Home

This translation is provided for information only. Only the French version is legally binding. Read the French version

Privacy policy

In short

Mycocarta only collects the data needed to run the service: your email (for authentication) and your foraging data (forays, spots, photos). We use no advertising trackers and never sell your data. You stay in full control of your information.

Data controller

The controller of the personal data collected on Mycocarta is:

BC Productions
Micro-enterprise (micro-entreprise)
SIRET: 894 537 141 00034
Registered office: Paris, France

Data collected

When you use Mycocarta, we collect the following personal data:

Account data:

  • Email address: used for authentication, account verification, essential communications about the service and, unless you turn them off, help and follow-up emails (getting-started tips, seasonal reminders, summaries of your forays)
  • Password: encrypted with the bcrypt algorithm (10 rounds), never stored in plain text
  • Account creation date

Foraging data:

  • Forays: name, date, personal notes, result (empty-handed, poor, good, exceptional) and, for an empty-handed foray, the position of the area searched
  • Spots: GPS coordinates (latitude, longitude), place name, identified species, notes, public/private status
  • Photos: uploaded images linked to spots

Subscription data (for premium users):

  • Subscription type (monthly or annual)
  • Subscription start and end dates
  • Payment status (handled by Stripe, a PCI-DSS certified processor)

Data NOT collected

Mycocarta does not collect the following data:

  • First and last name
  • Phone number
  • Postal address
  • Bank details (processed directly by the payment processor)
  • Detailed browsing data (no advertising trackers)

Local storage and offline mode

To work offline, Mycocarta uses IndexedDB via the Dexie.js library to store your data temporarily in your browser.

This data stays on your device and is synchronised with our servers when you are connected to the Internet. You can delete this local data at any time by clearing your browser cache.

No data is accessible to third parties through this local storage.

Cookies

Mycocarta uses two cookies that are essential to the operation of the service:

NextAuth session cookie: This cookie is needed to keep you logged in while you browse the site. It contains an encrypted JWT token and expires when your session ends or after 30 days of inactivity.

Language cookie (NEXT_LOCALE): This cookie remembers the language the site is displayed in (French, Spanish or English) while you browse. It contains no personal data and is deleted when you close your browser.

We use no advertising cookies or third-party tracking cookies (Google Analytics, Facebook Pixel, etc.).

Analytics and tracking

Mycocarta uses Plausible Analytics, a privacy-friendly analytics tool self-hosted on our own servers. Plausible collects no personal data, uses no cookies and complies with the GDPR without a consent banner.

We use no advertising trackers (Google Analytics, Facebook Pixel, etc.).

Payment and bank details

Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. BC Productions does not store any bank details on its servers.

Only the information needed to manage the subscription (Stripe customer ID, status, renewal date) is kept.

Purposes and legal basis of processing

Your data is processed for the following purposes:

  • Performance of the contract: providing the foraging logbook service (account creation, authentication, storage of your forays)
  • Email verification: securing accounts and preventing abuse (legitimate interest)
  • Management of the premium subscription: processing payments and providing the extended features
  • Essential communications: informing you of significant changes to the service (legitimate interest)
  • Help and follow-up: sending you getting-started tips, seasonal reminders and summaries of your forays, and asking for your feedback on the service, with no advertising content (legitimate interest). You can turn these emails off in your account or by replying to the message

We only process your data for legitimate and proportionate purposes. We never sell your data to third parties.

Hosting and security

Mycocarta data is hosted by OVHcloud (2 rue Kellermann, 59100 Roubaix, France), a provider certified as compliant with the GDPR and ISO 27001 standards.

Security measures in place:

  • Password encryption: bcrypt algorithm with 10 hashing rounds
  • HTTPS connection: all communications between your device and our servers are encrypted
  • Secure JWT: session tokens are signed and verified
  • Rate limiting: protection against brute-force attacks
  • File validation: images are checked by extension and signature (magic number) before being stored
  • Regular backups: to prevent data loss

Retention period

Your data is kept for the following periods:

  • Active account: for as long as your account is active
  • Inactive account: 3 years of inactivity (no login), after which you will receive a warning email before deletion
  • Deleted account: your data is permanently deleted within 30 days of the deletion request
  • Subscription data: kept for 5 years to meet accounting and tax obligations

Your rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

  • Right of access: obtain a copy of your personal data
  • Right to rectification: correct inaccurate or incomplete data
  • Right to erasure: delete your account and all associated data
  • Right to data portability: export your data in a structured format (JSON, PDF for premium users)
  • Right to object: object to the processing of your data on legitimate grounds
  • Right to restriction: request the restriction of processing in certain cases

To exercise these rights, you can:

  • Use the features of your personal area (profile changes, account deletion, data export)
  • Contact us via the contact form

We undertake to respond to your request within one month at most.

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority): www.cnil.fr

Sharing data with third parties

Your personal data is never sold to third parties.

It may only be shared in the following cases:

  • Hosting provider (OVHcloud): necessary for the operation of the service
  • Payment processor (Stripe): solely to process subscription transactions
  • Email delivery service (Resend): to send verification emails and essential notifications
  • Foray weather (Copernicus, European Union): to record the weather of the days before a foray, we send the Copernicus Climate Data Store a point rounded to about 10 km from your spots, with the dates concerned. No account data and not the exact position of your spots are sent
  • Base maps (OpenStreetMap, IGN France, IGN España): map tiles are loaded by your browser directly from these services, which therefore receive your IP address and the map area displayed, as with any image loaded from a third-party site
  • Legal obligation: in the event of a court order

All our processors comply with the GDPR and are located in the European Union or provide equivalent safeguards.

Changes to the privacy policy

We may need to amend this privacy policy to reflect changes to the service or to legal requirements.

Any significant change will be notified to you by email or via a notification on the service at least 30 days before it comes into force.

The date of the last update is shown at the bottom of this page.

Contact

For any question about the protection of your personal data or to exercise your rights, you can contact us via our contact form.