Privacy Policy

1. Who we are (data controller)

Plant Reminder is a plant care application that helps users manage plants, reminders, photos, notes, and optional social interactions. The controller responsible for your personal data is:

We have not appointed a Data Protection Officer because we are not required to. You can contact us at the email above about anything related to your personal data.

2. Data we collect

We collect the following categories of information:

Approximate location data

Only if you grant the location permission, the app reads your device location and stores an approximate position: coordinates rounded to about 1 km, city, country, and the time of the last update. Your device's own geocoding service (Apple or Google) converts the position into city and country. We use the approximate location to fetch local weather and adapt watering, seasonality, and other care logic. The app works without location; you can turn it off at any time in your device settings.

Notifications

If you allow notifications, we process your push notification token, your notification preferences, and the reminders queued for you.

3. AI features

Some features send content to specialized providers when you use them:

• Plant identification: the photo you choose is sent to Pl@ntNet to identify the species.
• Doctor, diagnosis, and AI questions: the photos and text you submit, together with basic information about the plant (such as its name, species, pot, watering history, country, and current temperature), are sent to OpenAI to generate an answer.
• Comment moderation: the text of photo comments and community content is checked with OpenAI before or shortly after publication. The result may mark content as allowed, under review, or blocked, and is stored with the content.

We do not send your email address or your exact location to these providers. Under OpenAI's API terms, data sent through its API is not used to train its models and may be kept for up to 30 days for abuse monitoring. AI answers are informational and may be wrong; they are not professional advice.

Automated moderation never closes or blocks an account on its own. If you think your content was blocked by mistake, write to us and a person will review it.

4. Social features and visibility

Plant Reminder includes optional social features. When you use them, some of your content or account information becomes visible to other users, depending on your privacy settings and the type of interaction.

What other users may see

• Your username, avatar, and certain profile information. If you have not chosen a username, others see an automatic pseudonym, never your email.
• If your profile is public, other users may discover your profile and see content you choose to share.
• Photos, comments, replies, and likes in feeds, profile pages, and comment threads.
• The plants you share with a friend for plant sitting, while sharing is active.
• Community questions are shown without your name.

Reporting, blocking, and moderation

You can report content or users and block users. Reports include the reported user, the related content, the reason, and the information needed to investigate. Content that receives several reports may be hidden automatically until we review it. We review reports manually and may remove content or restrict accounts that break our Terms of Use.

5. Purposes and legal bases

Under the GDPR, we process your data for these purposes and on these legal bases:

• Performance of our contract with you (Art. 6(1)(b) GDPR): creating and maintaining your account, syncing your plants, reminders and photos, the AI features you request, the social features you use, purchases and tokens, and replying to your requests.
• Consent (Art. 6(1)(a) GDPR): approximate location, push notifications, personalized ads, analytics and advertising storage where consent is required, and tracking on iOS (App Tracking Transparency). You can withdraw consent at any time without affecting earlier processing.
• Legitimate interests (Art. 6(1)(f) GDPR): app security, fraud and abuse prevention, content moderation, crash reporting, basic technical analytics, and keeping a minimal record of account deletions. Our interest is keeping the app safe, stable, and working; you can object as explained in section 10.
• Legal obligation (Art. 6(1)(c) GDPR): answering requests from authorities and complying with consumer, tax, and digital services rules.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. We do not sell your personal data.

6. Who we share data with

We share data only with these recipients:

• Supabase (servers in Frankfurt, EU): authentication, database, file storage, and backend functions.
• Google (EU and USA): Google Sign-In, Firebase Analytics, AdMob ads, and Google Play purchases.
• Apple: Sign in with Apple, push notifications, and App Store purchases.
• OpenAI (USA): AI answers, diagnoses, and content moderation (section 3).
• Pl@ntNet (France, EU): plant identification from photos.
• OpenWeather (United Kingdom): local weather from your approximate location.
• Sentry (data stored in Germany, EU): crash reports and technical diagnostics.
• Expo (USA): delivery of push notifications.
• Resend (USA): account emails (confirmation, password reset) and delivery of support messages.
• Cloudflare: hosting of our website and of the account confirmation and password reset pages.
• Other users, for what you choose to share in social features.
• Authorities, when the law requires it.

These providers act as our processors under data processing terms, except Google for advertising, which acts as an independent controller for its ads under its own policies. If the service is ever transferred to another owner, your data would be transferred under the same protections and we would let you know.

7. Ads and analytics

The app shows ads through Google AdMob and uses Firebase Analytics (Google Analytics) to understand how the app is used.

• In the EU, EEA, United Kingdom, and Switzerland, the app shows a consent form (Google's IAB TCF form) the first time you open it. Ad personalization, ad storage, and analytics storage follow your choices in that form. You can change them at any time from My Account > Privacy and ads > Manage Google privacy choices in the app.
• Before you choose, Firebase may record basic automatic events for that install, such as the first app opening and session start, with a technical install identifier. Ad storage and personalization stay off until you choose. If you refuse device storage in the form, analytics storage is turned off.
• On iOS, the app asks for App Tracking Transparency permission only after the consent form. You can change it in iOS Settings.
• User ID: only when analytics storage is allowed, we link analytics events to your internal account identifier (a random code, never your email or name).
• We do not send names, emails, or free text from your plants to Google Analytics.

If you refuse, the app keeps working and you may still see non-personalized ads.

8. Security

We use encrypted connections, access controls on every table so that each user can only read and change their own data, signed and expiring links for photos, secure storage of the session on your device, and restricted administrative access.

No method of transmission or storage is completely secure. If a breach affecting your data occurs, we will notify the authority and, where required, you.

9. Data retention

• Account, plants, and photos: while your account is active.
• Account deletion: when you request deletion, your account stays pending for 30 days so you can change your mind by signing in again. After that, your account, plants, photos, and other content are deleted. Residual copies in backups disappear when backups rotate.
• Deletion record: after deleting an account we keep a minimal record without email or name (internal identifier, dates, platform, country, and content counts) to prove the deletion and for aggregate statistics.
• Reports and moderation: for as long as needed to handle the case and prevent repeated abuse.
• Analytics: according to the retention configured in Google Analytics, at most 14 months for event-level data.
• Crash reports: deleted automatically by Sentry after its retention period, 90 days at most.
• Support emails: for as long as needed to handle your request and any follow-up.

10. Your rights and choices

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data. You can edit most of it directly in the app.
• Delete your account and personal data.
• Object to processing based on legitimate interests, and request restriction of processing.
• Withdraw consent at any time.
• Receive your data in a structured, machine-readable format (JSON and CSV, with your photos) and transmit it to another service.

To exercise these rights, write to myplantreminder@gmail.com from the email of your account. We will answer within one month. We may ask for information to confirm your identity.

Managing your settings

• Ads and analytics: My Account > Privacy and ads > Manage Google privacy choices (EU, EEA, UK, and Switzerland).
• Location, notifications, camera, photos, and tracking: your device settings.
• Profile visibility and social features: your profile settings in the app.

Deleting your account

You can delete your account from the app (My Account > Delete Account) or by following the steps on our account deletion page. If you only want to delete some data, see partial data removal.

11. International data transfers

Our database and files are stored in the EU. Some providers (Google, Apple, OpenAI, Expo, and Resend) may process data in the USA or other countries outside the European Economic Area. In those cases we rely on the EU-U.S. Data Privacy Framework when the provider is certified, or on the European Commission's Standard Contractual Clauses. Transfers to the United Kingdom rely on the European Commission's adequacy decision.

12. Minimum age

Plant Reminder is not directed at children. To create an account you must be at least 14 years old in Spain, or the minimum age of digital consent in your country (between 13 and 16 in the EU, 13 in the USA). Younger users may only use the app with the consent of their parent or legal guardian. If you believe a child has given us personal data without that consent, contact us and we will delete it.

13. Changes to this Privacy Policy

We may update this Privacy Policy to reflect legal, technical, or product changes. When we do, we update the effective date at the top of this page, and the app records which version you accepted the next time you sign in. If the changes are significant, we will tell you in the app.

14. Contact

For questions, support, or privacy requests, contact us at myplantreminder@gmail.com.

Website: plant-reminder.com