, typing into fields — and until 12 August 2026 we had that recording enabled. It is now off: Metrica receives only the page and click data listed above, not a recording of what happened on your screen.

The mobile app from the App Store and Google Play has no analytics. Neither counter is loaded there: not a single request goes to them and no analytics cookie is stored. The app does not collect or send which screens you open. Before 12 August 2026 this was different — the app shows the same site, so the counters ran there too; they are now switched off for the app specifically.

Your name, email address, and the contents of your photos, notes, and tracks are not sent to either counter, and we do not link your account with their identifiers.

To be plain about it: Yandex Metrica is operated by a Russian company, and the data listed above is processed in Russia. The website currently has no built-in “do not track me” switch; you can block analytics with browser settings (blocking third-party cookies and scripts) and, for Yandex Metrica, through the opt-out mechanism Yandex publishes on its own site. In the mobile app there is nothing to opt out of — analytics is not there.

Data is therefore processed outside the United Arab Emirates — in the European Union, the United States, the United Kingdom, and Russia. By using the Service you consent to that transfer to the extent needed to operate it.

5. Retention and rights

Data is retained while your account is active and as required by law. You may request access, correction, or deletion by emailing support@skyforest.ai. We respond within 30 days.

6. Contact