Privacy Policy — Axion Wild

Who We Are
What Data We Collect
How We Use Your Data
Legal Basis for Processing (GDPR)
Third-Party Services
Location Data
User-Generated Content
Data Retention
Your Rights
Children's Privacy
Security
Changes to This Policy
Contact Us

    This Privacy Policy explains how One Axion ("we", "us", "our") collects, uses, and protects your personal data when you use the Axion Wild application and related services. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and Cyprus data protection legislation.
  

1. Who We Are

One Axion is the trading name of the operator of Axion Wild.

Registered address: Cyprus (full registration details to be updated upon formal incorporation)
Contact email: privacy@oneaxion.com

For the purposes of GDPR, One Axion is the data controller of your personal information.

2. What Data We Collect

2.1 Account Information

Email address (used for account creation and authentication)
Display name or username (if provided)
Password (stored in hashed form — we never see your plain-text password)
Account creation date and last login timestamp

2.2 Location Data

GPS coordinates when you log a foraging find or use location-based features
Approximate location used for proximity-based recipe suggestions
Location is only collected with your explicit consent and when the app is in use

2.3 Foraging Activity Data

Species names, locations, dates, and notes you log as foraging finds
Photographs you choose to attach to finds
Confirmations and flags you submit on other users' pins

2.4 Payment Information

Subscription tier and billing history
Payment card details are processed and stored exclusively by Stripe — we do not store card numbers, CVVs, or full card data on our servers

2.5 Device and Technical Data

Device type, operating system, and browser/app version
IP address (used for security and fraud prevention)
Push notification tokens (if you enable notifications)
App usage patterns (e.g., features accessed, session duration)

2.6 Communications

Messages you send to our support team
Feedback or reports you submit within the app

3. How We Use Your Data

Purpose	Data Used
Creating and managing your account	Email, display name, password hash
Providing the foraging map and community features	Location, foraging activity data
Generating AI-powered recipe suggestions	Species names, approximate location, month
Processing payments and managing subscriptions	Billing history, Stripe tokens
Sending service notifications and updates	Email, push notification tokens
Improving and developing the service	Aggregated, anonymised usage data
Security, fraud prevention, and abuse detection	IP address, device data, activity logs
Complying with legal obligations	As required by applicable law

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Legal Basis for Processing (GDPR)

Under GDPR, we rely on the following legal bases to process your data:

Contract performance: Processing necessary to deliver the service you signed up for (account management, subscriptions, core app features)
Legitimate interests: Security monitoring, fraud prevention, service improvement, and aggregated analytics
Consent: Location data collection and push notifications (you may withdraw consent at any time in your device or app settings)
Legal obligation: Where required by EU, Cypriot, or other applicable law

5. Third-Party Services

We use the following trusted third-party processors. Each is bound by data processing agreements and handles your data only as instructed by us:

Provider	Purpose	Location
Supabase	Database, authentication, and storage	EU (eu-central-1)
Netlify	App hosting and serverless functions	USA (SCCs applied)
Stripe	Payment processing	USA/EU (SCCs applied)
Anthropic	AI recipe generation (species names and location passed; no account data)	USA (SCCs applied)
OpenStreetMap / Leaflet	Map tiles (no personal data transmitted)	Global CDN

Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Location Data

Location data is among the most sensitive data we handle, and we take that seriously:

We only request location access when you actively use a location feature (logging a find, enabling proximity search)
We do not track your location continuously or in the background
Location data attached to your foraging finds is stored on our servers and, where you choose to share a find publicly, may be visible to other users at the pin-level precision you provide
You can log finds without sharing your exact location by adjusting the pin manually before saving
You can delete your finds and associated location data at any time from within the app

7. User-Generated Content

Content you post to Axion Wild (foraging pins, photographs, notes) may be visible to other users of the service. Please do not include sensitive personal information in public find descriptions or notes.

You retain ownership of content you create. By posting content, you grant One Axion a non-exclusive, royalty-free licence to display, host, and distribute that content within the Axion Wild service.

You can delete your content at any time. Deleted content is removed from public display promptly, though copies may persist in encrypted backups for up to 30 days before being permanently purged.

8. Data Retention

Data Type	Retention Period
Account and profile data	For the duration of your account, plus 30 days after deletion request
Foraging finds and pins	For the duration of your account; deleted on request
Payment and billing records	7 years (required for tax and accounting compliance)
Security logs and IP addresses	90 days
Push notification tokens	Until you disable notifications or delete your account
Support communications	3 years from last interaction
Anonymised analytics	Indefinitely (no personal data retained)

9. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure ("right to be forgotten"): Request deletion of your data, subject to legal retention requirements
Right to restriction: Request that we limit how we process your data in certain circumstances
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@oneaxion.com. We will respond within 30 days. You also have the right to lodge a complaint with the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

10. Children's Privacy

Axion Wild is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately at privacy@oneaxion.com and we will take steps to delete that information promptly.

Users aged 13–17 should use the service with the knowledge and consent of a parent or guardian.

11. Security

We implement industry-standard technical and organisational measures to protect your data, including:

Encryption in transit (TLS) and at rest
Row-level security on our database — each user can only access their own data
API keys and secrets stored exclusively as server-side environment variables — never exposed to the client
Regular security reviews and policy updates

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority as required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by displaying a prominent notice within the app at least 14 days before the changes take effect. Your continued use of Axion Wild after that date constitutes your acceptance of the updated policy.

The "Last updated" date at the top of this page always reflects the most recent version.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

Email: privacy@oneaxion.com
Subject line: "Privacy Request — Axion Wild"
Response time: We aim to respond within 5 business days and will always respond within the legally required 30 days

Contents