# Privacy Policy

**Last Updated: June 19, 2026**

Salish Mushrooms, LLC (“we,” “us,” or “our”) operates the salishmushrooms.com website and the Forayz mobile applications for iOS and Android (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Services.

## Quick Summary

– We collect only what’s necessary to provide our mapping and educational services

– We use Google Analytics to understand how visitors use our website (you can opt out)

– We use **Google Firebase Crashlytics** to receive crash reports so we can fix bugs

– **Pro members** can sync their saved locations across devices — stored in your **Apple iCloud** (iOS) or **Google Firebase** (Android)

– We use your device location only to **show your position on the map** — we do **not** record, track, or transmit it

– We do **not** sell your personal information

—

## 1. Information We Collect

### 1.1 Account Information

When you create an account, we collect:

| Data | Purpose |

|——|———|

| Email address | Account identification, password resets, important notifications |

| Name (optional) | Personalization |

| Username | Account identification |

| Password | Stored securely using industry-standard hashing |

### 1.2 Sign-In with Apple or Google

If you choose to sign in with Apple or Google, we receive:

– Your unique identifier from Apple or Google

– Email address (if you choose to share it)

– Name (if you choose to share it)

We store these identifiers to link your account but do **not** have access to your Apple ID password, Google password, or other Apple/Google account information.

### 1.3 Subscription & Payment Information

**iOS App Purchases:**

When you subscribe through the iOS app, Apple processes the payment. We receive:

– Transaction ID (to verify your subscription)

– Purchase date and expiration date

– Subscription status

We do **not** receive or store your credit card number, billing address, or other payment details—Apple handles this securely.

**Web Payments:**

Web subscriptions are processed through Stripe. We receive confirmation of payment but do not store your full credit card number.

### 1.4 User-Generated Content

**Pro Members Only — Saved Locations (synced across devices):**

– **Waypoints:** Pins you drop on the map, including a title, optional notes, a color, precise coordinates (latitude/longitude), and timestamps.

So these are available on all your devices, this data syncs across devices using a different service on each platform:

– **On iOS**, waypoints are stored in **your own private Apple iCloud account** (via Apple’s CloudKit). We cannot access this data — it stays within your iCloud.

– **On Android**, waypoints are stored using **Google Firebase (Cloud Firestore)** under an identifier tied to your account.

Because waypoints are locations you choose to save, they may reveal places of personal interest to you (e.g., foraging spots). They are visible only to you. You can delete them in the app, and they are removed when you delete your account.

**All Members:**

– Course progress and quiz scores (if you use our educational content)

– Any comments or content you voluntarily submit

### 1.5 Automatically Collected Information

**Log Data:**

Our servers automatically record:

– IP address

– Browser type and version

– Pages visited and time of access

– Referring URL

**Rate Limiting:**

We track login attempts by IP address (up to 10 per hour) to prevent abuse.

### 1.6 Cookies & Local Storage

| Type | Purpose | Duration |

|——|———|———-|

| Session cookies | Keep you logged in | Until you log out |

| Local storage | Remember your map layer preferences | Persistent in browser |

We do **not** use advertising cookies or third-party tracking cookies.

### 1.7 Crash & Diagnostic Data (Mobile Apps)

Our mobile apps use **Google Firebase Crashlytics** to report crashes and errors so we can fix them. When the app crashes (or logs a non-fatal error), we receive:

– Crash stack traces and the app state at the time

– Device model, operating system version, and app version

– A pseudonymous identifier tied to your account (used to help debug issues — especially for Pro members). This is **not** your email or name.

Crash reporting runs only in released versions of the app, not in development builds. Crash reports do **not** include your precise location.

—

## 2. Information We Do NOT Collect

To be clear about what we **don’t** do:

– **No continuous location tracking:** The app uses your device location only to display your current position on the map. We do not record, transmit, or continuously track your movements. (Precise coordinates are stored only for waypoints you explicitly choose to save — see Section 1.4.)

– **No advertising trackers:** No Meta Pixel, advertising cookies, or retargeting

– **No cross-site tracking:** We don’t follow you across other websites

– **No selling data:** We never sell your personal information to third parties

—

## 3. How We Use Your Information

We use your information to:

– Provide and maintain the Services

– Authenticate your account and verify Pro membership status

– Process and verify subscriptions (iOS, Android and web)

– Sync your saved locations across your devices (Pro)

– Track your progress in educational courses

– Diagnose crashes and fix bugs

– Send essential account notifications (password resets, subscription updates)

– Protect against fraud and abuse

– Improve and debug our Services

We do **not** use your information for advertising or sell it to third parties.

—

## 4. How We Share Your Information

We share your information only in these limited circumstances:

### 4.1 Service Providers

| Provider | Purpose | Data Shared |

|———-|———|————-|

| Apple | iOS subscription verification; iCloud sync of Pro saved locations | Transaction IDs, subscription status; saved waypoints stored in your private iCloud (we cannot access them) |

| Google Android | Play Store subscription verification | Transaction IDs, subscription status |

| Google Firebase | Crash reporting (Crashlytics, iOS + Android); Pro cross-device sync on **Android only** (Firestore) | Crash diagnostics & device info (all users); saved waypoints — titles, notes, coordinates (Android Pro only) |

| Cloudflare | Content delivery (map tiles) | IP address (standard CDN operation) |

| WordPress/Web Host | Website hosting | Account data, content |

| Email Service | Transactional emails | Email address |

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

### 4.2 Legal Requirements

We may disclose your information if required by law, subpoena, or legal process, or if we believe disclosure is necessary to:

– Comply with applicable law

– Protect our rights or property

– Prevent fraud or abuse

– Protect the safety of users or the public

—

## 5. Data Security

We implement industry-standard security measures:

– Passwords are hashed using secure algorithms (never stored in plain text)

– HTTPS encryption for all data transmission

– Rate limiting to prevent brute-force attacks

– Authentication tokens with expiration

– Security headers to prevent common web vulnerabilities

While we take security seriously, no system is 100% secure. We encourage you to use a strong, unique password.

—

## 6. Data Retention

– **Account data:** Retained while your account is active

– **Subscription records:** Retained for accounting and legal compliance

– **Course progress:** Retained while your account is active

– **Synced saved locations (waypoints):** Retained while your account is active; deleted when you delete your account

– **Crash reports:** Retained by Firebase Crashlytics for up to 90 days

– **Server logs:** Typically retained for 30-90 days

You may request deletion of your account and associated data at any time (see Section 8).

—

## 7. Mobile Applications

Our iOS and Android apps follow the same privacy practices as our website. Additionally:

### 7.1 App Permissions

| Permission | Purpose | Required? |

|————|———|———–|

| Location | Show your position on the map | Optional — the map works without it |

| Internet access | Load maps and sync data | Yes |

| Storage | Cache map tiles for offline use | Pro feature |

We do **not** request access to your:

– Camera

– Microphone

– Contacts

– Photos

### 7.2 Offline Data

Pro members can download map regions for offline use. This data is stored locally on your device and can be deleted through the app settings.

—

## 8. Your Rights & Choices

### 8.1 Access & Portability

You can request a copy of your personal data by contacting us.

### 8.2 Correction

You can update your account information through your account settings or by contacting us.

### 8.3 Deletion

You can delete your account and personal data directly in the app (Account settings), or by contacting us. Some information may be retained for legal or legitimate business purposes.

### 8.4 Opt-Out

You can:

– Disable cookies in your browser (may affect functionality)

– Delete local storage data through your browser settings

– Unsubscribe from non-essential emails

### 8.5 California Residents (CCPA)

California residents have additional rights:

– Right to know what personal information we collect

– Right to delete personal information

– Right to opt-out of sale of personal information (we do not sell your data)

– Right to non-discrimination for exercising your rights

### 8.6 European Residents (GDPR)

If you are in the European Economic Area, you have rights including:

– Access, correction, and deletion of your data

– Data portability

– Objection to processing

– Withdrawal of consent

– Right to lodge a complaint with a supervisory authority

Some data is processed on servers that may be located in the United States: crash reports (via Google Firebase, all users), and Pro saved-location sync (your Apple iCloud account on iOS; Google Firebase on Android). By using these features you consent to this transfer.

—

## 9. Children’s Privacy

Our Services are intended for users aged 13 and older.

**Age Requirement:**

By creating an account, you confirm that you are at least 13 years old. If you are between 13 and 18, you represent that you have your parent or guardian’s permission to use the Services.

**Under 13:**

We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has created an account, please contact us immediately. We will delete the account and associated information promptly.

**Parents and Guardians:**

If your teen (13-17) uses our Services, we encourage you to discuss online privacy and responsible use of mapping/outdoor recreation apps with them.

—

## 10. Third-Party Links

Our Services may contain links to third-party websites (e.g., external mapping resources, educational content). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

—

## 11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

– Posting the updated policy on this page

– Updating the “Last Updated” date

– Sending an email notification for significant changes (if you have an account)

Your continued use of the Services after changes constitutes acceptance of the updated policy.

—

## 12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

**Salish Mushrooms, LLC**

Email: jeremy@salishmushrooms.com

Website: https://salishmushrooms.com/contact/

—

*This privacy policy was last reviewed and updated on June 19, 2026.*