Privacy Policy

4est is operated by Uģis Karulis, an individual based in Latvia.

Privacy and support contact: support@4est.app

Effective date: 2 October 2026.

4est is a private history of forest observations, mushroom findings, saved places, photographs, confirmed species and related context. It is delivered through the iOS app, this website and an Android app that is currently in development, all sharing a single 4est account. It provides on-device mushroom-recognition suggestions, a personal species logbook, a species library, personal progression and insights, decision-support tools and an optional Community layer.

4est is local-first. Ordinary interaction is designed to remain useful from data on your device, while account and cloud services support private synchronization and backup. Community features are separate and optional.

This website is the web view of the same account: your findings, photos, collections and saved places synced from the app appear here. It does not create a separate data store.

Account and authentication information. Depending on the platform and your choice, you can authenticate with Sign in with Apple or Google. The provider may supply your email address on authorization; it is stored with your account identity. One 4est account works across the iOS app, the Android app and this website. On the web, your session is maintained with a signed session cookie.

The finding and observation data you create: dates, categories, species choices, notes, quantities and related metadata.

Precise or approximate location information associated with findings, saved places and other forest history.

Photographs and media you choose to attach. Apple Photos originals are never uploaded. With account sync, optimized photo copies may be privately backed up to server object storage.

Technical synchronization information: stable record identifiers, timestamps, versions and deletion state.

Community data you deliberately create: profile, shared posts, comments, appreciation reactions, follow relationships, blocks and reports.

Limited operational information for service security and troubleshooting: request timestamps, errors and network/security logs.

Your findings, precise coordinates, private notes, quantities, place names, private photographs, personal history, My Species, personal insights and private map data are private account data. They are not published as a public map or feed, not sold, not used for advertising and, under this policy, not used to train AI models.

Creating or syncing a finding never publishes it. Sharing to Community is a separate, deliberate action that creates a separate, cleaned share record rather than exposing your private journal.

Community is optional and opt-in. Your Community profile is private by default. Private-profile content is visible only to people whose follow requests you approved; public-profile shared content is visible to other registered 4est accounts.

When you share a finding as a Community post, 4est creates a separate record with your caption, the shared species, capture date, your chosen location reveal level and one image derivative with metadata removed. It contains no coordinates, private notes, place names, private media references or private history.

Comments, appreciation reactions, follow relationships, blocks and reports are part of the Community service. Reports are stored for moderation and are never shown to the account being reported.

For each shared post you choose how much location context to show: none, country, region or an approximate area with a chosen radius. The approximate area is computed server-side from the original coordinate so the published circle is offset from the exact point. Exact coordinates are never published to Community.

Approximate-area reveal is designed not to disclose the precise coordinate, but no location system can be guaranteed perfect. Share with that in mind.

4est may request camera, photo and location access when a feature needs it. Your device platform manages these permissions and you can change them in your device settings. Declining a permission may limit the feature that depends on it.

Place names may be determined using Apple geocoding. Weather and environmental context are provided by Apple WeatherKit. Navigation may use Apple Maps.

Mushroom-recognition analysis runs on your device. A photo may still reach the private account backup if you use sync and the photo is part of a supported finding; that backup is separate from the recognition analysis itself.

Recognition results are suggestions. They are not an authoritative identification and do not establish whether a mushroom is edible or safe.

The app stores working data locally for speed and offline use. With an account, supported structured data and optimized private media are also stored on DigitalOcean infrastructure in region fra1 (Frankfurt) for synchronization and backup.

After setup the app also works offline, and findings continue to be stored on the device until a connection is available.

Community activity is available in the in-app inbox. If you enable push notifications, 4est registers your installation with Apple Push Notification service (APNs) and stores that installation device token. The device token is not authentication credentials, and notification content does not link it to your location or journal data.

You choose which activity notifies you, and you can turn notifications off in the app notification settings or your device settings.

4est offers an optional 4est Premium subscription through Apple StoreKit. Apple processes the purchase, billing and refunds. 4est stores only what is needed to reflect entitlements, including promotional grants applied to an account.

Deleting your 4est account does not cancel an App Store subscription. Subscriptions are managed and cancelled in Apple ID settings.

To keep, organize and display your forest history; to back up and synchronize supported account data and photographs; to authenticate accounts and provide security, export and deletion; to provide location-aware history, maps and features; to operate optional Community features; to deliver notifications you enable; to operate, secure and improve 4est; and to answer support and privacy requests.

We use service providers only where they are needed for 4est to work. Apple processes information when Sign in with Apple, Apple Maps, geocoding, WeatherKit, StoreKit, APNs and Apple platform services are used. DigitalOcean hosts the cloud database, API infrastructure and private media storage. Vercel hosts this public website. When optional analytics is used, Google (Google Analytics 4 and Google Tag Manager) and Microsoft (Clarity) process analytics data as independent controllers, while Sentry processes error and performance data for our monitoring purposes. These providers process data under their own terms and privacy commitments insofar as they apply to the services we use.

This website uses one required signed session cookie, to keep you signed in and to prevent private data from being exposed to others. It is not used for analytics or advertising.

Optional product analytics is off until you allow it. If you allow analytics, the site loads Google Analytics 4, Google Tag Manager and Microsoft Clarity to understand, in aggregate, which pages and features are used. Analytics events never contain exact mushroom or forest coordinates, finding ids, account ids, email, name, private notes, photo filenames or links, Community comment text, search text, authentication data or session cookies.

Without consent, Google Analytics, Google Tag Manager and Microsoft Clarity are not loaded. You can change the choice at any time from the footer link “Analytics settings”; if you withdraw it, further collection by these tools stops and known analytics cookies are cleared.

Independently of analytics consent, the site uses Vercel Web Analytics and Vercel Speed Insights to measure visit counts and performance without building a profile, and Sentry to capture errors and performance problems so the service stays secure and reliable. Sentry events are not given the session cookie, authorization headers, request bodies, email, user identifiers or exact coordinates, and Sentry Session Replay is not enabled.

Google and Microsoft act as independent controllers for their own analytics services; see their privacy policies for details.

Your synced account data and private media are kept while the account is active, unless you delete the content earlier. Community content is kept while the account is active, unless you delete it, make it private or delete the underlying finding.

Operational security logs are intended to be kept no longer than 30 days, unless a longer period is needed to investigate abuse or security incidents or to comply with legal requirements. Support correspondence may be kept for up to 24 months.

When content or an account is deleted, removal from active systems is intended to complete quickly. Residual copies may remain in backup infrastructure until those backups rotate out on their normal schedule.

Deletion starts from account settings in the 4est app. If the app is not available to you, you can request deletion from this website by emailing support@4est.app; the account deletion page explains what to include. Account deletion removes the cloud account, backed-up media and synced history associated with the user, including findings and related location data, as well as your Community profile, posts, comments, reactions, follow relationships, blocks, reports and notification registrations.

We may retain information only where required by law, or retain genuinely anonymized data that can no longer be linked to you. Deletion is logical first, and physical media wiping may follow as a queued process; we do not promise instantaneous physical deletion. If Sign in with Apple was used, the associated authorization is revoked during deletion.

4est supports account export. A signed-in user can download a copy of their data from the website, and further help can be requested at support@4est.app.

4est maintains scientific/research data retention as a separate domain. It is off by default and requires explicit consent; research-data retention is not currently performed for accounts. Without consent, nothing from your journal reaches a research store.

Depending on where you live, including the EU/EEA, you may have the right to access, correct, delete, restrict processing of or receive a copy of your personal data, to object to certain processing and to complain to a data-protection authority. Contact us at support@4est.app.

4est is a general-audience outdoor app and is not specifically directed at children. We deliberately do not design the account service to collect personal data from children who cannot lawfully consent to such processing in their country without appropriate authority.

We use technical and organizational measures to protect synced account data and private media. No internet-connected system can guarantee absolute security, so we do not promise that data loss or unauthorized access is impossible.

We may update this policy when 4est or its data practices change. We will announce material changes appropriately and update the effective date above.

Privacy and support: support@4est.app

Operator: Uģis Karulis, Latvia