Privacy policy

Last updated: 4 October 2026

Effective: 4 October 2026

Controller

FT Plus s.r.o.
IČO: 04965159
Registered office: Světova 523/1, Libeň, 180 00 Praha 8, Czech Republic

FT Plus is the data controller for the processing described in this policy.

Scope

This policy applies to:

• FT Plus websites — ftplus.cz and related subdomains
• Here Shroom — the Here Shroom iOS app and hereshroom.ftplus.cz marketing site
• Pebble Journey — the current iPhone TestFlight app, supporting browser journey features when a test service is available, and the separately identified Android prototype

Product-specific details are described in the sections below.

FT Plus Website (ftplus.cz)

What we collect

The FT Plus website does not have user accounts, comments, payments, newsletters, or contact forms. We do not intentionally collect account or form data through the company website. The Here Shroom shared-trip pages separately relay app data that a user has chosen to share, as described below; that content is not a website account or submission form.

Standard web infrastructure may process basic technical data needed to deliver the site: IP address, requested URL, time of request, browser user agent, and error logs.

Cookies and analytics

ftplus.cz does not use advertising cookies, tracking cookies, or third-party analytics.

Purposes and legal basis

Technical data is processed for our legitimate interest in operating, securing, and improving the website. We do not sell this data or use it for advertising profiles.

Processors and hosting

The site is hosted on cloud infrastructure. We aim to use infrastructure within the European Economic Area where practical. Infrastructure providers process technical data as necessary to provide hosting, security, and delivery services.

Retention

Technical logs are kept only as long as needed for operations and security. Specific retention periods depend on infrastructure providers. Logs may be retained longer if required by law or to investigate abuse.

Here Shroom App

Here Shroom is distributed for testing through Apple TestFlight and is not offered on the public App Store. This policy does not represent a build awaiting Apple approval as publicly available.

What the app does

Here Shroom is a mushroom foraging companion app that lets you log finds, save locations, record trips, and keep notes and photos. Data is stored on your device first, and the app works offline without signing in.

Data created or processed when you use the app

When you use Here Shroom, the following data may be created, stored, or processed:

• Foraging records: Trips, times, distance, species categorisation, abundance, notes, and timestamps
• Location data: Exact GPS coordinates of finds and GPS breadcrumb routes recorded during active trips when route recording is enabled; route recording is on by default and can continue in the background until the active trip ends
• Photos: Pictures of your finds, including a separate Apple Photos copy when you grant add-only Photos access for a camera capture
• Feedback: Messages, mushroom requests, optional contact and related Atlas details that you choose, plus limited build, API-host, and iOS-version context added by the app
• Account and service records: Privacy choices, sharing choices, consent settings, export or deletion status, and TestFlight purchase-status records
• Connection and security data: Resolved IP address used for rate limiting, request time, HTTP status, redacted endpoint or access-log metadata, and bounded diagnostic records; raw API paths or queries containing record identifiers and request payloads are excluded from application logs

Offline use, account, and private synchronisation

Here Shroom stores exact find locations and recorded GPS routes on the current device first. While you are signed out, the app has no authenticated cloud session and does not send exact locations or routes to FT Plus. After you sign in with Apple, supported pending and new trips, finds, photos, settings, and submitted feedback automatically synchronise to your owner-only account when online. This includes exact find locations and completed recorded routes. They are encrypted in transit and protected at rest; ordinary exact account reads remain scoped to your account. The explicit public share-link exception below can expose selected trip details, exact find coordinates and photos.

The current app does not offer a separate local-only location switch. Signing out stops future authenticated synchronisation but does not delete data already held for your account. Turning route recording off stops new breadcrumb-route recording only; marked finds still capture and retain exact locations. You can delete a recorded trip or use the account-data deletion controls for the scopes described in this policy. Sharing a public trip by link is another explicit action, separate from the anonymous Community contribution choice.

Separately from FT Plus account synchronisation, iOS may include on-device Here Shroom records, exact locations and routes, and photos in an iCloud device backup or a computer backup if device backup is enabled. Backup copies are controlled by your Apple and device backup settings and are not available to FT Plus as Here Shroom cloud account data.

Private account synchronisation is separate from anonymous Community contribution. A trip contributes nothing unless you explicitly enable its independent contribution choice. Signing in or synchronising exact data does not itself change that choice or publish a share link. The same authenticated owner can restore supported server-acknowledged records after reinstalling or on another device. Never-uploaded, pending, deleted or otherwise unavailable records cannot be reconstructed from the service. Restoration does not search or merge unrelated or unproven legacy accounts.

Synchronised storage and ordinary account access are owner-scoped; the public share-link exception below uses a separate, filtered projection:

• Trip, find, feedback, settings, and media metadata are stored in account partitions scoped to the owner.
• Exact find coordinates are encrypted at rest and protected in transit.
• Completed GPS routes are application-encrypted and stored in private, owner-scoped route storage.
• Photos and feedback attachments are kept in private cloud storage. GPS EXIF is removed from photos on the server before storage.
• Device choices such as whether to record a route remain on the device. Apple Health/HealthKit integration was removed from the current app on 18 September 2026; any workout copies written by older versions remain under your Apple Health controls.

Account and identity

During Sign in with Apple, the app sends a short-lived, nonce-bound Apple identity token for verification. FT Plus keeps Apple's anonymous per-app subject mapped to your Here Shroom owner record and stores only a hash of each random server session secret. We do not request or store your Apple name or email address. Ordinary sessions have a maximum 90-day lifetime and can be revoked by signing out. For sensitive export and deletion actions, FT Plus also stores a device public key, its derived key identifier and enrolment time, plus single-use, short-lived challenge records. The private device key remains in the Secure Enclave and is not sent to FT Plus.

Photos and mushroom recognition

Automated recognition is intentionally disabled in the current TestFlight candidate. Adding a photo opens the manual Atlas picker without sending the photo to the recognition endpoint. The server independently protects against older clients by discarding a recognition request body without decoding it, running inference, creating a durable suggestion record, or retaining a training copy, and returns no identification or confidence result. No recognition photo is sent to an external AI service.

This is separate from your foraging record: a photo attached to a find is still uploaded and kept as part of the normal synchronisation described above. If recognition is enabled in a future release and you turn on the optional "Help improve recognition" setting, submitted identification photos (with location metadata removed) may be kept, linked to your account, to improve the recognition model. You can turn this off at any time; doing so deletes retained training copies for your account and prevents new training retention.

Exact visibility and anonymous aggregation

New trips have two independent explicit choices with no default: exact visibility intent (private, followers, or public) and whether to contribute to anonymous map aggregation. Neither choice sets or changes the other. A private trip can contribute to the aggregate while its exact data remains owner-only, and a trip with public visibility intent can decline to contribute. Followers visibility is not an anonymous public share. A completed Public trip can instead be deliberately shared by link under the separate rules below. Historical records may carry an earlier combined sharing/contribution choice; current controls let you change contribution.

Only a signed-in trip explicitly set to contribute is eligible. Eligible foraging find locations are privacy-protected before publication: randomly displaced within a configured privacy radius, quantised into grid cells, and subject to a minimum contributor threshold. Selected non-harvestable landmark catalogue items, marked per Atlas entry (for example ant hills), may be published at precise locations. Configured contributor and trip thresholds can be as low as one; these measures do not guarantee that every displayed cell combines several people. Published cells contain no user, trip, or find identifier and no correlable precise timestamp; foraging cells contain no raw find coordinate, and landmark positions carry nothing beyond the position itself. Without an eligible affirmative contribution choice, including a preserved historical combined choice, there is no contribution. A negative contribution choice excludes the trip.

Contribution and Community viewing have a free path. Access to the gated Community endpoint can use honored Premium status or a configured number of ended trips that are explicitly contributing. That configured trip threshold may be zero. Premium does not enable contribution or replace your independent privacy choices. Contribution is revocable. Turning it off, deleting a trip, or deleting the account excludes the affected finds and rebuilds the privacy-transformed aggregate. A change made offline reaches the server and affects its aggregate after queued synchronisation resumes. Exact visibility and contribution remain separate throughout.

Public trip share links

When you deliberately share a completed Public trip, anyone with its link can read the permitted projection without an account. Private and Followers trips do not receive this anonymous view. Individual asset privacy overrides take precedence; an asset without an override inherits the trip's visibility. A Public trip can therefore expose inherited public find details and photographs.

Making route/location information public can expose exact find coordinates. The website may plot those finds as an abstract route; it does not publish the full recorded GPS breadcrumb track. Find photographs and trip/basket photographs have separate visibility gates. The projection can include a pseudonymous handle and trip/find timing, but excludes free-text notes and private account identifiers. These disclosed details can still identify a person or a place.

Stop sharing, making content private or deleting it prevents subsequent permitted service reads. It cannot retrieve screenshots, downloads or copies that a recipient already saved or forwarded. Shared photos are served through the permission-checked service; the underlying private storage is not made a public photo bucket.

Feedback

Feedback submissions are stored locally and queued when you submit while offline, then sent after account-backed connectivity is available. The app does not automatically attach find coordinates or a GPS route; free text and optional contact or Atlas details contain what you choose to enter, together with limited app context. On the server, feedback and attachments are owner-scoped; intake queue messages contain only an opaque job pointer, not feedback text, contact details, images, coordinates, or GPS payloads.

Premium purchase-status experiment

The Premium label and StoreKit flow are only a Sandbox purchase-status experiment in TestFlight. They test purchase, restore, and server verification status after Sign in with Apple. A Sandbox/TestFlight transaction is not a production subscription and does not charge the tester. Where test Premium status is honored by the service configuration, it can provide Community access without the contributing-trip threshold and expanded private cloud capacity. It does not change publication, location or contribution consent. FT Plus does not offer a production Here Shroom subscription. Apple processes the test transaction; FT Plus keeps the owner-scoped StoreKit original transaction identifier, verification state, claimed/high-water timestamps, and expiry needed to verify or revoke that test status. The fixed test product identifier is checked during verification but is not stored as a separate owner record.

Analytics and crash reporting

The app contains no third-party analytics or crash-reporting frameworks. During TestFlight testing, Apple's standard TestFlight infrastructure may collect crash reports and usage data according to Apple's privacy terms.

Third-party services

• Apple: Sign in with Apple (required for cloud features), TestFlight (test distribution and related diagnostics), MapKit (map display), StoreKit (the Sandbox purchase-status experiment), and iCloud device backup if enabled. The current app has no Apple Health/HealthKit integration. Apple processes its services under its terms and privacy policy.
• Microsoft Azure: FT Plus runs the Here Shroom backend and stores synchronised data on Microsoft Azure cloud infrastructure.

Purposes and legal bases

We use Here Shroom data to provide the local and account-backed features you request, keep your private records, prepare exports and deletions, operate and secure the service, respond to feedback, and perform future recognition retention or anonymous aggregation only under the choices described above. We do not sell this data or use it to build advertising profiles.

We process account synchronisation, feedback, export/deletion, and Sandbox purchase-status data as necessary to perform the service contract or take steps you request (GDPR Article 6(1)(b)). Optional future recognition-training retention and anonymous Community contribution rely on your separate, revocable consent (Article 6(1)(a)). We process bounded security and abuse-prevention records for our legitimate interest in protecting the service (Article 6(1)(f)), and process records where necessary to meet legal obligations (Article 6(1)(c)) or establish, exercise, or defend claims.

Retention

Active trip/find records and their media have no automatic age-based deletion period; they remain until you delete that recorded trip or use account deletion. Account-level settings, feedback, identity/device-key, and purchase-status records remain until account deletion, except where a specific choice above says otherwise. Turning off recognition-improvement retention deletes retained training copies and stops future retention. In-app export jobs and private server export files expire 24 hours after creation. Copies you save or share are then under your control.

The in-memory IP rate-limit state is short-lived. Ingress, access, and application security logs are retained only as long as needed for operation and security; exact periods depend on deployment and infrastructure-provider settings, and may be longer where required by law or to investigate abuse. Copies in an iCloud or computer device backup follow that backup's retention and deletion controls and may remain after live app data is deleted until the backup is replaced or deleted. FT Plus cannot access or remove those device-backup copies.

Account deletion removes active service data, account and purchase-status links, private media, retained training images, exports, feedback, and aggregate contributions. A minimal deletion fence remains to prevent stale synchronisation from restoring erased data. As verified on 5 August 2026, the checked configuration did not maintain a separate recoverable Here Shroom app-data backup: the dedicated Azure account uses local redundancy and has no Blob soft delete, container soft delete, versioning, point-in-time restore, or Table export backup configured. Active deletion is therefore not followed by an FT Plus backup-retention window in that configuration. This is a dated technical check, not a claim of a new October infrastructure audit. Contact us for current retention information about specific data; Microsoft may retain separate service security or legal records under its terms.

Pebble Journey

Pebble Journey is currently an iPhone test app distributed internally through Apple TestFlight. A build eligible for later external testing is not an approved external beta or a public App Store release. The service environment remains TEST; that label does not make personal data anonymous.

Current app and service scope

Pebble Journey records reported encounters with painted pebbles, rather than tracking a person or guaranteeing custody. The iPhone app saves drafts first, suggests code/QR/text candidates on your device and asks you to confirm the pebble and publication choice. Current signed test builds have no preset server address. Looking up a journey or sending a report requires a configured, available TEST service; a production server is rejected. This policy does not claim that a remote test service or every planned platform feature is already operational.

Local drafts, photographs and recognition

On-device data can include a pebble code, action (found, taking, keeping or placed), optional place and note, encounter time, publication choice, separate mutation identifier, server/session scope, photo reference, retry state and a returned event receipt. Public journey history and photographs can be cached with a fetch date for offline viewing. Unconfirmed or unpublished drafts stay local.

The camera is optional and requires your permission; the system photo picker supplies images you select. Apple Vision processes QR codes and readable text on-device and returns candidates, not an automatic identification or publication. The app creates a fresh, resized JPEG without forwarding source EXIF/GPS metadata or comments. Current iPhone draft photographs stay on the device and are not attached to a submitted encounter report. The app does not automatically write a separate camera copy into Apple Photos. Visible people, writing and other identifying image content are not removed merely by stripping metadata.

Optional town suggestion

Only when you request a nearby-town suggestion does the app ask for foreground location access. It passes the returned location to Apple's reverse-geocoding service and places a town/region suggestion into an editable, optional field. Desired coarse accuracy is not a guaranteed precision limit on the returned location. Exact coordinates are not stored in Pebble drafts or report fields and are not sent to the Pebble API. The current app does not record a continuous route or track location in the background. You may enter a place manually or omit it; text you enter can itself contain a precise address or other personal information.

Guest identity, reports and public visibility

A public lookup does not require an app account. Where a TEST service is available, the app sends the requested pebble code and normal connection data; a confirmed public report sends its stable mutation identifier, action, optional place/note, encounter time and publication choice. The report payload contains no draft photograph or raw-coordinate field. Sending can retry when the app is active or you request a retry. It is not a guarantee of background delivery while iOS suspends the app.

The prototype service uses essential first-party guest/session and anti-forgery cookies or tokens. A protected guest session normally lasts one day and is associated with a pseudonymous contributor identifier. This is not anonymous data or a one-day deletion period for a report. The iPhone keeps its origin, scoped credentials and session state in device-only Keychain storage. Changing a server or resetting/replacing a session preserves older drafts and pauses publication under a different identity; it does not erase already published information.

Publication is a deliberate choice. A public journey can show the pebble's name/code, published front/back photographs, reported actions, dates and optional place/note. Public responses omit contributor account identifiers and credentials, but text or image content may still identify someone. Do not treat a public report as private merely because it was submitted as a guest. The service has private-membership denial checks; current iPhone provider sign-in, private-group management, follows and related account lifecycle features are not delivered by this test version.

Browser and Android prototype distinctions

The supporting browser/API prototype can let a creator upload front/back pebble photographs. Uploaded original bytes reach the service before server-side sanitization removes metadata and re-encodes the stored image. Public images remain readable through current audience checks; private storage URLs are not exposed as an anonymous bucket. This differs from the current iPhone's local draft photographs. The prototype's creator login is local-development-only; it is not a live social login. Planned Apple/Google/Facebook accounts are not described here as already operating.

The Android prototype is still in development and is not represented as a published Android store release. Its bundled Google ML Kit QR/text recognition runs on-device, but that SDK can send performance and usage metrics to Google under Google's terms. Recognition media/input/output is not sent to FT Plus for remote identification by that flow. Current Android local draft-discard and disabled app-backup controls differ from the iPhone controls described below.

Retention, copies and your controls

Current iPhone drafts, cached public information and managed photographs have no automatic age-based purge. Local drafts can be resumed before publication, but this version does not provide a complete in-app export, account-wide deletion or published-report deletion interface. A session reset is not a data erase. Removing the app or managing backups affects local copies, not an existing server report. Protected Keychain credentials and backup copies may remain after an app is removed. Apple Photos originals and any copies you save remain under your library controls. Enabled iCloud or computer device backups may contain app files; device-only Keychain credentials are separate.

The browser/API prototype lets the same contributor remove a report while matching authority is available, normally within the guest-session window. Removal hides the report and redacts its place and note; a limited record of actor/action/times/identifiers and mutation receipts can remain to protect history and prevent conflicting retries. It is not complete deletion of every service record or photograph. No general service-data expiry, current cloud-backup retention or complete automated account deletion/export process is established for this prototype. Recipients' saved public copies and device backups cannot be retrieved by FT Plus. Use the contact below for access, correction, restriction, portability, consent withdrawal or erasure requests for data we actually hold; we may need proportionate information to identify the relevant records and verify authority.

Providers, security, purposes and legal bases

Apple provides iPhone camera/photo/location/geocoding services and TestFlight distribution. TestFlight can collect crash and usage diagnostics and optional feedback/screenshots, and make tester contact or identity information and diagnostics available to FT Plus under Apple's terms. This is separate from Pebble's pseudonymous guest reports. The current iPhone app has no third-party analytics, advertising/tracking or purchase/subscription SDK. It has no HealthKit, MapKit, StoreKit or social login integration. Android's separate Google SDK behavior is described above.

FT Plus's supporting service architecture uses Microsoft Azure storage when a service is enabled. Source controls include protected guest capabilities, first-party request scoping, upload limits, anti-forgery and abuse-rate controls, audience checks and opaque event references. App/service payloads, photographs, raw coordinates, notes and credentials must not be deliberately added to application logs or queue messages. Basic connection/security data, such as IP address, requested resource, request time/status and bounded error records, can be needed to operate a connected service. Deployment location, current log/backup settings and service retention are not newly attested by the TEST label; the transfers and security sections below apply.

We process requested draft/journey/report functionality as necessary to provide the service you request (GDPR Article 6(1)(b)); optional public publication relies on your explicit, revocable choice (Article 6(1)(a)). Device permission prompts are not a blanket consent to every processing purpose. Bounded security/abuse records support our legitimate interests (Article 6(1)(f)); legal obligations and necessary claims records can rely on Article 6(1)(c) or the applicable claims basis. We do not sell Pebble data or use it to build advertising profiles. Any later provider, payment, sponsorship, privacy or distribution change requires corresponding disclosures; it is not a current beta feature.

TestFlight testing data — both apps

Apple's TestFlight infrastructure automatically collects crash and usage information and shares it with the application provider during beta testing; TestFlight does not offer an opt-out from that automatic collection while you use it. Feedback and screenshots you deliberately submit are optional. Apple may also make tester identity/contact details, installation/build status and diagnostic context available to FT Plus. This is separate from app-account sign-in or a pseudonymous Pebble guest identifier. Apple's handling is governed by its own privacy terms.

FT Plus uses information made available to us to manage beta invitations and access, reproduce crashes, investigate defects, improve the tested product and respond to feedback or support requests. We do not use it for advertising profiles or sell it. Managing the testing service and responding to requests relies on service/request necessity (Article 6(1)(b)); bounded diagnostic analysis and product security/quality rely on our legitimate interests (Article 6(1)(f)). Applicable legal duties or necessary claims records have the legal bases described above. Optional feedback is not a permission to use its contents for unrelated marketing or model training.

Data held by Apple follows Apple's TestFlight retention controls and terms. Any copies, issue notes or diagnostic records FT Plus downloads or creates are kept only while needed for the relevant beta administration, defect investigation or feedback response, then removed or minimized when that purpose ends, except for applicable legal duties or claims. We do not promise a separate fixed number of days for every diagnostic record. Stopping testing does not retroactively erase Apple's records or necessary existing issue records. Contact us to request access, correction, objection, restriction or erasure of testing data FT Plus actually holds; we can identify whether Apple-held data instead requires Apple's process.

International transfers

FT Plus is based in the Czech Republic (EU). We aim to use infrastructure within the European Economic Area where practical. Apple or other processors may process data outside the EEA. Where a transfer is subject to GDPR, we require an applicable transfer mechanism and appropriate safeguards.

Security

We aim to use appropriate security measures to protect data. For Here Shroom, data stored on your device is protected by your device's built-in security features. Data synchronised to our servers is sent over encrypted connections and stored scoped to your account. Find coordinates are encrypted at rest, completed route payloads are application-encrypted in private storage, and photos and attachments are kept in private storage. Explicit public sharing uses the separately permission-checked projection described above, not an open storage container. Logs, telemetry, and server queues must not contain raw coordinates, GPS routes, or image payloads.

Your rights

Under GDPR, you have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate personal data
• Erasure — request deletion of your personal data
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interests
• Portability — receive your data in a portable format

Here Shroom provides in-app controls to export or delete your data. An export combines available owner-scoped server records and media with records, GPS routes, preferences, feedback, and media available only on the current device. Data not yet synchronised and held only on another device cannot be included. The private server export is available for 24 hours; temporary app copies are removed during normal share cleanup, while copies you save or send remain under your control.

The in-app archive is a portable product-data export, not a complete copy of every security or identity record FT Plus may hold: it excludes session hashes, Apple identity mappings, device-key enrolment and challenge records, and deletion fences. Contact us for a broader access request. Copies saved in Apple Photos are also outside Here Shroom's export and deletion controls and remain until you remove them in Apple Photos. Copies in iCloud or computer device backups are likewise outside those in-app controls and remain until managed through the applicable backup settings.

While signed out, these controls export or delete only Here Shroom data available on the current device and do not call authenticated server controls. Cloud data, if any, requires signing in with Apple to export or delete. Current-device export still requires Face ID, Touch ID, or the device passcode through a hardware-backed, purpose-bound local signature. Signed-in cloud export and deletion each require local biometric or passcode approval of a fresh, owner- and purpose-bound challenge signed by an enrolled hardware-backed device key, plus fresh Apple reauthorisation for an Apple-linked account. The app labels signed-out actions as current-device operations and does not present local deletion as account-wide erasure.

During signed-in account deletion, FT Plus exchanges the fresh one-time Apple authorization code with Apple, verifies that the returned identity token belongs to the linked Apple account, and uses the resulting refresh token to request revocation from Apple. The authorization code, identity token, and refresh token are not persisted or logged. Server deletion is resumable if interrupted; the app keeps the current device's local copy until the server confirms completion, then clears it. Data not yet synchronised from another device cannot be remotely erased and must be removed on that device. Merely signing out or removing a local copy does not erase an existing server copy; use the in-app recorded-trip or account deletion control. You may also contact us to exercise your rights or ask about a deletion that cannot complete.

You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) or your local supervisory authority.

Changes to this policy

We may update this policy when we change how we handle data or release new products. Material changes will be noted with a new "Last updated" date at the top of this page. For Here Shroom and Pebble Journey, significant changes may also be communicated through the app or TestFlight.

Contact

For privacy questions or to exercise your rights, contact us at:

Email: info(at)ftplus.cz
Post: FT Plus s.r.o., Světova 523/1, Libeň, 180 00 Praha 8, Czech Republic