Gribomushrooms and heroes
Menu
Language: EN

Privacy Policy

Wersja polska · Terms of Use

Effective from 29 October 2026 (the previous version was effective from 25 October 2026).

This policy explains what personal data we process when you use the Gribo app (Android and iOS) and the Gribo portal, for what purpose, on what legal basis, for how long, and what your rights are. It fulfils the information obligation under Article 13 of Regulation (EU) 2016/679 (GDPR). The Polish version prevails in case of discrepancies.

Data controller

The controller of your data is Key Data Krzysztof Kacprzak, ul. Włodarzewska 87B/66, 02-393 Warsaw, Poland, NIP (tax ID) 9482228490, REGON 367226330.

For any matter concerning personal data, write to support@gribo.app or use “Write to us” in the app Settings. We have not appointed a data protection officer, as we are not required to (Article 37 GDPR).

In short

  • Gribo needs no account. It shows no ads, uses no analytics and does not track you across other apps or websites.
  • Mushroom recognition runs on your phone. Photos, exact locations, spots, outings and tracks stay on your phone.
  • Only the data needed for the online features you choose to use (friends, group outings, community map, cloud backup, mushroom conditions, stylized avatar, contact) passes through our server. Messages to friends are end-to-end encrypted and the server does not know their content. Exception: when you report an illegal dump in Clean Forest, you give us the point and blurred photos, which we publish on the map after checking them.
  • You can remove your data from the server with “Delete my data from the server” in Settings.

Data on your phone

Photos, find locations, spots, outings, tracks, the journal, your profile (nickname, avatar, rank), your friends list and settings are stored only on your phone. We have no access to them and do not process them. The exception is Clean Forest reports (section below): the point and the blurred photos of the dump. The original photos of dumps stay in the app’s storage, not in the gallery. You can delete them in the app or by uninstalling it.

A .gribo_backup file is encrypted with your password. You decide where to keep it (e.g. on the phone or on a drive of your choice). We do not know the password and cannot recover it.

Friends and group outings

When you add friends, send them spots, messages, invitations or trade offers, or take part in a group outing, the data passes through our relay server in Google Cloud, Warsaw region (europe-central2).

  • What we process: a random device identifier and its public key (created by the app on first connection, not linked to your name or phone number), mailbox addresses, encrypted content, and the time and size of each item. Content is end-to-end encrypted — the server cannot read it. During an outing, participants’ positions are encrypted with the group key.
  • Purpose and legal basis: providing the service you request (Article 6(1)(b) GDPR).
  • Retention: received items are deleted immediately; unreceived messages and trade offers after 30 days; invitations after 24 hours; outing data (including encrypted positions) when the outing ends, at the latest after 24 hours. The device identifier and public key are kept while you use online features — they are deleted with “Delete my data from the server” or after 13 months without connecting to the server.

Community map and “I want to join”

The community map is public. An entry appears on it when you share it yourself (a single spot or via the “Sharing my data” switch) or — in new installs — in the default mode described below. The server stores: the map area at the precision you choose (region, neighbourhood or exact — about 70 m), the species, the month, optionally the number of mushrooms and — on Android, if you tick it — your nickname. It never stores photos or exact GPS points from your phone. Other users with access to the community map see the area, species, month, number of people, nicknames (if given) and the mushroom total (if given). The server links an entry to your device identifier only so that you can withdraw it.

  • Legal basis: providing the publication service you request (Article 6(1)(b) GDPR); in the default mode — our legitimate interest (Article 6(1)(f) GDPR), described below.
  • Retention: an entry that is not refreshed disappears after about 13 months; “Withdraw everything” or “Delete my data from the server” removes it immediately.

Default mode in new installs. In the app installed from 24 October 2026, the “Sharing my data” switch is on by default, in the safest mode. Only the following then reaches the server: the map cell at “region” precision (an H3 hexagon at resolution 5, about 250 km² — the server stores only the centre of that cell, not the place of the find), the species and month of the find, and the pseudonymous device identifier the server links the entry to. No nickname, no mushroom count, no photos or GPS points, no spot names. The app never sends protected species. The public heatmap shows a region only once entries come from several different devices. An entry disappears after about 13 months without refresh.

The device identifier is a pseudonym, not anonymous data, so we inform you about this mode when you first start the app — before anything is sent — and tell you where to turn it off: in Settings (“Sharing my data”). The legal basis is our legitimate interest (Article 6(1)(f) GDPR): building a shared map of where mushrooms grow, used by all users. You have the right to object (Article 21 GDPR): turn off “Sharing my data” in Settings — your entries are removed from the server right away and nothing more is sent. Installs from before that date are not affected: sharing stays as you set it. More precise modes (neighbourhood, exact), mushroom counts and the nickname always require your conscious choice.

“I want to join” (Android) shows other people that you are looking for an outing. The server then stores your card (nickname and public key), rank, built-in avatar and approximate area (about 1 km). People within about 25 km — or, if you choose so, all users of the feature — can see it. Legal basis: Article 6(1)(b) GDPR. The entry disappears after 2 hours at the latest, or when you withdraw it.

Cloud backup

If you turn on cloud backup (Android and iOS), the app stores on the server a copy encrypted with your password before upload. The server only knows its identifier, size and time of saving, and cannot read the content. Files are kept in Google Cloud Storage in Warsaw.

  • Legal basis: Article 6(1)(b) GDPR.
  • Retention: a backup that is not refreshed disappears after about 13 months; you can delete it earlier in the app or with “Delete my data from the server”.

Clean Forest (reporting illegal dumps)

When you report an illegal dump, our server in Google Cloud (Warsaw) receives: the GPS point with its accuracy, the day, the type and size of the waste, and photos with blurred faces and without metadata, linked to a pseudonymous device identifier. It does not receive your track, your mushrooms, other photos or your nickname. Your first name, surname and address stay on your phone and go only into the email that you yourself send to the municipality (the municipality, and the forest district or the regional environmental protection inspectorate (WIOŚ) if they are copied, become separate controllers). A copy of that email reaches our mailbox zgloszenia@gribo.app (OVHcloud): an automated process reads only the code and the date and deletes the copy immediately; messages without a code are deleted after 7 days at the latest. From the municipality’s reply we record the fact, the time and a short excerpt without addresses or telephone numbers, for 12 months. No earlier than 48 hours after the report and after we have checked it, the following appear on the public map in the app and on gribo.app: the point (approximate near buildings), the type, the size, the day, the status and the blurred photos, without your nickname. The municipality receives the link to the report immediately. Legal bases: contract (Article 6(1)(b) GDPR) – preparing the letter and the statuses; our legitimate interest (point (f)) – the public map, protection against abuse, statistics; legal obligation (point (c)) – handling notices of illegal content under the Digital Services Act (we keep the notifier’s email for 12 months). We keep the photos and the point for up to 24 months from the last event concerning the site; after that only a count in the statistics remains. You may object to the publication of a specific site or photo (support@gribo.app), and “Delete my data from the server” unlinks your reports from your device (the sites remain on the map with no link to you). Rules on publication and moderation: Clean Forest Rules (in Polish), https://gribo.app/czysty-las/regulamin/

Mushroom conditions and bloom alert

The “Mushroom conditions” card estimates, from the weather, the chance of a flush in the area you are viewing. The bloom alert — if you turn it on in Settings — checks the areas of your spots once a day in the background and compares the current weather with the weather on the days you found something there. These features work when they are available in your version of the app.

  • What we process: the area rounded to 0.1° (about 10 km) — for the card, the area from the map; for the alert, the areas of your spots and the dates of past finds there. Never exact points, spot names or photos. Like every request to our server, the request is signed with the device identifier, but the server does not store it together with the area or the dates.
  • Where the weather comes from: Open-Meteo running on our own server in Poland — requests do not go to external weather providers.
  • Retention: the result for a given area, without the device identifier, is kept for up to 24 hours so that it does not have to be fetched again. The area may appear in technical logs (up to 30 days, see “Server logs and security”).
  • Legal basis: providing the service you request (Article 6(1)(b) GDPR).

Stylized avatar

The stylized avatar is available only to people aged 16 or over. You start it only on your own initiative and after giving explicit consent.

  • What we process: a photo of your face, the chosen template and style, and your notes for the image. The server passes them to OpenAI solely to generate avatar variants. We store neither the photo nor the results on the server — they are kept in server memory only for the duration of the request. The avatar you pick is stored only on your phone; friends receive it like any other avatar.
  • Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time in Settings. Withdrawal does not affect the lawfulness of processing before it.
  • Recipient and transfer: OpenAI processes the data as our processor (the contracting entity is OpenAI Ireland Ltd). Data may be processed in the United States under standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). OpenAI may retain submitted data for up to 30 days to detect abuse and then deletes it. OpenAI does not use this data to train its models.
  • Attempt counter: to enforce limits, we store a hash of the device identifier, the time and the result of each attempt (Article 6(1)(f) GDPR — our legitimate interest in preventing abuse and controlling costs). The counter is kept for 12 months.
  • Do not send photos of other people or of children.

Write to us, species reports and full access

A message sent via “Write to us” reaches us by email (mailbox hosted by OVHcloud). It contains the text, your email address (if you give it), nickname, app version, language and device identifier. A species report for the Atlas also contains the name, a comment and optionally a photo, from which metadata (including GPS location) is removed before sending. We do not store these messages on the relay server or in logs.

  • Legal basis: answering your request and handling complaints (Article 6(1)(b) GDPR), complying with obligations for GDPR requests (Article 6(1)(c) GDPR) and, after the matter is closed, establishing, exercising or defending legal claims (Article 6(1)(f) GDPR).
  • Retention: while the matter is handled, then up to one year after it is closed; if the matter concerns a claim — until the claim becomes time-barred.
  • If we would like to use a submitted photo in the Atlas, we will ask for your permission first.

A request for full access (Android) contains your email address and a comment. On the server we store them together with a hash of the device identifier and the request status. Legal basis: Article 6(1)(b) GDPR. We delete the email and comment no later than 30 days after the request is rejected or access is revoked, and earlier at your request or with “Delete my data from the server”.

Server logs and security

The server and the Google Cloud infrastructure keep technical request logs: IP address, time, resource address, size and response code. The IP address is also used for limits that protect against abuse. Logs contain no message content, photos or email addresses.

  • Legal basis: our legitimate interest — security and continuity of the service and abuse prevention (Article 6(1)(f) GDPR).
  • Retention: logs up to 30 days. The server database’s disaster-recovery copy is updated continuously and holds the state of the last 72 hours — data deleted from the server disappears from it within 72 hours.

Server statistics are kept only as daily totals (e.g. number of messages or outings), without device identifiers or IP addresses. They are not personal data.

External services

Some content is downloaded by the app directly from other companies’ servers. Like any web server, they see your phone’s IP address. We do not pass these companies any information about you. They act as separate controllers under their own privacy policies.

  • Maps: OpenFreeMap and Protomaps. Map tiles are downloaded for the part of the map you are viewing, so these servers also see the approximate map area you browse (for the offline map — the area around your spots). Map data © OpenStreetMap contributors.
  • Atlas 3D models: Google Cloud Storage.
  • Outing weather (Android): MET Norway (api.met.no). At the start of an outing we send only the area rounded to about 10 km, never the exact spot. Mushroom conditions and the bloom alert get the weather through our server — see “Mushroom conditions and bloom alert”.
  • Speech recognition (species name by voice): handled by your phone’s system. If the language is available on the phone, recognition happens on the phone. Otherwise the recording may be processed by Google (Android, Google app) or Apple (iOS) under their own terms.
  • Stores and payments: Google Play and the Apple App Store process data related to downloading and updating the app as separate controllers, under their own privacy policies.
    • In-app purchases on Android are handled exclusively by Google Play’s billing system. Payment data (payment instrument, billing address, transaction history in your Google account) is processed by Google as a separate controller. We do not receive your card or other payment details.
    • In the developer console, Google gives us order data: order number, item purchased, price, currency, country, date and status (e.g. refunded). We use it to perform the contract and handle complaints (Art. 6(1)(b) GDPR) and for tax and accounting purposes (Art. 6(1)(c) GDPR). We keep it for the period required by tax law, as a rule 5 years from the end of the calendar year in which the tax payment deadline expired.
    • The list of items you own, purchase confirmations and the record of your consent to immediate delivery are stored only on your phone and in your backup, if you create one. Our server does not receive or store any purchase data.
    • If you include an order number in a complaint, we process it together with your message as described under “Write to us, species reports and full access”.
    • There are currently no payments on iOS.

Phone permissions

  • Camera — mushroom photos and scanning friends’ QR codes.
  • Location (also in the background during an outing) — map, navigation, recording the track and the place of finds.
  • Photos — importing photos from the gallery with the place they were taken, saving photos to the gallery.
  • Microphone and speech recognition — saying a species name.
  • Physical activity / motion — counting steps during an outing.
  • Notifications — information about an ongoing outing.

Data from these permissions stays on your phone unless you send it yourself through the features described above. You can revoke any permission in your phone settings.

Recipients and transfers outside the EEA

We disclose your data only to the following recipients:

  • entities that process it on our behalf under a data processing agreement (Article 28 GDPR):
    • Google (Google Cloud) — relay server, database and copies in the Warsaw region, logs, Clean Forest photos;
    • OVHcloud — the mailbox receiving form messages and copies of illegal dump reports;
    • OpenAI — only for the stylized avatar;
  • other users or the public — only what you choose to share in the features described above: your friends receive what you send them, and everyone can see community map entries, the “I want to join” entry and sites on the Clean Forest map;
  • the municipality concerned by a dump report, and the forest district and WIOŚ if they are copied: you send them the email with your data yourself, from your own mailbox, and from us the municipality receives a link to the report page with the point and the blurred photos. These recipients are separate controllers;
  • public authorities, where the law requires us to disclose the data.

Server data is stored in Poland. Data leaving the European Economic Area: photos for the stylized avatar (OpenAI, USA) and — for service access — technical data at Google. Transfers are based on standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR) or on a Commission adequacy decision (Article 45 GDPR). You can obtain a copy of the safeguards by writing to us.

Your rights

You have the right to:

  • access your data and obtain a copy (Article 15 GDPR);
  • rectification (Article 16 GDPR);
  • erasure (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability for data processed under a contract or consent (Article 20 GDPR);
  • object to processing based on legitimate interest (Article 21 GDPR);
  • withdraw consent at any time, without affecting the lawfulness of earlier processing (Article 7(3) GDPR);
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, or with the supervisory authority of your country of residence (Article 77 GDPR).

“Delete my data from the server” (Settings) removes in one step everything the server links to your device: identifier and public key, unreceived items, community map entries, the “I want to join” entry, cloud backup, full-access request and the stylization attempt counter. In Clean Forest it unlinks your reports from your device. Published sites remain on the map as environmental information. You may separately request the erasure of a specific photo or site. Logs and the database disaster-recovery copy expire within the periods described above. You can delete data on the phone in the app or by uninstalling it.

Gribo has no accounts, so we cannot always link a request to a specific device. If a request requires it, we will ask for information that allows us to identify your data, e.g. the device identifier shown in the app (Articles 11 and 12(6) GDPR). We reply without undue delay and at the latest within one month (Article 12(3) GDPR).

Providing data is voluntary. Without some of it you cannot use a given online feature — e.g. without an email address we cannot reply by email. We do not make decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). In Clean Forest we use temporary automated measures: a site marked as incorrect by three different devices is hidden pending review, and after three sites have been rejected by a moderator the server stops accepting reports from that device. These are not decisions based solely on automated processing: final decisions on content are taken by a human, and at your request a human will review any such measure (support@gribo.app). Details: § 5 of the Clean Forest Rules.

Children and age

The stylized avatar is available only to people aged 16 or over. This is the age of a child’s consent to information society services in Poland (Article 8(1) GDPR). If you are under 16, use the online features (friends, community map, “I want to join”) with the knowledge of a parent or guardian and do not share your nickname publicly. If we learn that we process a child’s data contrary to these rules, we will delete it.

Security

Messages to friends are end-to-end encrypted and backups are encrypted with your password. The server keeps only the necessary minimum and deletes most data automatically. Connections are encrypted (HTTPS). Access to the admin panel is restricted to the administrator.

Gribo portal

The Gribo portal uses no cookies, analytics, advertising pixels or third-party tracking scripts. The portal server keeps technical logs (IP address, time, page address) for 30 days for security purposes (Article 6(1)(f) GDPR). You can download reminder calendars without providing any data. The “Report a violation” form on the Clean Forest map collects an email address and a description (12 months, Article 6(1)(c) GDPR). The base map is loaded from OpenFreeMap (tiles.openfreemap.org) and, in browsers without WebGL, from the OpenStreetMap servers (tile.openstreetmap.org); the provider sees your IP address and the area you are viewing.

Changes to this policy

When we change how we process data, we will update this policy and let you know in the app. New purposes that require consent will start only after you give it. The current version is always in the app (Settings → About) and at https://gribo.app/en/privacy/.