We treat your data the way we treat the forest — minimally disturbed, ethically harvested, never sold. This page explains what we collect, why, and what your rights are.
Last updated 12 October 2026 · Effective immediately
⟡ In one sentence
We collect only what each part of the site needs to work — no third-party analytics, no advertising trackers, no selling your data, ever — and we tell you below exactly what goes where.
Who we are
Fungai Art is an independent herbal and artistic practice run by Robin Floræsta. There is no company behind it. The data controller for personal information collected through this website (fungai.art) is Robin Floræsta, trading as Fungai Art, Ackerstraße 9, 10115 Berlin, Germany. Contact: robin@fungai.art. See also the imprint.
What we collect — feature by feature
Visiting the site — our host (Netlify) processes your IP address and basic request data to deliver pages and protect the site. On every request our ban check compares your IP address against a short list of blocked addresses; it is not stored. Server logs are kept briefly. Basis: legitimate interest (running a secure website).
Shop & orders — name, email, shipping address and the items you order, used to fulfil and ship your order and to send order emails. Card payments are handled entirely by Stripe; we never see your card number. Basis: contract; legal obligation (bookkeeping).
Find Your Formula — your quiz answers, which can include health-related information (for example medications, pregnancy, health conditions, sleep, how you feel) and any note you write. We store them securely in our database to compose your formula and, if you reserve it, to prepare it. If you don’t reserve it, your answers and formula are deleted automatically after 30 days. An AI model (Anthropic’s Claude) assists the composition and writes your personal reading; under Anthropic’s commercial terms this data is not used to train its models. If you reserve a formula we also receive your name, email, city, country and age range, and send a confirmation email. Basis: your explicit consent, given on the start screen — you can withdraw it at any time by emailing us, and we will delete your answers.
Check-ins after a reservation request (Formula Evolution) — if you buy the formula, and unless you ticked “No check-in emails”, Robin writes twice, about 3 and 6 weeks after your purchase, to ask how it is going. A reservation request alone gets no check-ins, and its check-in record is deleted after 120 days if no purchase follows. Every email has a one-click stop link that also removes your address from them. If you answer, your answers (how you take it, how it feels, whether your intention has shifted, what changed, whether your health changed) are stored with your formula so they can shape your next one, and Robin receives a copy by email. Your email address is kept only for these check-ins, and the check-in record is deleted about two months after the last email. Basis: our legitimate interest in following up the formula you asked for, with an easy way out at every step; your answers: your consent, by sending them.
Your member page (optional) — the confirmation email links to the community portal. If you sign in there with the email you reserved with, we start your member page with your name and town and put your formula in My formulas, visible to you and the keepers only. Nothing is created unless you sign in. Basis: your request, by signing in.
Purchases — when you buy a formula or order from the shop we keep a record of it (name, email, address, what you bought, the amount, the payment or invoice reference, and for a formula its herbs, the proposed dose and your answers) so we can prepare, ship and look back at it, and you get an order confirmation by email. Basis: contract; legal obligation (bookkeeping).
Learning from check-ins (optional) — on the check-in page there is a separate, unticked box. Only if you tick it, your check-in answers are kept after the check-ins end, without your name or email, joined only to the formula and the quiz answers it came from, so we can learn which formulas suit which people. Without it, your answers are deleted with the check-in record. Basis: your explicit consent; withdraw it any time by emailing us, and we delete those answers.
Dinner Experience enquiries — the name, email and message you send through the enquiry form are emailed to Robin. Basis: steps you ask for before a booking; legitimate interest in answering you.
Newsletter — the email address you subscribe with, used only to send Field Notes. Unsubscribe anytime, instantly. Basis: consent.
Community (Spore) — if you join: your email (for magic-link sign-in), the profile you create (name, bio, picture), and what you post, comment, send or RSVP to inside the community. Community administrators can see member email addresses to run the community. Basis: contract (providing the membership).
Foraging Map — only if you allow location: your position is used in your browser, and rounded to about 1 km before it reaches our servers to look up your place name, local weather and nearby species sightings. Questions you ask MYCO (the map’s AI guide) are processed by Anthropic together with that approximate location. On the homepage, if precise location isn’t shared, we show what’s in season using the approximate city our host derives from your connection; it isn’t stored. Nothing is used to build a profile of you. Basis: consent (your browser’s location prompt).
What we do not collect
No Google Analytics, advertising pixels or analytics cookies
No advertising identifiers or behavioural profiling
No fingerprinting
No data sold to anyone, for any reason, ever
Counting page views
We count how many times each page is opened, so we know whether any of
this is reaching anyone. It is our own counter — no analytics company is
involved, and the individual records never leave our own database.
For each page opened we record: the page path, the
country and city the request came from, whether the device
is a phone, tablet or computer, the operating system and browser family,
your browser's primary language (for example "de"), and the
website that linked you here — the site's name only, never
the full address it linked from.
The city is worked out from your connection by our hosting provider. It
is approximate, it is often wrong or missing, and it is the most precise
location we keep. We do not record your coordinates.
We do not record your IP address or the full text of
your browser's identification string. We do not set a cookie, store
anything on your device, or create any kind of visitor identifier. That is
deliberate, and it has a consequence we want to be straight about:
we can count page views, and we cannot count people. Two
visits by you and one visit each by two strangers look identical to us,
because nothing we keep can tell them apart — and for the same reason, a
row saying "Berlin, phone, /shop" cannot be connected to you, to an order,
or to any other visit.
If your browser sends a Do Not Track signal, we do not
count the visit at all.
These records are deleted after 90 days. Every Sunday
night Robin receives a summary by email: totals per page, per country, per
city and per day, never a single record. Before it is sent, MYCO (our
assistant, running on Anthropic's model) reads those totals and writes a
short note on top; only the totals go to Anthropic, never the records.
Third-party services
These providers handle data on our behalf, each only for the function listed:
Anthropic — the AI model behind formula composition, personal readings and MYCO. anthropic.com/legal/privacy
Map & nature data for the Foraging Map — Esri and CARTO (map tiles, loaded by your browser, so they see your IP address), BigDataCloud (place name from rounded coordinates), Open-Meteo (weather), iNaturalist and GBIF (public species observations). No names or contact details are sent to them.
Fonts & code libraries — every typeface and the sign-in library are served from fungai.art itself, so no font service sees your visit. jsDelivr delivers the PDF reader in the members' Academy and sees your IP address when it does; CoinGecko provides crypto price rates when a price is shown in crypto.
Some of these providers are based outside the EU/EEA (mainly in the United States). Where that is the case, transfers rely on the provider’s safeguards, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
Cookies & local storage
We use the bare minimum, and nothing for marketing or analytics. Everything below exists only to make the feature you are using work, which is why the site shows no cookie banner: there is nothing to ask your consent for.
fa_cart_v1 — your shopping cart (browser only)
fungai_formulas — formulas you save in Mixology (browser only)
Formula quiz progress — lets you pick up the quiz where you left off; cleared when you refresh the start screen or finish (browser only)
Foraging Map & community settings — your map acknowledgement and, if you’re a member, your sign-in session
Stripe cookies — only set when you check out, for fraud prevention
Clearing your browser data removes everything stored in your browser.
Your rights (GDPR)
If you're in the EU/UK (and we extend these rights to everyone), you can:
Access — request a copy of any data we hold about you
Correct — ask us to fix anything inaccurate
Delete — request deletion of your data ("right to be forgotten")
Portability — receive your data in machine-readable form
Object — stop us using your data for any specific purpose
Withdraw consent — for your formula answers, the newsletter or location, anytime, without affecting what happened before
To exercise any of these, email robin@fungai.art. We'll respond within 30 days — usually within 48 hours. It's free.
Getting a copy of your data
Email us from the address you used on the site, and say what you want a copy of (or say "everything"). If we can't tell from the email alone that the request is yours, we'll ask one question to confirm it — we won't ask for ID documents. You'll get a machine-readable file (JSON, plus CSV for orders) covering your community profile and content, formula readings and reservations, orders, newsletter status and any enquiry emails.
Deleting your data
Email us and say what you want removed. We will delete your community profile and everything you posted, your formula readings and reservations, your newsletter subscription, your uploaded picture, and our email correspondence with you.
Two things we cannot delete on request, and why:
Completed orders — Swedish accounting law requires us to keep the invoice record for seven years. We can remove everything not required by that law, and the record is then deleted automatically.
Payment records held by Stripe — Stripe keeps its own records as the payment processor, under its own legal duties.
Deletion happens within 30 days. Encrypted database backups roll over within about a week after that, which is when the last copies disappear.
Data retention
Order records — kept for 7 years (Swedish accounting law), then deleted
Formula quiz answers — if you don’t reserve the formula, deleted automatically after 30 days; if you reserve it, kept while we prepare and follow up on your formula. Either way, deleted on request at any time
Enquiry and contact emails — kept as long as the conversation is useful, then deleted
Community account and content — until you delete your account or ask us to
Newsletter email — until you unsubscribe
Local browser data — until you clear it
MYCO conversations — not stored at all (see below)
Encrypted database backups — roll over on about a seven-day cycle, so deleted data can persist in a backup for up to a week longer
MYCO, our AI assistant
MYCO answers questions on the site. Here is exactly what happens when you talk to it.
What it stores: nothing. Your conversation lives in your browser for as long as the panel is open and is never written to our database. Close it, and it's gone.
Where your message goes. It is sent to Anthropic, which runs the language model on our behalf as our processor. Under our agreement with them, your messages are not used to train their models. They keep them only briefly for abuse monitoring.
What MYCO knows. It answers from our own knowledge base — our herb database, plant monographs and our house protocols — and tells you which sources it used. It has no access to our member database, your account, your orders or your formula.
Does talking to MYCO improve it? Not automatically, and not today. Nothing you type is fed back into it. If we ever start keeping conversations to improve MYCO's answers, we will say so here first, explain the choice, and ask before using anything of yours.
Without an account: one question per 12 hours. To count it we keep a scrambled code made from your connection's IP address (a one-way hash; the IP itself is never stored), and we delete it after 24 hours. Signed-in members have no such limit.
What it will not do. MYCO does not diagnose, prescribe, or advise on medical conditions or medication — it refuses those questions.
Please don't type anything into MYCO you'd mind us seeing in a support conversation — treat it like an email, not a diary.
Security
The site is served over HTTPS only. Payments are processed by Stripe (PCI-DSS Level 1); we never store card data. Our database uses access rules so each part of the site can only read or write what it needs, and only administrators can see community member emails. Data is encrypted in transit and at rest, backups are encrypted, and sign-in uses a one-time email link — we never hold a password of yours, because we never ask for one.
If something goes wrong
If personal data is ever exposed, lost or accessed by someone who shouldn't have it, we will:
Contain it, work out exactly what was affected, and write down what happened.
Report it to the Swedish data protection authority (IMY) within 72 hours of becoming aware, unless it's clear there's no risk to anyone.
Tell you directly, without delay, if the breach is likely to put you at real risk — in plain words: what happened, what it means for you, and what we're doing about it.
Keep a record of every incident, including the ones we don't have to report.
If you think you've found a security problem on this site, please email robin@fungai.art — we'd genuinely rather hear it from you than find out later.
Children
The site is intended for adults. A Find Your Formula reservation request asks your age range; for anyone under 18, Robin removes every psychoactive herb before anything is prepared, or declines the request. Please complete it together with a parent or guardian if you are under 18. Some herbs documented in our materia medica are restricted to adults.
Changes to this policy
If we ever change this policy, the "Last updated" date at the top will change and a notice will appear on the homepage. Material changes will be announced via the newsletter.