Trust, security & privacy

Understory accounts are optional. Account sign-in, when used, is handled through our hosted backend provider using email/password or Google sign-in. Passwords are never stored or transmitted in plain text by Understory.

Sessions are scoped to the signed-in user. Personal data such as your logged sightings is only accessible to your own account through database row-level access controls.

• Account information you provide when signing up (email, and a display name if set).
• Sightings you choose to log, including species, notes, photos, and location you attach.
• Search location and weather lookups required to compute the forecast. Locations are not tied to your account unless you save them.
• Standard server logs (IP, user agent, timestamp) used for abuse prevention and debugging.

Understory does not sell personal data and does not run third-party advertising trackers.

Understory relies on the following providers to operate. Each only receives the data needed to perform its function:

• Hosted backend (database, authentication, storage) for account and sightings data.
• Map and geocoding providers for location search and the in-app map.
• Weather data providers for the conditions snapshot and forecast.
• Wikipedia / Wikimedia for species reference photos.

You can delete individual sightings from the Log at any time. To delete your account and associated data, contact us using the address below and we will remove your account data from our active systems. Backups are rotated on the backend provider's normal schedule.

Understory is an educational tool. Never consume any wild mushroom based on this app alone. See the safety resources page for poison control contacts and identification rules.

Questions about privacy, security, account deletion, or to report a vulnerability: hello@understoryforecast.com