Privacy Policy

Who we are

Mold Buster is a consumer microbial testing company based in Maryland. Our website is mold-buster.com. If you have questions about this policy, email us at hello@mold-buster.com.

What this policy covers

This policy covers two different things, and they collect different information:

• This website — where you can read about Mold Buster and sign up for early access.
• The Mold Buster mobile app — where you create an account, photograph your petri plates, and receive a report on what grew.

Where a section applies to only one of them, it says so. Everything else applies to both.

What we collect on this website

Two things on this website collect information: signing up for early access, and ordering a kit. They are not the same, so they are listed separately.

• If you sign up for early access: your email address. That is the only thing the form asks for.
• If you order a kit: your name, email address, and shipping address. Stripe collects these on its own checkout page and passes them to us, so that we can send your kit and email you about the order.
• On any visit: basic analytics data about your visit, meaning pages visited, time on page, and general location (country/region level only). We use Plausible Analytics, which does not use cookies and does not collect personal information.

Your card details are entered on Stripe's checkout page and never reach this website. Mold Buster does not receive or store your card number.

What we collect in the app

The app requires an account. Some of what follows is required to make it work; the rest you choose to give us.

• Account: your email address and a password. Passwords are handled by our authentication provider and are stored only as a cryptographic hash — we never see or store your actual password.
• Profile (all optional): first and last name, phone number, and either a zip code or a city and state. The app asks for one form of address, not both.
• Your kits: the code printed on your kit, and — for a kit from another company — the company name you type in yourself. We do not offer a list of other companies to choose from.
• Your plates: the room you tag each plate with, and any note you choose to write about it. Both are free text, so please do not put anything in them you would not want us to hold.
• Your photos: the pictures you take of each petri plate, at full resolution, plus a cropped copy the app generates to display your results. We record when your phone took each photo and when our server received it, because the time between your first and second photo affects how the result is read.
• Your results: the colony counts, types, and locations our model detects on each plate, the severity we calculate from them, and the PDF report we generate.

The app contains no advertising, no third-party analytics, and no tracking of any kind. It does not ask for your location, and it does not read your photo library — it only receives the pictures you take inside the app itself.

How we use your information

• To create and run your account, and to keep you signed in.
• To analyze your plate photos and produce your report.
• To notify you inside the app when a report is ready, when a kit is archived, and when a free report becomes available again.
• To email you about your kit reservation and launch updates, if you signed up on this website.
• To improve our detection models, using photos handled as described in the next two sections.

We do not sell your information. We do not share it with advertisers. We do not use it to build a profile of you or to target you with anything.

Your plate photos

Your photos are stored privately and are readable only by your own account. To produce your report, a photo is sent to our analysis service, which returns the detected colonies and sends nothing back to us about you. Your photos are not published, not shared with other users, and not given to third parties for their own purposes.

We also use plate photos to improve the models that read them. While you have an account, those photos remain linked to you and you can have them deleted. What happens if you delete your account is different, and is described immediately below — please read it before deleting.

Deleting your account, and what we keep

You can delete your account at any time from the Account screen in the app. You will be asked to re-enter your password to confirm. When you do, we permanently delete:

• Your account and sign-in credentials
• Your profile, including your name, phone number, and address information
• Your plates, room tags, notes, results, reports, and notifications
• Your photos and PDF reports, including the copies held in our file storage

This is a real deletion, not a deactivation, and it cannot be undone.

The one thing we keep, and why

Before your account is deleted, we keep a de-identified copy of your plate photos to continue training our detection models. Before a photo is kept, we remove its embedded metadata — including any GPS coordinates and information about the device that took it — and store it under a random identifier in a separate location with no reference to you, your account, or your plates. The only information kept alongside it is the first three digits of your zip code and your state, which tell us roughly what climate and region a sample came from without identifying a household.

You should know two things about this. First, because the retained copy is deliberately not linked to you, we cannot find it again afterwards — which means that once your account is deleted we are unable to identify or remove your images on request. Second, removing metadata cannot change what is visible in the picture itself: if you have written something on the dish, such as a room label in your handwriting, that writing stays in the retained image.

If you would prefer that we not keep your plate images, email us before you delete your account and we will remove them while they can still be identified as yours. If you have already deleted your account, contact us anyway and we will tell you honestly what we can and cannot do.

Your rights

You can view and edit your profile at any time in the app, and delete your account as described above. Depending on where you live, you may also have the right to request a copy of your data, to ask us to correct it, or to object to how we use it. We do not yet offer a self-service data export; email us and we will handle the request by hand.

If you only signed up on this website and never created an app account, email hello@mold-buster.com with the subject line "Delete my data" and we will remove your record within 7 days.

Third-party services

We use a small number of third-party services to operate the website and the app. Each one only receives what it needs to do its job:

• Supabase — the app's database, sign-in, and file storage. Your account, profile, plates, photos, and reports are held here, protected by access rules that scope every record to its owner. Supabase's privacy policy is at supabase.com/privacy.
• Modal — the service that runs our colony-detection model. It receives a plate photo, returns what it found, and does not receive your name, email, or any other account information. Modal's privacy policy is at modal.com/privacy.
• Stripe — payment processing for kit orders placed on this website. Checkout runs on Stripe's own hosted page, so your card details are entered there and never reach our site. Stripe collects your name, email address, shipping address, and payment details to take the payment, calculate tax, and let us ship your kit. It tells us your name, email address, shipping address, and the amount paid. It never gives us your card number, and we never store one. Stripe's privacy policy is at stripe.com/privacy.
• Resend — email delivery and contact list management for this website. Two things go through Resend. When you sign up for early access, your email address is stored in its contact platform. When you order a kit, Resend sends your confirmation email, and sends us an order notification containing your name, email address, shipping address, and the amount paid. Resend's privacy policy is at resend.com/privacy.
• Plausible Analytics — cookieless, privacy-preserving analytics for this website only. It is not used in the app. No personal data is collected. Plausible's policy is at plausible.io/privacy.
• Vercel — website hosting. Vercel's privacy policy is at vercel.com/legal/privacy-policy.

These providers process data on our behalf and are not permitted to use it for their own purposes. They operate in the United States, so if you use Mold Buster from elsewhere, your information will be processed there.

How we protect your information

• All traffic between the app, this website, and our servers is encrypted in transit.
• Photos and reports are held in private storage. Nothing is publicly accessible by URL.
• Access rules are enforced by the database itself, per record and per file, rather than only by the app — so a request for someone else's data is refused at the source.
• Your sign-in session is stored in your device's Keychain, the area iOS reserves for credentials.

No system is perfectly secure, and we will not claim otherwise. If we ever discover a breach affecting your information, we will tell you.

Email communications

By submitting your email address on this website, you agree to receive transactional emails about your reservation and launch-related updates from Mold Buster. You can unsubscribe at any time using the link at the bottom of any email we send. Emails about your account itself — such as resetting your password — are part of the service and are not marketing.

Cookies

This website does not use tracking cookies. Plausible Analytics, our analytics provider, is cookieless by design. We do not display a cookie consent banner because there is nothing to consent to. The app does not use cookies at all.

Children

Mold Buster is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will email registered users and update the "Last updated" date at the top of this page.

Contact

Questions about this policy: hello@mold-buster.com