Privacy Policy

The controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Dennis van den Brock
Josef-Wolter-Weg 2
41569 Rommerskirchen
Germany
[email protected]

Account data: Email address, display name, language preferences, and a hashed password for password-based accounts. If you sign in with Apple or Google, we process the provider identifier and the email address and name supplied by that provider; we do not receive your Apple or Google password.

Plant data: Plant names, species, photos you upload, care notes, journal entries, measurements, and care history.

Household & location data: Household names and room/location names you create. Members of a shared household can see each other's plants. If you invite others, their email address is processed to send the invitation.

Geographic location (optional): When you choose to set or update a household location and grant permission, the app reads your current or recent device coordinates. We store them with the household and send them to WeatherAPI to retrieve local forecasts and weather history for care adjustments and alerts. We do not continuously track your movement. The household owner can remove the saved location in household settings; revoking device permission alone does not delete coordinates already stored.

Device & diagnostic data: Push notification token (if you grant permission). Production error reports and stack traces are collected via Sentry to detect and fix bugs (see §4).

Usage data: Basic server logs (IP address, timestamp, HTTP method/path) are retained for up to 7 days for security and debugging. With your explicit consent, we also collect pseudonymous product events such as sanitized screen names, registration and onboarding steps, completed feature actions, the source from which a Premium screen was opened, app version, and operating system. Product analytics never contains form contents, plant names, notes, email addresses, photos, or payment details. No product analytics event or analytics installation identifier is sent before you make a choice. You can withdraw consent at any time under More → Allow usage analytics.

Payment data: If you subscribe to Plantly Premium, in-app payment is processed by Google Play or Apple, with RevenueCat verifying and synchronizing subscription status. Existing Stripe subscriptions continue to be processed by Stripe. We process customer and subscription identifiers, plan, price, currency, billing periods, payment status, and related checkout and invoice records. Payment credentials are collected by the respective payment provider; we do not store full card numbers or card security codes.

AI features: Chat messages, conversation history, generated replies, and relevant plant or household context are processed to answer your questions. Context can include plant names, care history, journal entries, health-check results, and location information. Plant identification and health checks process the photos you submit. See the providers and AI diagnostics described below.

Sharing: Household members and invited plant sitters can access data within the scope of their role or invitation. Content you explicitly share outside Plantly is disclosed to the recipients you choose.

Website and support: Visiting the website generates technical request data such as IP address, requested page, and browser information. Account reset and deletion forms process your email address and confirmation tokens. If you join a waitlist, we store your email address, chosen platform, and signup time to handle that request. Support requests include your contact details and the information you send us.

Local storage and permissions: The app stores sign-in credentials, preferences, and cached content on your device. Camera and photo access support scans and uploads; notifications support reminders; optional location access supports household weather. Widgets can display plant and care information on your device. You can manage permissions in device settings.

We use your data exclusively to provide and improve the Plantly service:

• Authenticate your account and keep it secure.
• Store and sync your plant collection across devices.
• Fetch local weather data using your household's coordinates and adapt care schedules accordingly.
• Send care reminders via push notification (only if you opt in).
• Manage your subscription through Google Play, Apple, RevenueCat or Stripe.
• Identify plants and analyse plant health using PlantNet, and generate AI chat replies and care advice through OpenRouter (see §4).
• Detect and fix crashes using Sentry (see §4).
• With your consent, measure pseudonymous registration, onboarding, activation, and Premium funnels on our own infrastructure.

We do not sell your data or share it with advertising networks.

Hetzner (hosting) — Hosts our server infrastructure and processes the application data and technical request data needed to operate it. See Hetzner's privacy policy.

PlantNet (plantnet.org) — When you request plant identification or a health check, the submitted photos are sent to PlantNet's API for species or disease suggestions. PlantNet processes the image on their servers. See PlantNet's privacy policy.

OpenRouter and model providers — AI chat and AI-generated health advice send the relevant messages, conversation history, and plant context to OpenRouter, which routes them to the model provider used for that feature. Provider selection can vary. Do not include sensitive personal information that is unnecessary for plant care. Provider retention and training practices depend on the provider and contractual settings; we do not promise zero retention or a universal exclusion of model training. See OpenRouter's privacy policy.

Langfuse (AI diagnostics) — Our AI integration records chat inputs, retrieved context, generated replies, internal user and conversation identifiers, model information, and usage metadata in the configured Langfuse system for troubleshooting and quality review. These records can contain the text of your conversation. This processing is separate from optional product analytics.

WeatherAPI — Receives household coordinates from our server to provide weather forecasts and history. See WeatherAPI's privacy policy.

Cloudflare — Uploaded plant images are stored in private R2 storage and delivered through signed image URLs using Cloudflare Workers. Image delivery involves the requested image and technical request information, including the requesting IP address. See Cloudflare's privacy policy.

Apple and Google sign-in — If you choose these login methods, the selected provider authenticates you and supplies account information to Plantly. Their own privacy policies also apply: Apple and Google.

Stripe — existing subscriptions and their billing records continue to be processed by Stripe, Inc. Stripe is PCI DSS compliant. See Stripe's privacy policy.

RevenueCat, Apple and Google Play — RevenueCat, Inc. receives a random Plantly billing identifier and purchase and subscription data to verify store purchases and synchronize Premium access. Payment credentials are handled by the respective store. See RevenueCat’s privacy policy and the privacy policies of Apple and Google.

Expo (push notifications & updates) — Push notification tokens and notification content are routed through Expo and the Apple or Google push delivery systems. The app also uses Expo's over-the-air update system to deliver minor updates. See Expo's privacy policy.

Sentry (error reporting) — We use Sentry only for production error alerts; logs, performance tracing, profiling, metrics, and session replays are disabled. Error events may include stack traces, basic device information, your IP address, and your internal numeric Plantly user ID, but not your email address or name. For API and Backoffice errors, a JSON request body of up to 10 KB may be attached after credentials, tokens, payment data, images, files, and similar sensitive fields have been redacted; webhook and binary upload bodies are excluded. Sentry error events are retained for no longer than 30 days. See Sentry's privacy policy.

First-party product analytics — If you consent, the app sends a small, predefined event catalog to Plantly's API. We store these events in our own access-controlled ClickHouse database and display aggregate results and internal account-level usage summaries in our private Grafana instance. We do not use a third-party product analytics provider. The system has no touch autocapture, session replay, advertising profile, or GeoIP enrichment. A random installation identifier connects consented events; after sign-in, events may also contain our internal numeric user identifier.

• Art. 6(1)(b) — Contract performance: account and sign-in data, plant and household data, sharing you request, AI requests, account lifecycle requests, service-related support, and payment processing. Data required for these functions must be provided for the relevant function to work; optional features can be left unused.
• Art. 6(1)(f) — Legitimate interests: technical logs, Sentry crash reporting, and AI diagnostics for security, troubleshooting, and service reliability.
• Art. 6(1)(a) — Consent: requested waitlist notifications, product analytics, location access for weather-based care adjustments, and care push notifications. Analytics consent can be withdrawn in Plantly's settings; device permissions can also be withdrawn in your device settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
• Art. 6(1)(c) — Legal obligations: retaining required accounting records and complying with applicable legal duties.

Your data is retained for as long as your account is active. Account deletion immediately revokes access and starts an asynchronous, retry-safe removal process. Personal account data, sessions, devices, your journal entries, disease scans, AI conversations in the application database, analytics data, and associated files are removed. This application deletion process is separate from retention of diagnostic records and backups. A household with no other members is deleted with its plants and files. A shared household must be transferred to another active member first; its shared plant and care history remains with that household, while your attribution is removed.

Stripe and Google Play subscriptions are cancelled before account deletion. You must cancel Apple subscriptions yourself in the App Store; immediate account deletion remains available and does not end Apple billing. Billing records that we are required to retain by law are stored separately from the deleted account with a pseudonymous reference (for the statutory period applicable to the particular record).

Pseudonymous first-party product events are automatically deleted after 365 days. With the updated analytics consent, account-linked daily usage totals and minimal hashed delivery receipts are retained until account deletion. These contain predefined actions and counts, never journal text, chat content, photos, email addresses, or payment details. Withdrawing consent stops further collection. The separate consent record is retained while needed to demonstrate and enforce your choice. Basic server logs are retained for no longer than 7 days.

Under the GDPR you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — request that we limit processing.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests, You can object to direct marketing at any time.

You can create a machine-readable export or start deletion in the Plantly app under More → Account & data. Account deletion is also available on the public account deletion page. You can also object or make other requests by emailing [email protected]. We will respond without undue delay and normally within one month. If an extension is permitted because of the complexity or number of requests, we will explain it within that month.

You have the right to lodge a complaint with a supervisory authority. For our location in North Rhine-Westphalia, you can contact Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). You may also contact the authority in your usual place of residence, place of work, or place of the alleged infringement.

We use industry-standard measures to protect your data: HTTPS everywhere, secure password hashing, JWT tokens with short expiry, and access-controlled infrastructure. No method of transmission over the internet is 100% secure — we cannot guarantee absolute security, but we take it seriously.

Plantly is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Some service providers and model providers operate outside the European Economic Area, including in the United States. Applicable GDPR transfer requirements must be met, for example through an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. Contact us for information about the safeguards applicable to your data and how to obtain a copy.

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice. The date at the top of this page always reflects the latest version.