Privacy

Privacy is a product feature here, not a policy page. The guiding principle is that MycoAdvisor doesn't need to know who you are.

What we don't ask for

Standard use of MycoAdvisor requires no real name, no surname, no email address, no phone number, no postal address, no social login and no merchant customer account. You receive a system-generated Researcher ID such asR-X8K2-P91M, which contains no personal information and is not derived from any contact detail.

Recovery, without an email address

Because there is no email address to send a reset link to, you also receive a Recovery Key such as MYCO-7F4Q-2ZMN-X81P-H5KA. Store it somewhere safe. We never store the key itself — only a secure hash of it — so we cannot email it to you, and neither can anyone who compromises our database.

Private research and public reports are different things

Publishing is never a toggle on your research. When you publish, MycoAdvisor creates a separate public report: a snapshot containing only what you selected, with sanitized copies of the photographs you chose. Later edits to your private research do not silently change an already published report; you publish a new version explicitly.

Photographs are sanitized before they are public

Uploads are validated by their actual file signature, not their claimed type. The derivative used for publication is rebuilt from pixels alone, which removes EXIF, GPS coordinates, device make and model, and embedded colour and XMP data. Public reports never reference your original upload.

Identity, per report

Having a Public Alias does not commit you to using it. Each report is published either as Anonymous Researcher or under your alias, so you decide whether two public reports can be linked to the same person.

IP addresses

We will not claim that IP addresses are invisible — any network request necessarily involves one. What we commit to is that MycoAdvisor does not intentionally persist user IP addresses where that is technically configurable, and never stores them in ordinary application tables. Our application logs are built on an allowlist of safe fields, and client addresses are not among them.

Analytics

No advertising pixels, no fingerprinting, no cross-site trackers, no advertising identifiers and no session replay. Product measurement is aggregate: how many research projects were started, how many reached a second observation, how often a reminder led to one.

What we send to the AI model

Analysis runs server-side only; your browser never talks to a model provider directly. The context we send describes the research — species, genetics, research day, notes, measurements, sanitized images — and deliberately has no field for your Researcher ID, alias, IP address, email or any merchant order or customer information.

Commerce stays separate

If you start research from a supplier's product code, the research remains anonymous. Your research identity and a shop's customer identity are kept apart: MycoAdvisor does not automatically receive your name, shipping address, billing address or order history.

This page describes how the product is built. A formal data protection notice will accompany public launch.