MushroomSquad Privacy Policy

Effective date: 2026-09-30

MushroomSquad is a fan-made companion app that helps Pikmin Bloom players find each other for cooperative Mushroom Battles. This policy explains what information the app collects, why, and what happens to it. We have tried to write it in plain language, because we would rather you actually read it.

The most important things first

MushroomSquad never connects to or reads Pikmin Bloom. Everything in the app — your in-game name, your battle strength, whether a battle went well — is reported by people, not pulled from the game.
We show no ads and we do not sell your personal data.
Our websites use no analytics trackers. The app measures how its features are used only on our own server; it contains no third-party analytics SDK.

What we collect

When you use MushroomSquad, we collect:

Sign-in information. You sign in through Firebase Authentication with a Google account or, on iPhone, iPad, and the web, with Sign in with Apple. With Google, Firebase keeps your email address, name, profile-photo link, and an account identifier on our behalf. With Apple, we do not ask for your name or email; Firebase keeps only an account identifier. Our own server stores only the account identifier. We never see or store a password.
Your Pikmin Bloom In-Game Name. Self-reported by you. It is shown to the players you are matched with, so a Host can identify you in the game's invite list.
Your Friend Code. Self-reported. Shared with the Host of a Team-Up you are matched into, so they can send you an in-game friend request.
Mushroom-battle Power values. Self-reported figures, one per mushroom type, used to match you into suitable battles.
Your timezone and notification-window preferences. Which hours of the day you agree to receive battle invitations, and your IANA timezone so daily limits reset at your local midnight.
Push notification tokens. A Firebase Cloud Messaging (FCM) device token so the server can send you notifications, stored with your device type, app language, app version, and when that device last connected.
Participation history and reviews. Which Team-Ups you took part in, the verdict filed for each match you helped with (SUCCESS, UNDERDELIVERED, or FAILED_TO_ATTACK), and your derived Good Review Rate, which is calculated over a rolling 90-day window; and, if you host, the star ratings and praise Helpers give you.
Screenshot evidence. If a Host reports that a Helper underdelivered, they must attach a screenshot of the in-game battle screen as evidence. These screenshots are stored for enforcement review; they are not shown to other players.
Things you write or report. In-app feedback, reports about players or Postcards (with any note you add), and the players you block.
Postcards (美片菇). If you attach a photo to a Team-Up you host, it is scanned automatically before publication (see processors below) and then shown to the players invited to that Team-Up. A published Postcard is served from a public address, so treat it as public. Do not upload anything you would not want a stranger to see.
Telescope. If you use Telescope to search photos of real-world places, we keep three kinds of data: saved state, which stays until you remove it (or, for unlocks, until you delete your account); your search phrases, for 30 days; and activity history, which expires on its own.
- Favorites (saved state): the photos you favorite, kept until you remove the favorite.
- Spot-type marks (saved state): your answer to "What's at this spot?" for a Telescope photo, whether or not you favorited it. The answer is Mushroom, Giant Flower, Detector, or Detector? (not a Mushroom or a Giant Flower, and not sure it's a Detector). It is kept until you choose "Clear my pick". Removing a favorite does not clear its mark. To clear a mark on a photo you can no longer find in Telescope, email [email protected] and we will clear it for you. Your mark counts toward the totals, and the spot label derived from them, that other players see on that photo in search results and in their favorites; neither ever shows who marked. "Detector" marks made before this policy's effective date now show as "Detector?". Older marks may also still record whether you confirmed a Detector postcard there; the app no longer asks or shows this.
- Coordinate unlocks (saved state): a record of which spots you unlocked, kept until you delete your account.
- Search phrases. When you type a search, it is sent to our translation provider (see processors below), which turns it into English. We keep only the English phrase it returns, for 30 days, and never store your original wording. If you searched in English, the phrase we keep may be the same as what you typed.
- Activity history, kept for 90 days, after which only anonymous totals remain, for 2 years. It records your searches (the area, filters, whether you typed it or picked a preset, time, device type, app version, how many results came back, and whether you then favorited or unlocked a result), the favorites you add, the unlocks you make (including reopening coordinates you already unlocked), your spot-type changes, and when you reach a usage limit. From the app version that adds them, it also records opening Telescope, opening a photo, copying coordinates, and opening the map. This history stays for its full 90 days even after you remove the favorite or mark it describes.
- Usage allowance. How many unlocks you have left, and any higher allowance we grant you, is kept while your account exists. The results a search returned are kept for 24 hours so you can page through them.
Other usage measurement. Besides Telescope, the app and our server record, on our own server only (never with an analytics company), how some features are used: opening the Collection Book, which categories, sets and items you view (with time on screen and scroll depth), reward reveals, and load errors; Movie editing, playback and export steps; how your battle sign-ups turned out; the hosting-time outlook you were shown when you created a battle; when you use Done for Today; and the days you use the app. These records are tied to your account (and, for the Collection Book and Movies, your device type). They are deleted after 90 days, or when you delete your account; after that only anonymous totals with no account or device identifiers remain, and we may keep those indefinitely. Views of a shared Movie by people who are not signed in are recorded without any account link (only a random ID for that viewing), for 90 days, then only as totals. Postcard upload and loading times are recorded only as anonymous counts.
Basic technical data. Ordinary server logs (such as IP address, request timestamps, and device/app information) generated when your app talks to our server, used for operating and securing the service, and the last time you used the app, kept while your account exists.

What we do not do

We do not connect to, read, or modify Pikmin Bloom or your Niantic account.
We do not show advertising.
We do not sell or rent personal data to anyone.
We do not run third-party analytics or advertising trackers on our websites, and the app contains no third-party analytics SDK. The app's usage measurement is first-party: it goes only to our own server.

Why we collect it

Matchmaking: matching Hosts who need battle help with Helpers who are ready right now, based on Power, notification windows, and review rate.
Reputation and enforcement: keeping the marketplace honest. Because we cannot see inside the game, reviews and screenshot evidence are how the community stays fair. Confirmed problems can lead to temporary matching freezes or, for repeated Host abuse, temporary bans.
Notifications: sending you battle invitations during the hours you chose, plus follow-up notices about battles you already joined.
Improving features: measuring whether Telescope and our other features help players, on our own server only; no third-party analytics.
Abuse prevention and service operation: rate limits, security, and debugging.

Where your data lives

The MushroomSquad server runs in Germany, behind Cloudflare, which provides content delivery and network protection. Authentication and push notifications are provided by Google Firebase, so that data is processed by Google under Google's Firebase privacy terms. Images you upload are scanned by Microsoft Azure AI Content Safety before they can be published. The text of a typed Telescope search is sent through OpenRouter to an AI model provider, only to translate it; they may process it outside the EU. All traffic between your device and our servers is encrypted in transit (HTTPS/TLS).

Who we share data with

Other matched players. When you are matched into a Team-Up as a Helper, the Host sees your In-Game Name, your Good Review Rate (or a "New" badge), and your Friend Code, so they can identify and invite you in the game. Helpers see the Host's In-Game Name and the battle details (such as mushroom type and Power Target). Helpers can also rate the Host (1–5 stars, plus optional praise). A Host's rating is shown to the Helpers they invite only as a total across several Helpers, never with the names of who rated. Screenshot evidence is never shown to other players.
Service providers (processors). Google Firebase (sign-in and push notifications), Cloudflare (network delivery, TLS, and protection against abuse), Microsoft Azure AI Content Safety (automated scanning of images you upload, before anyone else can see them), and OpenRouter (it receives the text of a typed Telescope search, never your name or account, and passes it to a provider of the AI model we chose, for translation only). They process data on our behalf to run the service; none of them may use it for their own purposes.
Your sign-in provider. If you sign in with Google or Apple, that company authenticates you under its own privacy policy and passes Firebase only what is described under "Sign-in information" above.
Legal requirements. We may disclose information if required to do so by law.

That is the complete list. There is no other sharing.

How long we keep it

Review verdicts feed a rating computed over a rolling 90-day window; older verdicts stop affecting your rate but may remain in your history and in enforcement records.
In-game friending is temporary by design: MushroomSquad's flow expects players to unfriend after a battle. (Friending happens inside Pikmin Bloom, which we do not control.)
Account and profile data is kept while your account exists.
Telescope data and usage measurement are kept for the periods listed under "What we collect" above.
Postcard images have their own limits, and none of them is indefinite. An image you started uploading but never finished is discarded after about 48 hours. An image awaiting a moderation decision is kept up to about 14 days, and a rejected one for about 7 days after that. An approved image you never attached to a battle expires after about 14 days. A published image is removed about 7 days after the battle it belongs to ends, and in any case no more than about 60 days after it was published. A copy quarantined by moderation is kept about 14 days if nobody ever ruled on it, or about 7 days after a ruling. The moderation record itself is deleted after about 6 months, or — where a rule violation was confirmed — kept in a reduced, anonymized form. Material we are legally required to preserve (for example a report to the authorities) is exempt from these windows and is kept as long as the law requires.
Account deletion: you can delete your account yourself, from inside the app: Profile → Account → Delete account. It takes effect immediately and permanently — there is no grace period and no undo. You leave any Team-Up you are in, any battle you are hosting that has not happened yet is cancelled, your Telescope favorites, marks, unlocks, searches and activity history, and your usage-measurement records, are deleted (anonymous totals already counted remain), and the images you uploaded are deleted (except any material under the legal hold described above). Your battle history stays without your name attached, as an anonymous placeholder, because other players' Team-Ups and reviews have to remain accurate. If you cannot reach the app — for example you are locked out of your sign-in account — email [email protected] and we will handle it for you; emailed requests are processed within 30 days, as data-protection law requires.

Your rights

You can delete your account at any time from inside the app (Profile → Account → Delete account). For everything else — access to, a copy of, or correction of the personal data we hold about you — email [email protected]; those requests are handled by a person, within 30 days. Deleting your account does not produce a copy of your data, so ask for one first if you want it.

Because our server is hosted in Germany, the EU General Data Protection Regulation (GDPR) applies to how we handle personal data. Under it you have rights of access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with a supervisory authority. We serve players internationally (including Taiwan, Japan, Hong Kong, and Korea), and we apply the same practices to everyone regardless of where you live.

Children

MushroomSquad is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us at [email protected] and we will delete it.

Not affiliated with Niantic

MushroomSquad is an independent, fan-made companion app. It is not affiliated with, endorsed by, or connected to Niantic, Inc. or Nintendo. "Pikmin Bloom" and related names are trademarks of their respective owners.

Changes to this policy

If we change this policy, we will post the updated version at this URL with a new effective date. Material changes during testing will also be announced to testers.

Questions? Email [email protected].