Privacy Policy

Revision of August 12, 2026

1. General

This Privacy Policy describes how SAMPLIFY FZCO (the Operator) collects, uses, and protects personal data of users of SkyForest at https://skyforest.ai.

Operator address: UAE, Dubai, Dubai Digital Park, Dubai Silicon Oasis, Building A2, office 101. By using the Service you consent to this Policy.

2. Data we collect

• Name and email address
• Payment metadata processed by Stripe (PCI DSS Level 1). We do not store card numbers.
• User content: coordinates, notes, photos, mushroom day records, the path of a walk you finish, and the marketplace listings and messages you send to other users
• A push notification token, if you allow notifications in the mobile app
• Technical data: IP address, browser, device type, session information
• Cookies and similar technologies. Analytics and advertising-measurement cookies exist only on the website; the mobile app stores none

3. Purposes

• Providing and improving the Service
• Processing token purchases and account management
• Customer support and security
• Analytics on the website: understanding which pages are used and where they fail. The mobile app has no analytics at all (see section 4.3)
• Measuring our advertising: whether people who clicked an ad reached the apps page. This happens on that one page of the website and nowhere else, and never inside the mobile app (see section 4.4)

4. Who we send data to

We do not sell or rent your personal data. We do measure our own advertising on one page of the website, and that measurement sends data to Meta — the whole of it is described in section 4.4. Beyond that, the Service relies on other companies: hosting, payments, mushroom recognition, maps, weather, analytics. All of them are listed below — what is sent, why, and whether it is sent by our server or straight from your device. That difference matters: when the request comes from your device, the recipient also sees your IP address.

4.1. Sent by our server

Here the request comes from our server, so the recipient does not see your IP address.

• Supabase (EU, United States) — database, sign-in, and file storage. Everything you save in the Service lives here.
• Vercel (United States) — website and backend hosting. Your IP address and request records end up in technical logs.
• Kindwise (Czech Republic) — mushroom identification. Only the photo itself is sent: our server strips the image metadata, including GPS coordinates, before it leaves us. Your name, email, and user ID are not sent.
• WeatherAPI.com (United Kingdom), Open-Meteo (Switzerland), and, if you pick it, Visual Crossing (United States) — weather forecast and history for the coordinates and dates you ask about. WeatherAPI.com's own terms allow onward transfer of service data to the United States, Russia, Japan, China, and India.
• Overpass API of the OpenStreetMap project (Germany), Google Earth Engine (United States), and the public FGIS LK map (Russia) — forest type and land cover for the coordinates of the spot you look at.
• iNaturalist (United States) and GBIF (Denmark) — reference data about species: the coordinates of the area and the species name.
• Nominatim, the address search of the OpenStreetMap project (OpenStreetMap Foundation, United Kingdom; servers in the Netherlands, Ireland, and the United States, reached through the Fastly delivery network) — naming a place. We send either the text you type into the search box or the coordinates of a point you mark on the map, rounded to three decimals (about 110 metres) before they leave us. Our server makes the request, so the provider sees our address, not yours.
• Thunderforest (United Kingdom) — trail map tiles. Our server requests the tiles on your behalf, so the provider sees our address, not yours.
• Apple and Google — verification of subscription and purchase receipts made in the mobile app: the purchase identifier and your identifier in that store.
• Google (Gmail mail service) — sending transactional email: the recipient address and the message itself.
• Stripe — card payments on the website (PCI DSS Level 1). We never receive or store card numbers.

4.2. Contacted directly by your device

These requests leave your device, so the recipient sees your IP address and details about your browser or app.

• Supabase — the app reads and writes your own data directly, without a middleman.
• Yandex Metrica and Google Analytics — analytics, and only when you use the website in a browser. The mobile app does not load them at all; see section 4.3.
• Meta Platforms Ireland Limited (Ireland; outside the EEA, Meta Platforms, Inc., United States) — advertising measurement, and only on the apps page of the website. The mobile app does not load the pixel at all; see section 4.4.
• Map tiles: OpenStreetMap and OpenTopoMap (EU), Esri satellite imagery (United States) — the tile numbers you request — that is, the area you are looking at and the zoom level.
• iNaturalist (United States) — reference photos of species are loaded from its servers.
• Google and Apple — if you sign in with their accounts. They pass us the email address and name from that account.
• App Store and Google Play — when you buy a subscription inside the mobile app.

4.3. Analytics

On the website we run two analytics counters: Yandex Metrica (Yandex LLC, Russia) and Google Analytics (Google LLC, United States). They receive your IP address, an identifier stored in your browser cookies, information about your browser and device, and which pages you opened, which links you followed, and where on the page you clicked. Both derive an approximate location — city level — from your IP address.

Session recording (Yandex Webvisor) is switched off. Yandex Metrica is able to record a whole session — cursor movement, scrolling, typing into fields — and until 12 August 2026 we had that recording enabled. It is now off: Metrica receives only the page and click data listed above, not a recording of what happened on your screen.

The mobile app from the App Store and Google Play has no analytics. Neither counter is loaded there: not a single request goes to them and no analytics cookie is stored. The app does not collect or send which screens you open. Before 12 August 2026 this was different — the app shows the same site, so the counters ran there too; they are now switched off for the app specifically.

Your name, email address, and the contents of your photos, notes, and tracks are not sent to either counter, and we do not link your account with their identifiers.

To be plain about it: Yandex Metrica is operated by a Russian company, and the data listed above is processed in Russia. The website currently has no built-in “do not track me” switch; you can block analytics with browser settings (blocking third-party cookies and scripts) and, for Yandex Metrica, through the opt-out mechanism Yandex publishes on its own site. In the mobile app there is nothing to opt out of — analytics is not there.

4.4. Advertising measurement (Meta pixel)

We advertise the apps on Instagram and Facebook. To learn whether those ads bring anyone in, the apps page of the website (https://skyforest.ai/apps) loads the Meta Platforms pixel. It runs on that page only: no other page of the website loads it, and the mobile app never loads it (the tag checks whether it is running inside the app and stops before it requests anything).

What Meta receives: your IP address, information about your browser and device, the address of the page, and the identifiers Meta stores in its own cookies for that page. It records the visit as a page view of our ad destination. Your name, email address, account, photos, notes, and tracks are not sent, and we do not upload customer lists to Meta.

Meta acts as an independent controller for that data and may use it to measure ad performance and to build audiences for advertising, under its own terms. Meta Platforms Ireland Limited is the controller for people in the EEA; elsewhere it is Meta Platforms, Inc. in the United States.

The website does not yet ask for consent before loading the pixel, and there is no cookie banner: the honest statement today is that visiting the apps page loads it. You can prevent it with browser settings (blocking third-party cookies and scripts, tracking protection) or with an ad blocker, and you can limit how Meta uses the data in your Meta ad preferences. If you never open the apps page, no data reaches Meta at all.

Data is therefore processed outside the United Arab Emirates — in the European Union (including Ireland), the United States, the United Kingdom, and Russia. By using the Service you consent to that transfer to the extent needed to operate it.

5. Retention and rights

Data is retained while your account is active and as required by law. You may request access, correction, or deletion by emailing support@skyforest.ai. We respond within 30 days.

6. Contact