The short version
- We do not run advertising trackers, and we do not set cookies of our own.
- We only ask for your name and email when you register for an event, send us feedback, or join Common Ground.
- Anything you post in Common Ground is visible to other members, and files you upload can be opened by anyone who has the link.
- You can ask us to show you, correct, or delete your data at any time through our contact form.
- If we get it wrong, you can complain to the National Privacy Commission.
Who we are
Mycelium Learning is an independent permaculture education project based in the Philippines. We publish free learning material at mycelium-learn.com and run Common Ground, a community discussion space for permaculture practitioners.
Under the Data Privacy Act of 2012 (Republic Act No. 10173) we are the personal information controller for the data described on this page. Questions about privacy go to Joaquin Riego, founder, through our contact form. The address is also published at the bottom of this page.
This policy covers mycelium-learn.com, the Common Ground forum, and our event registration pages. It does not cover other websites we link to, including YouTube, Instagram, and registration forms run by partner organisations.
What we collect
What we collect depends on how you use the site. If you are only reading, you do not give us any personal information.
Reading the site
You do not need an account to read anything. We do not run Google Analytics, Meta Pixel, or any similar tracking script. Our host, Vercel, keeps standard request logs that include your IP address, browser type, the page you asked for, and the time. These are used to deliver the site and to spot abuse.
Pages load fonts from Google Fonts, and our video pages embed YouTube in its no-cookie mode. Both mean your IP address reaches those companies when a page loads. Video and image files are served from our own storage on Cloudflare R2.
Registering for an event
Our registration form asks for your full name and email address, and has a checkbox for whether you want to hear about future events. We email you a confirmation with the joining details, and we email ourselves a copy so we know who is coming. Registrations live in our Gmail mailbox. There is no registration database.
Sending feedback
The feedback form asks for your first name, last name, email address, and your message. The form is delivered through Formspree, which passes it to our inbox.
Joining Common Ground
Creating an account requires an email address, a password, and a display name. You may also add where you are from and your level of practice, both of which are optional to fill in honestly and are shown to other members. We assign your avatar a colour. Your password is stored by Supabase in hashed form and is never visible to us.
Using Common Ground
Once you are in, we store what you create: your agree, disagree and pass answers to statements, the discussions you post, your replies, your emoji reactions, notifications generated for you, and any files you upload. Uploaded files keep their original filename, and we do not strip metadata such as camera or location information that your images may carry. Please remove anything sensitive before uploading.
Reporting a bug
Bug reports are sent without your account attached. They do include your message, the page you were on, and your browser's user agent string, because without those we cannot reproduce the problem.
Emailing us
If you write to us directly we keep the message and your address so we can reply and follow up.
Photographs at events
We take photographs and video at in person events and we publish some of them on this site and on social media. Some of our events are family days, so these images include children. Where children are photographed we rely on permission from a parent or guardian. If you or your child appears in something we published and you want it taken down, email us and we will remove it.
Why we are allowed to
The Data Privacy Act requires us to have a lawful basis for every use of your personal data. Ours are set out below.
| What we do | Data involved | Our lawful basis |
|---|---|---|
| Deliver the website and keep it working | Request logs | Our legitimate interest in running a working, secure site |
| Register you for an event and send joining details | Name, email | Steps taken at your request so you can attend |
| Tell you about future events | Email, your opt in | Your consent, withdrawable at any time |
| Run your Common Ground account | Account details and everything you post | Your consent, and providing the service you signed up for |
| Reply to feedback and email | Name, email, your message | Your consent in writing to us |
| Fix bugs | Report, page, user agent | Our legitimate interest in a working site |
| Publish photographs of events | Images of participants | Consent, and for children the consent of a parent or guardian |
Where we rely on consent you can withdraw it at any time, and withdrawing it does not make what we did beforehand unlawful.
How long we keep it
| What | How long |
|---|---|
| Event registration emails | 12 months after the event, then deleted |
| Feedback messages and direct email | 12 months, unless we still need it to help you |
| Common Ground account and profile | For as long as your account exists |
| Posts, replies, answers and uploads | Until you delete them, or until you ask us to |
| Bug reports | 12 months |
| Website request logs | Held by our host for their standard log period |
| Event photographs | Kept as a record of the event, removed on request |
When you ask us to delete your account we remove your profile and log in details within 30 days. We may keep data longer where we need it to resolve a dispute or to meet a legal obligation, and if we do we will tell you why.
What other people can see
Common Ground is a community space, so parts of it are deliberately visible to other members. Please read this part before you post.
- Your display name, your location if you added one, and your level of practice are shown to other signed in members.
- Your discussions, replies and reactions are shown with your display name.
- Your answers to statements are stored against your account. The opinion map presents them grouped rather than labelled, but they are not anonymous to us, and the data used to draw the map is sent to other members' browsers. Treat your answers as visible, not private.
- Files you upload are given a public web address. Anyone with that link can open the file, whether or not they have an account.
How we protect it
The site is served over an encrypted connection. Passwords are handled by Supabase, our accounts provider, which stores them hashed so that we never see them. Mycelium is run by a very small team, so the number of people who can reach member data is kept to a minimum. Registrations and feedback arrive in a mailbox protected by two step verification.
No system is completely secure, and we will not pretend otherwise. If a breach affects your personal data we will notify you and the National Privacy Commission as the law requires.
Your rights
The Data Privacy Act gives you the following rights over your personal data.
To be informed
To know that we are processing your personal data, and what we do with it. That is what this page is for.
To access
To ask for a copy of the personal data we hold about you, and to know where we got it.
To object
To tell us to stop processing your data. If our only basis was your consent, we stop.
To correct
To have anything inaccurate fixed. You can edit your own Common Ground profile and posts at any time.
To erasure or blocking
To ask us to remove, delete or suspend your data where it is outdated, unnecessary, or processed without a lawful basis.
To damages
To be compensated if you suffer harm because of inaccurate, unlawfully obtained, or unauthorised use of your data.
To data portability
To receive a copy of the data you gave us in a format you can take elsewhere.
To complain
To bring a complaint to the National Privacy Commission if you think we have handled your data wrongly.
To use any of them, send us a request through our contact form and tell us what you want. We may ask you to confirm your identity first, so that we are not handing your data to someone else. We reply within 30 days, and if your request is complicated we will tell you before that deadline how much longer we need.
Children and young people
Our learning material is written for a general audience, and some of our events are designed for families. Under Philippine law a person under 18 cannot give valid consent to the processing of their own personal data, so a parent or guardian has to give it for them.
Common Ground is intended for adults. If you are under 18, please ask a parent or guardian before you create an account. If you are a parent and you would like your child's account, posts, or photographs removed, email us and we will do it.
Changes to this policy
When our practices change we update this page and change the date at the top. If a change materially affects how we use your personal data we will say so on the site rather than quietly editing the text.
Contact and complaints
For anything on this page, including requests to see, correct, or delete your data, write to us first. We would rather fix it directly.
Mycelium Learning
Privacy contact: Joaquin Riego, Founder
The quickest route is our contact form, which reaches the same inbox.
We do not print our email address on this page, because a published address is picked up by spam and phishing robots within days. If you would rather write to us directly, press the button and the address appears in your browser.
If you are not satisfied with how we handled your concern, you can bring it to the regulator.
National Privacy Commission
25th to 27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City, Philippines
Enquiries: info@privacy.gov.ph
Complaints: complaints@privacy.gov.ph
Telephone: +632 5322 1322
privacy.gov.ph