1. Introduction

Welcome to MagniSpore, a product of Magni Consulting LLC ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide, including:

• Email address and username
• Profile information (experience level, growing environment, location)
• User-generated content (grow logs, photos, notes, observations)
• Communication preferences and settings

2.2 Automatically Collected Information

When you use our Service, we automatically collect:

• Device information (model, operating system, unique identifiers)
• Usage data (features accessed, time spent, interaction patterns)
• Log data (IP address, browser type, pages visited)
• Analytics data through third-party services

2.3 Photo Metadata Handling & De-identification

Photos and profile avatars you upload are re-encoded through a server-side sanitization pipeline that strips all EXIF, IPTC, and XMP metadata before storage. We discard GPS coordinates, device serial numbers, and any embedded authoring information. If the pipeline cannot decode an image, the upload is rejected rather than stored with metadata intact. We retain only a minimal set of technical fields: capture timestamp, image orientation, color profile, and a device-class label drawn from a fixed set of values: smartphone, dslr, point-and-shoot, or unknown. We do not retain model-specific identifiers (for example, “iPhone 15 Pro”, “Canon EOS R5”).

“De-identified” as used in this Policy means content from which we have removed or suppressed direct device identifiers (GPS, camera serial number, EXIF authoring information) and from which account identifiers (email, username) are stripped before inclusion in any training dataset. De-identified content may still be linked to an internal pseudonymous user identifier for the sole purpose of honoring revocation and deletion requests; that identifier is held separately from the training data and is not exported alongside it. De-identification in this sense is distinct from anonymization (which implies irreversibility under some legal standards); users who require strict irreversibility should leave the relevant contribution category disabled.

2.4 Consent-Based Contribution Data

Separate from the core Service data above, users may opt in (or out) of contributing cultivation data for internal product improvement and machine-learning use. This is structured into four independent categories:

• Community posts — public posts, comments, and reactions
• Grow journal — private grow logs, observations, and photos
• Lab cultures — agar plates, liquid cultures, and grain spawn records
• Yield & harvest data — weights, timing, and outcome records

At signup, this contribution opt-in defaults to enabled for users whose IP address at signup geolocates to the United States, and disabled for every other IP geolocation. Your IP address is used only to determine the initial default state of the contribution toggles; we do not retain the IP address in association with your consent record. The consent event log records the geo-country code (for example, US, DE, IN) derived at that moment, not the IP itself.

Every consent change (signup default, later toggle, deletion cascade) is recorded as a dated event in an append-only log. Users can inspect their history and revoke any category at any time via Settings → Privacy. See the Data Use & Contribution page for details.

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Personalize your experience and provide tailored content
• Process your requests and transactions
• Send administrative information and updates
• Analyze usage patterns and optimize performance
• Detect, prevent, and address technical issues or fraud
• Comply with legal obligations

4. Data Sharing and Disclosure

We do not sell your personal information. We may share information with:

• Service Providers:Third-party vendors who perform services on our behalf under a data-processing agreement. The current list of service providers is maintained in § 5 of this Policy.
• Legal Requirements: When required by law, subpoena, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize sharing

What we will not do with contributed content.Data you contribute under Settings → Privacy is used only for internal product improvement, community aggregate insights, and the training of machine-learning models we control for the Service. We will not sell contributed content, license it to data brokers, or share it with advertising networks. Raw identifiable content remains internal; aggregate statistics derived from contributed content may be published or shared, and collaborations with named expert reviewers are bound by written confidentiality agreements. The full license terms are in § 6.1 of the Terms of Use.

Third-party AI providers. As of the Last Updated date above, Magni Consulting LLC does not transmit user-contributed content to any third-party AI provider. If we integrate a third-party AI provider for a user-facing feature in the future, we will (a) select providers whose terms prohibit the use of submitted data for training their own models, and (b) update this Policy and give affected users notice before activating the integration.

5. Third-Party Services

We use the following third-party services to operate the Service:

• Supabase (Database & Authentication): Stores user data, authentication credentials, and application data. Supabase processes data in accordance with their privacy policy.
• Vercel (Hosting & Deployment): Hosts and serves the application. Vercel may collect usage analytics and performance data.
• Brevo (Email Communications): Sends transactional emails such as password resets and notifications. Brevo processes email addresses for delivery purposes.
• Upstash (Rate Limiting): Processes IP addresses temporarily for API rate limiting. No personal data is stored permanently.

These services process data on our behalf under their respective privacy policies and data processing agreements. We encourage you to review their privacy practices.

6. Data Security

We implement reasonable security measures to protect your information. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

7. Data Retention

We retain your information for as long as necessary to provide the Service and comply with legal obligations. You may request deletion of your account and associated data at any time through Settings → Account.

Consent event log. Consent changes are recorded as an append-only history so that past content eligibility can be reconstructed at any point in time. Individual events cannot be edited or deleted while the account exists; when the account is deleted, consent events are removed together with all other personal data via cascade.

Retroactive model training.Content contributed under an active consent category may be incorporated into a trained machine-learning model. If you subsequently revoke that category, future training runs will exclude your content, and any content-linked records (for example, photos) will be flagged as ineligible going forward. However, content that was included in a model before revocation cannot be surgically removed from that specific model — this is a technical limitation of how neural networks are trained, not a policy choice. Users who are uncomfortable with this trade-off should leave the relevant contribution category disabled so that their content is never incorporated in the first place.

What “included in a model” means. Content is considered included in a model once it has been used as an input to a training run that produced a model checkpoint we retained. Content that was merely staged for export but not yet consumed by a training run is still fully revocable and will be excluded from any future training run that draws from that stage.

8. Your Rights and Choices

Depending on your location, you may have rights to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data (Settings → Account → Delete Account)
• Object to or restrict certain processing
• Data portability — you can request a portable copy of your data via Settings → Privacy (export tooling in development)
• Withdraw consent (Settings → Privacy, per category)

To exercise these rights, use the in-app controls above or contact us at the information provided below.

9. Children's Privacy

The Service is not intended for children under 18. We do not knowingly collect personal information from children. We rely on user attestation at signup and may require age verification for account recovery or access to certain features. If we become aware that a user under 18 has created an account, we will disable the account and delete associated data. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We take appropriate safeguards to ensure your data receives adequate protection.

10.1 Service Jurisdiction

MagniSpore is operated from the United States by Magni Consulting LLC, an Ohio limited liability company, and is intended for users in the United States. We do not offer the Service in European Union member states, the United Kingdom, or the European Economic Area; we do not accept payment in Euros or other EU currencies, and we do not market the Service in those jurisdictions. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. Our contribution-data defaults (see § 2.4) reflect this posture: users with a non-US IP address at signup default to opt-out of every contribution category.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Information

For questions about this Privacy Policy or to exercise your rights, contact: