PlantPeepalPlantPeepalAndroid updates

Privacy Policy

Last updated: June 18, 2026 · Version 1.1

This policy explains what PlantPeepal collects, why we collect it, how we use it, and the choices you have.

What we collect

  • Account data: email, username, display name, optional bio and avatar.
  • Location: city and country only. We do not collect your GPS coordinates or precise location. You can change or remove your city in Settings at any time.
  • Plant data: plants you add, photos you upload, captions, notes, health analyses, and care actions.
  • Activity: posts, comments, likes, follows, forum questions and answers, content reports, and which features you use.
  • Device: push notification token (so we can send notifications), device type and OS version (for example iOS or Android), and crash diagnostics.
  • Subscription: your subscription tier and status. We do not store your payment card details — purchases are handled by the Apple App Store or Google Play.

We do not sell your personal data.

Why we collect it and how we use it

  • Operating the service — letting you sign in, post, follow others, and use AI features.
  • Improving AI quality — when you opt in, your plant photos and the optional feedback you submit on AI diagnoses (helpful / not helpful, what was actually wrong) help us train better disease detection models. Photos may include embedded metadata such as a capture timestamp; we do not use photo metadata to identify you.
  • Aggregated analytics and crash diagnostics — understanding feature usage and app stability in aggregate, not tied to your identity.
  • Communications — service announcements, weather and outbreak alerts when you opt in, care and streak reminders, and push notifications for social activity.

Legal bases for processing (EEA/UK)

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, we process your personal data only when we have a legal basis to do so:

  • Performance of a contract — to provide the account, social, and AI features you ask for under our Terms.
  • Consent — for optional processing such as weather and outbreak alerts, push notifications, and using your photos and feedback to improve our AI models. You can withdraw consent at any time in Settings, which does not affect processing already carried out.
  • Legitimate interests — to keep the service secure, prevent abuse and fraud, and understand aggregate feature usage, balanced against your rights and freedoms.
  • Legal obligation — to comply with applicable laws and respond to lawful requests.

Automated analysis and AI

Our AI features (plant identification, disease detection, and care suggestions) produce automated analyses to assist you. These are informational only — they do not produce legal or similarly significant effects about you, and you remain free to disregard them. Always use your own judgment; see our AI disclaimer for limitations.

Third parties we share data with

We use the following service providers. We share only what each needs to deliver its function:

  • Supabase — hosts our database, authentication, file storage, and serverless functions.
  • Google (Gemini API) — receives plant photos and prompt context when AI features are used. This processing is governed by Google's own privacy policy and terms; we are not responsible for how Google handles data once it is received.
  • WeatherAPI.com — receives your city (not coordinates) when fetching local forecasts for weather alerts and care plans.
  • Expo Push Notification service — relays push notifications to your device.
  • RevenueCat — manages in-app subscriptions; receives an app-assigned user identifier and your purchase and subscription status. Your payment card details are handled by the Apple App Store or Google Play, not by us or RevenueCat.
  • Sentry — receives crash reports and aggregated performance data to help us diagnose and fix app issues.

We have agreements that require these providers to handle your data appropriately.

International data transfers

We and our providers (including Supabase, Google, and Sentry) may process and store your data on servers located outside your country, including in the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent UK mechanisms.

Photo retention

Photos you upload are retained as long as you keep your account. When you delete a plant, its photos are deleted. When you delete your account, your photos are removed from active storage and from any backups within a reasonable retention period.

How long we keep your data

We keep personal data only as long as needed for the purposes described in this policy:

  • Account and profile data — while your account is active. When you request deletion, we sign you out and schedule your account for permanent deletion after a 30-day grace period; you can cancel during that period by signing back in. We may retain limited records after deletion where required to comply with law.
  • Plant photos and content — as described in Photo retention above.
  • Crash diagnostics and analytics — retained in de-identified or aggregated form.
  • Backups — once data is deleted, residual copies may persist in encrypted backups maintained by our hosting provider until they are overwritten on that provider's standard backup cycle.

Your rights

Depending on where you live, you may have rights to:

  • Correct inaccurate information;
  • Delete your account and personal data;
  • Object to or restrict certain processing;
  • Withdraw consent at any time, where we rely on your consent;
  • Lodge a complaint with your local data protection authority.

You can exercise most of these rights from Settings — update your profile, change or remove your city, opt out of weather and outbreak alerts, turn off AI training use, manage reminder notifications, or delete your account. For anything else, email privacy@plantpeepal.com. We will not discriminate against you for exercising any of these rights, and we respond to verified requests within the time required by law (generally within 30–45 days). You may use an authorized agent to submit a request on your behalf.

California privacy rights

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share your personal information as those terms are defined under California law, and we do not process it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16. You will not be discriminated against for exercising these rights. To make a request, email privacy@plantpeepal.com.

Cookies and tracking

Our mobile app does not use advertising cookies or third-party ad trackers. Our website uses only the cookies strictly necessary to operate it and keep you signed in. We do not use your data for third-party advertising.

Children

PlantPeepal is not intended for users under 13 (or under 16 in the EU and other applicable jurisdictions). We do not knowingly collect personal data from children. If you believe a child has signed up, contact us and we will remove the account.

Security

We use industry-standard practices including TLS in transit, encrypted storage at rest, and Row-Level Security on our database. No system is perfectly secure; please use a strong, unique password and keep it private.

Changes

We may update this policy. If we make material changes we will notify you in-app and ask you to review and accept the updated policy before continuing to use the app.

Contact

Email privacy@plantpeepal.com with privacy questions or requests.