Privacy Policy

Who we are

Our website address is: https://fieldmycologist.uk.

Field Mycologist UK is a fungi observation recording platform operated by Leon Terry.

What personal data we collect and why

Registration data

When you register for an account, we collect:

  • Your name or display name
  • Email address
  • Password (stored in encrypted form)

This information is necessary for account creation, authentication, and communication about your account and observations.

Observation data

When you submit observations, we collect:

  • Photographs you upload
  • Geographic coordinates (latitude and longitude)
  • Date and time of observation
  • Species identification details
  • Field notes and descriptions
  • Vice county (determined automatically from coordinates)
  • What3Words address (generated automatically from coordinates via the What3Words API)

Image Metadata (EXIF Data)

When you upload images to Field Mycologist, our system automatically extracts certain metadata embedded in the image files (known as EXIF data) to help auto-populate your observation details. This includes:

  • GPS Coordinates: If your camera or phone embeds location data in photos, we extract latitude and longitude to auto-fill the observation location field.
  • Date and Time: The timestamp when the photo was taken is used to auto-fill the observation date and time.
  • Camera Information: Make and model data may be extracted for quality assurance purposes but is not stored long-term.

Important: The extracted coordinate data (latitude/longitude) is stored with your observation, but the original EXIF metadata is not retained on our servers. Only the processed location information is saved.

You maintain full control over this data:

  • Auto-filled location and time can always be manually overridden before submitting.
  • Your geoprivacy settings (Open, Obscured, or Private) apply to all location data, regardless of whether it came from EXIF, manual map selection, or device GPS.
  • You can disable GPS tagging in your phone’s camera settings if you prefer not to include location data in your photos.
  • You can strip EXIF data from images before uploading using third-party tools if you have privacy concerns.

If you set your observation location manually before uploading images, the EXIF location data will be ignored and your manual selection will be preserved.

ID Suggestions

When visitors leave ID suggestions on the site we collect the data shown in the suggestion form, and also the visitor’s IP address and browser user agent string to help spam detection.

After approval of your suggestion, your profile picture is visible to the public in the context of your comment.

Third-party API requests

When you use the website, certain data is transmitted to third-party services to provide core functionality:

  • NBN Atlas (https://nbnatlas.org): When a species record is created or updated, the scientific name is sent to the NBN Atlas Species API (species-ws.nbnatlas.org) to retrieve taxonomic classification data. No personal data is transmitted in these requests. Taxonomic data retrieved is cached for up to 30 days.
  • What3Words (https://what3words.com): Geographic coordinates from your observations may be sent to the What3Words API to generate three-word location addresses. What3Words’ privacy policy applies to their processing of this data.
  • IUCN Red List (https://www.iucnredlist.org): Species names may be sent to the IUCN Red List API to retrieve conservation status information. No personal data is transmitted in these requests.

Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

  • Consent: You provide consent when you register for an account and submit observations
  • Legitimate interests: We process data as necessary for the operation of the website, including security monitoring, spam prevention, and service improvement
  • Legal obligation: We may retain certain data where required by law

Cookies

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, maps, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

With your explicit consent: When you authorise third-party integrations (such as iNaturalist), we share only the specific data necessary to provide that integration, as described in the Third-Party Integrations section below. This sharing:

  • Requires your active consent and authorization
  • Can be revoked by you at any time
  • Is limited to the specific purposes of the integration
  • Does not include sharing your account password or other authentication credentials

How long we retain your data

For users that register on our website, we store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

Observation records and associated images are retained for as long as your account is active. If you delete your account, your personal profile data will be removed, though observation records may be retained in anonymised form for scientific record-keeping purposes.

iNaturalist integration data (access tokens and connection records) is deleted immediately when you disconnect the integration.

NBN Atlas taxonomic data cached on this website is retained for up to 30 days before being refreshed from the source.

What rights you have over your data

If you have an account on this site, or have left ID suggestions, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Under UK GDPR, you also have the right to

  • Access your personal data
  • Rectify inaccurate personal data
  • Restrict processing of your personal data
  • Object to processing of your personal data
  • Data portability (receive your data in a structured, machine-readable format)

To exercise any of these rights, contact us at hello@fieldmycologist.uk.

Right to disconnect integrations

You have the right to disconnect any third-party integrations at any time. When you do:

  • We immediately revoke access tokens
  • We stop any future data sharing with that service
  • Previously shared data remains subject to the third party’s own policies
  • You may need to separately manage or delete data on the third-party platform

Third-Party Integrations and Data Sharing

iNaturalist Integration

Field Mycologist UK offers optional integration with iNaturalist, a third-party citizen science platform operated by the California Academy of Sciences and National Geographic Society. This integration is entirely optional and requires your explicit authorisation.

What data is shared

When you choose to connect your Field Mycologist UK account to iNaturalist and export observations, the following information is transmitted to iNaturalist:

  • Observation photographs (images you’ve uploaded)
  • Geographic coordinates (location data from your observations)
  • Date and time of observations
  • Fungi species identification
  • Observation notes and descriptions
  • Your iNaturalist username (obtained during authorisation)

How authorization works

  • We use OAuth 2.0 authentication, an industry-standard secure authorization protocol
  • You explicitly authorize Field Mycologist UK to post observations on your behalf through iNaturalist’s official API
  • We store an access token that allows us to export observations to your iNaturalist account
  • This token is encrypted and stored securely in our database
  • We never receive or store your iNaturalist password

Your control

  • You can disconnect the iNaturalist integration at any time from your profile page
  • Disconnecting revokes Field Mycologist UK’s access to your iNaturalist account
  • You maintain complete control over what gets exported – no automatic exports occur
  • Previously exported observations remain on iNaturalist (you can manage them directly on iNaturalist)
  • You can delete the access authorization through your account settings page

Third-party privacy

When you export data to iNaturalist, that data becomes subject to iNaturalist’s own privacy policy and terms of service. We recommend reviewing their privacy policy at https://www.inaturalist.org/pages/privacy

iNaturalist observations are typically public by default, though iNaturalist offers options to obscure precise locations for sensitive species. Once data is on iNaturalist, it is governed by their policies, not ours.

Data retention

We store your iNaturalist connection status and access token as long as you maintain the connection. When you disconnect, we immediately delete:

  • Your iNaturalist access token
  • The connection authorisation record
  • Any temporary data related to the integration

We retain a record that an observation was exported to iNaturalist (to prevent duplicate exports), but this is just a flag in our database and contains no personal information beyond what’s already in the observation record.

NBN Atlas

Field Mycologist UK retrieves taxonomic data from the NBN Atlas Species API. This is an automated process that does not involve any personal data. Scientific names of fungi are sent to the API, and taxonomic classification data is returned and stored on our website. No user accounts, personal information, or observation location data is shared with the NBN Atlas through this integration. For details on how NBN Atlas handles data, see their privacy policy at https://nbn.org.uk/privacy/.

Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

Governing law

This privacy policy is governed by the laws of England and Wales. For any complaints about our handling of your personal data, you may contact the Information Commissioner’s Office (ICO) at https://ico.org.uk.

Contact information

If you have any questions about this privacy policy or our data practices, please contact us at:

Field Mycologist UK
Email: hello@fieldmycologist.uk