Privacy

Privacy policy

Last updated Oct 26, 2026.

Shroom Labs runs shroomlabs.io and api.shroomlabs.io. This page says what we collect, why, who else sees it, how we keep it safe, and how to get it deleted. We don't sell your data and we don't run ads or ad trackers. We use Google Analytics to count visits.

What we collect

• Your account. Your email, username, and display name. If you sign in with Google, Google tells us your email and your Google account id. If you use a passkey, we keep only its public half, which can't be used to sign in. If your account has a password, we keep only a salted hash of it, never the password itself.
• Your chambers. If you link a chamber, we keep its hardware id and certificate, its name, its firmware version, and the readings it sends: temperature, humidity, light, fan, and its other sensors and settings. We also keep the Profile and stage it's running, the commands sent to it by you or by Autopilot, and when it last checked in.
• What you post. Profiles you build, ratings, grow reports, and grow photos you upload.
• Feedback and messages. What you send through the beta feedback form, plus your username, user id, the chamber you picked, its firmware version, the page you were on, your browser, and a screenshot if you add one. What you send through the contact form: your name if you give it, your email, and your message.
• Payments. Your plan, its status, when it renews, and your Stripe customer id. You enter card details on Stripe's own page. We never see or store your card number.
• Grow Coach. If you use it, your questions, its answers, and a log of what Autopilot looked at and changed.
• Security records. For each sign-in session we keep your IP address and browser name. We log sign-ins and account changes with the IP address so we can spot trouble. IP addresses are also used to limit spam and abuse.

Cookies and browser storage

• One cookie keeps you signed in. It can't be read by scripts and only travels over HTTPS.
• Your browser's local storage keeps your sign-in, the last readings it saw from your chambers so pages load fast, and whether you like Celsius or Fahrenheit. Signing out clears both your sign-in and the saved readings.
• The sign-up page uses Cloudflare Turnstile to tell people from bots.
• Google Analytics sets a Google cookie so we can count visits and see which pages help people. It gets the page address without any codes or sign-in links, your browser, and a rough location from your IP address. It also gets a few actions with no personal details attached: which profile or product you looked at or bought, a checkout started, canceled, or stopped (for example because you weren't signed in), a sign-in or new account and which method, a chamber linked, and a profile applied. The order number it gets is the Stripe checkout id, never your email, name, card, or chamber id. It isn't used for ads. It's off on sign-in pages, alert email links, and Off-menu pages. You can block it with any tracker blocker or Google's opt-out add-on.
• No ad cookies.

How we use it

Only to run Shroom Labs: to sign you in, show your chambers and send them settings, run Autopilot if you turn it on, send the emails you asked for, bill your plan, keep accounts safe, fix bugs, and answer you. We don't use your data for ads and we don't sell or rent it.

Who else sees it

These companies process data for us, only to run the service:

• Cloudflare runs our API, database, photo storage, nightly backups, live chamber connections, and DNS. It also runs the Turnstile bot check and, when Grow Coach chat is on, the AI models it uses.
• Netlify hosts this website. It also stores feedback and contact form messages and emails them to us.
• Resend sends our email: sign-in links and grow alerts. It gets your email address and the message.
• Stripe handles payments. It gets your email and the payment details you type into its checkout page.
• Google runs Google Analytics, which counts visits to this website. It also handles sign-in if you choose Sign in with Google.
• TypeSafe is an AI decision service Autopilot can use to judge small setting changes. It gets your chamber's recent readings and grow settings only. It never gets your name, email, or account id.
• Pwned Passwords (Have I Been Pwned). When a password is set, we send the first 5 characters of its hash to check it against known leaks. The password itself never leaves our server.

Things you publish, like Profiles, grow reports, approved photos, and your username next to them, are public. We may also share data when the law requires it, or to protect people or the service from harm. If Shroom Labs is ever sold or merged, your data would move with it under this policy, and we'd tell you first.

How it's shared

Each company above gets only the parts it needs, sent straight from our servers or your browser to theirs over encrypted HTTPS. We don't email, export, or hand over customer lists. These companies may store data in the United States and other countries.

How we keep it safe

• Every connection to the site, the API, and linked chambers uses HTTPS.
• Each linked chamber gets its own certificate, so only that chamber can speak for it. Firmware updates are signed, and chambers check the signature before installing one.
• Sign-in sessions and email links are stored as hashes. Passwords are salted and hashed.
• Photos sit in private storage and are only served through our API to people allowed to see them. Backups sit in a separate private bucket.
• Our server logs leave out request addresses and headers, so sign-in links are never logged.
• Sign-ins, sign-ups, and other sensitive actions are rate limited.

No system is perfect. If we learn of a breach that affects your data, we'll tell you by email.

How long we keep it, and deleting it

• We keep your data while your account is open.
• Unlinking a chamber deletes its readings and command history.
• Download it. Go to Account, Your data and tap Download my data. You get one file with your account, chambers, profiles, alerts, and purchases.
• Delete it. Same place. Deleting your account removes your profile, posts, photos, alerts, sessions, Grow Coach history, and chamber history from our database right away, and unlinks your chambers. They keep growing on your own Wi-Fi. If you have a Grow Coach plan, cancel it first.
• Nightly backups are kept for 30 days, then deleted.
• We keep one line saying an account was deleted, with the IP address but not your user id, so abuse can still be traced.
• Stripe keeps its own payment records as the law requires. Feedback and contact messages stay with Netlify until we delete them. Ask and we will.
• Turn off alert emails any time from the link in each one, or in Account.

Kids

Shroom Labs is for adults. You need to be 18 or older to make an account. If we learn someone younger made one, we delete it.

Changes

If we change this page in a way that matters, we'll email account holders before it takes effect and update the date at the top.

Questions or requests

Use the contact form. A real person reads every message. You can also read our Terms of Service.