Privacy policy

Last updated: 20 August 2026

Effective: 20 August 2026

Controller

FT Plus s.r.o.
IČO: 04965159
Registered office: Světova 523/1, Libeň, 180 00 Praha 8, Czech Republic

FT Plus is the data controller for the processing described in this policy.

Scope

This policy applies to:

• FT Plus websites — ftplus.cz and related subdomains
• Here Shroom — the Here Shroom iOS app and hereshroom.ftplus.cz marketing site

Product-specific details are described in the sections below.

FT Plus Website (ftplus.cz)

What we collect

The FT Plus website does not have user accounts, comments, payments, newsletters, or contact forms. We do not intentionally collect personal data through the website.

Standard web infrastructure may process basic technical data needed to deliver the site: IP address, requested URL, time of request, browser user agent, and error logs.

Cookies and analytics

ftplus.cz does not use advertising cookies, tracking cookies, or third-party analytics.

Purposes and legal basis

Technical data is processed for our legitimate interest in operating, securing, and improving the website. We do not sell this data or use it for advertising profiles.

Processors and hosting

The site is hosted on cloud infrastructure. We aim to use infrastructure within the European Economic Area where practical. Infrastructure providers process technical data as necessary to provide hosting, security, and delivery services.

Retention

Technical logs are kept only as long as needed for operations and security. Specific retention periods depend on infrastructure providers. Logs may be retained longer if required by law or to investigate abuse.

Here Shroom App

Here Shroom is distributed for testing through Apple TestFlight and is not offered on the public App Store. This policy does not represent a build awaiting Apple approval as publicly available.

What the app does

Here Shroom is a mushroom foraging companion app that lets you log finds, save locations, record trips, and keep notes and photos. Data is stored on your device first, and the app works offline without signing in.

Data created or processed when you use the app

When you use Here Shroom, the following data may be created, stored, or processed:

• Foraging records: Trips, times, distance, species categorisation, abundance, notes, and timestamps
• Location data: Exact GPS coordinates of finds and GPS breadcrumb routes recorded during active trips when route recording is enabled; route recording is on by default and can continue in the background until the active trip ends
• Photos: Pictures of your finds, including a separate Apple Photos copy when you grant add-only Photos access for a camera capture
• Feedback: Messages, mushroom requests, optional contact and related Atlas details that you choose, plus limited build, API-host, and iOS-version context added by the app
• Account and service records: Privacy choices, sharing choices, consent settings, export or deletion status, and TestFlight purchase-status records
• Connection and security data: Resolved IP address used for rate limiting, request time, HTTP status, redacted endpoint or access-log metadata, and bounded diagnostic records; raw API paths or queries containing record identifiers and request payloads are excluded from application logs

Offline use, account, and private synchronisation

Here Shroom stores exact find locations and recorded GPS routes on the current device first. While you are signed out, the app has no authenticated cloud session and does not send exact locations or routes to FT Plus. After you sign in with Apple, supported pending and new trips, finds, photos, settings, and submitted feedback automatically synchronise to your owner-only account when online. This includes exact find locations and completed recorded routes. They are encrypted in transit and protected at rest; exact reads remain scoped to your account.

The current app does not offer a separate local-only location switch. Signing out stops future authenticated synchronisation but does not delete data already held for your account. Turning route recording off stops new breadcrumb-route recording only; marked finds still capture and retain exact locations. You can delete a recorded trip or use the account-data deletion controls for the scopes described in this policy.

Separately from FT Plus account synchronisation, iOS may include on-device Here Shroom records, exact locations and routes, and photos in an iCloud device backup or a computer backup if device backup is enabled. Backup copies are controlled by your Apple and device backup settings and are not available to FT Plus as Here Shroom cloud account data.

Private account synchronisation is separate from anonymous Community contribution. A trip contributes nothing unless you explicitly enable its independent contribution choice. Signing in or synchronising exact data does not change that choice or make exact data public. Cloud synchronisation does not currently provide cross-device trip or find download or account merging.

Data synchronised to FT Plus is owner-scoped and not available to other users as exact data:

• Trip, find, feedback, settings, and media metadata are stored in account partitions scoped to the owner.
• Exact find coordinates are encrypted at rest and protected in transit.
• Completed GPS routes are application-encrypted and stored in private, owner-scoped route storage.
• Photos and feedback attachments are kept in private cloud storage. GPS EXIF is removed from photos on the server before storage.
• Device choices such as whether to record a route or write a trip to Apple Health remain on the device.

Account and identity

During Sign in with Apple, the app sends a short-lived, nonce-bound Apple identity token for verification. FT Plus keeps Apple's anonymous per-app subject mapped to your Here Shroom owner record and stores only a hash of each random server session secret. We do not request or store your Apple name or email address. Ordinary sessions have a maximum 90-day lifetime and can be revoked by signing out. For sensitive export and deletion actions, FT Plus also stores a device public key, its derived key identifier and enrolment time, plus single-use, short-lived challenge records. The private device key remains in the Secure Enclave and is not sent to FT Plus.

Photos and mushroom recognition

Automated recognition is intentionally disabled in the current TestFlight candidate. Adding a photo opens the manual Atlas picker without sending the photo to the recognition endpoint. The server independently protects against older clients by discarding a recognition request body without decoding it, running inference, creating a durable suggestion record, or retaining a training copy, and returns no identification or confidence result. No recognition photo is sent to an external AI service.

This is separate from your foraging record: a photo attached to a find is still uploaded and kept as part of the normal synchronisation described above. If recognition is enabled in a future release and you turn on the optional "Help improve recognition" setting, submitted identification photos (with location metadata removed) may be kept, linked to your account, to improve the recognition model. You can turn this off at any time; doing so deletes retained training copies for your account and prevents new training retention.

Exact visibility and anonymous aggregation

Each trip has two independent explicit choices with no default: exact visibility intent (private, followers, or public) and whether to contribute to anonymous map aggregation. Neither choice sets or changes the other. A private trip can contribute to the aggregate while its exact data remains owner-only, and a trip with public visibility intent can decline to contribute. In this release, followers and public are saved intent only; all exact trip, find, route, photo, and location reads remain owner-only.

Only a signed-in trip explicitly set to contribute is eligible. Eligible foraging find locations are privacy-protected before publication: randomly displaced within a configured privacy radius, quantised into grid cells, and subject to a minimum contributor threshold. Selected non-harvestable landmark catalogue items, marked per Atlas entry (for example ant hills), may be published at precise locations. Published cells contain no user, trip, or find identifier and no correlable precise timestamp; foraging cells contain no raw find coordinate, and landmark positions carry nothing beyond the position itself. An unset or negative choice contributes nothing.

Contribution and Community viewing are free. Viewing the gated Community endpoint requires a configured number of ended trips that are explicitly contributing; Premium status does not bypass that threshold. Contribution is revocable. Turning it off, deleting a trip, or deleting the account excludes the affected finds and rebuilds the privacy-transformed aggregate. A change made offline reaches the server and affects its aggregate after queued synchronisation resumes. Exact visibility and contribution remain separate throughout.

Feedback

Feedback submissions are stored locally and queued when you submit while offline, then sent after account-backed connectivity is available. The app does not automatically attach find coordinates or a GPS route; free text and optional contact or Atlas details contain what you choose to enter, together with limited app context. On the server, feedback and attachments are owner-scoped; intake queue messages contain only an opaque job pointer, not feedback text, contact details, images, coordinates, or GPS payloads.

Premium purchase-status experiment

The Premium label and StoreKit flow are only a Sandbox purchase-status experiment in TestFlight. They test purchase, restore, and server verification status after Sign in with Apple. A Sandbox/TestFlight transaction is not a production subscription, does not charge the tester, and grants no app functionality. FT Plus does not offer a production Here Shroom subscription. Apple processes the test transaction; FT Plus keeps the owner-scoped StoreKit original transaction identifier, verification state, claimed/high-water timestamps, and expiry needed to verify or revoke that test status. The fixed test product identifier is checked during verification but is not stored as a separate owner record.

Analytics and crash reporting

The app contains no third-party analytics or crash-reporting frameworks. During TestFlight testing, Apple's standard TestFlight infrastructure may collect crash reports and usage data according to Apple's privacy terms.

Third-party services

• Apple: Sign in with Apple (required for cloud features), TestFlight (test distribution and related diagnostics), MapKit (map display), StoreKit (the Sandbox purchase-status experiment), iCloud device backup if enabled, and Apple Health/HealthKit if you enable trip workout logging. The app writes the workout to Health but does not read your Health data. Apple processes these services under its terms and privacy policy.
• Microsoft Azure: FT Plus runs the Here Shroom backend and stores synchronised data on Microsoft Azure cloud infrastructure.

Purposes and legal bases

We use Here Shroom data to provide the local and account-backed features you request, keep your private records, prepare exports and deletions, operate and secure the service, respond to feedback, and perform future recognition retention or anonymous aggregation only under the choices described above. We do not sell this data or use it to build advertising profiles.

We process account synchronisation, feedback, export/deletion, and Sandbox purchase-status data as necessary to perform the service contract or take steps you request (GDPR Article 6(1)(b)). Optional future recognition-training retention and anonymous Community contribution rely on your separate, revocable consent (Article 6(1)(a)). We process bounded security and abuse-prevention records for our legitimate interest in protecting the service (Article 6(1)(f)), and process records where necessary to meet legal obligations (Article 6(1)(c)) or establish, exercise, or defend claims.

Retention

Active trip/find records and their media have no automatic age-based deletion period; they remain until you delete that recorded trip or use account deletion. Account-level settings, feedback, identity/device-key, and purchase-status records remain until account deletion, except where a specific choice above says otherwise. Turning off recognition-improvement retention deletes retained training copies and stops future retention. In-app export jobs and private server export files expire 24 hours after creation. Copies you save or share are then under your control.

The in-memory IP rate-limit state is short-lived. Ingress, access, and application security logs are retained only as long as needed for operation and security; exact periods depend on deployment and infrastructure-provider settings, and may be longer where required by law or to investigate abuse. Copies in an iCloud or computer device backup follow that backup's retention and deletion controls and may remain after live app data is deleted until the backup is replaced or deleted. FT Plus cannot access or remove those device-backup copies.

Account deletion removes active service data, account and purchase-status links, private media, retained training images, exports, feedback, and aggregate contributions. A minimal deletion fence remains to prevent stale synchronisation from restoring erased data. As verified on 5 August 2026, FT Plus does not maintain a separate recoverable Here Shroom app-data backup: the dedicated Azure account uses local redundancy and has no Blob soft delete, container soft delete, versioning, point-in-time restore, or Table export backup configured. Active deletion is therefore not followed by an FT Plus backup-retention window. Microsoft may retain separate service security or legal records under its own applicable retention terms.

International transfers

FT Plus is based in the Czech Republic (EU). We aim to use infrastructure within the European Economic Area where practical. Apple or other processors may process data outside the EEA. Where a transfer is subject to GDPR, we require an applicable transfer mechanism and appropriate safeguards.

Security

We aim to use appropriate security measures to protect data. For Here Shroom, data stored on your device is protected by your device's built-in security features. Data synchronised to our servers is sent over encrypted connections and stored scoped to your account. Find coordinates are encrypted at rest, completed route payloads are application-encrypted in private storage, and photos and attachments are kept in private storage that is not publicly accessible. Logs, telemetry, and server queues must not contain raw coordinates, GPS routes, or image payloads.

Your rights

Under GDPR, you have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate personal data
• Erasure — request deletion of your personal data
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interests
• Portability — receive your data in a portable format

Here Shroom provides in-app controls to export or delete your data. An export combines available owner-scoped server records and media with records, GPS routes, preferences, feedback, and media available only on the current device. Data not yet synchronised and held only on another device cannot be included. The private server export is available for 24 hours; temporary app copies are removed during normal share cleanup, while copies you save or send remain under your control.

The in-app archive is a portable product-data export, not a complete copy of every security or identity record FT Plus may hold: it excludes session hashes, Apple identity mappings, device-key enrolment and challenge records, and deletion fences. Contact us for a broader access request. Copies saved in Apple Photos are also outside Here Shroom's export and deletion controls and remain until you remove them in Apple Photos. Copies in iCloud or computer device backups are likewise outside those in-app controls and remain until managed through the applicable backup settings.

While signed out, these controls export or delete only Here Shroom data available on the current device and do not call authenticated server controls. Cloud data, if any, requires signing in with Apple to export or delete. Current-device export still requires Face ID, Touch ID, or the device passcode through a hardware-backed, purpose-bound local signature. Signed-in cloud export and deletion each require local biometric or passcode approval of a fresh, owner- and purpose-bound challenge signed by an enrolled hardware-backed device key, plus fresh Apple reauthorisation for an Apple-linked account. The app labels signed-out actions as current-device operations and does not present local deletion as account-wide erasure.

During signed-in account deletion, FT Plus exchanges the fresh one-time Apple authorization code with Apple, verifies that the returned identity token belongs to the linked Apple account, and uses the resulting refresh token to request revocation from Apple. The authorization code, identity token, and refresh token are not persisted or logged. Server deletion is resumable if interrupted; the app keeps the current device's local copy until the server confirms completion, then clears it. Data not yet synchronised from another device cannot be remotely erased and must be removed on that device. Merely signing out or removing a local copy does not erase an existing server copy; use the in-app recorded-trip or account deletion control. You may also contact us to exercise your rights or ask about a deletion that cannot complete.

You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) or your local supervisory authority.

Changes to this policy

We may update this policy when we change how we handle data or release new products. Material changes will be noted with a new "Last updated" date at the top of this page. For Here Shroom, significant changes may also be communicated through the app or TestFlight.

Contact

For privacy questions or to exercise your rights, contact us at:

Email: info(at)ftplus.cz
Post: FT Plus s.r.o., Světova 523/1, Libeň, 180 00 Praha 8, Czech Republic