Privacy Policy
Effective date: September 2026
1. Who We Are
LeafMeGrow ("we", "our", "us") respects your privacy. This policy covers both the LeafMeGrow mobile app and the website at leafmegrow.com, and describes what we collect, why, how long we keep it, and what choices you have.
We are the data controller for both:
Rua Fernando Gil Cardeira 2, 1 Esq, 8800-082 Conceição de Tavira, Portugal
Tax number (NIF): 333624769 · VAT ID: PT333624769
privacy@leafmegrow.com
These details match our Imprint. If you have questions about anything below, email privacy@leafmegrow.com and we will answer.
2. What We Collect
In the app
| Data type | What we collect | Why |
|---|---|---|
| Account information | Email address; if you sign in with Google or Apple, the email and basic profile your provider shares | Required to create and log in to your account |
| Profile information (optional) | Username, display name, bio, avatar photo, general location text | Shown to you in the app and used to personalise it |
| Photos you add | Plant photos, journal photos, support-request screenshots, and photos you submit for plant identification | To provide the garden, journal, support and identification features |
| Location data | One-time precise GPS during onboarding, from which we store only the derived zone such as Zone 7b; plus an approximate location rounded to roughly 1 km if you enable weather features | Growing-zone detection; local forecasts and weather-aware care adjustments |
| Care activity | Plants you add, care tasks and completion history, streaks, achievements | The core plant-care features, statistics and the optional leaderboard |
| Notifications | A push notification token and your notification preferences, including quiet hours, if you enable notifications | To deliver care reminders and weather alerts |
| Diagnostic data | Crash reports and performance metrics via Sentry, tagged with your user ID, email and username | To detect and fix stability issues, and to reproduce problems you report |
| Unsuccessful plant searches | If you search our plant database and it returns no results, we record the search text on its own. It is not linked to you — no account, device or session identifier is stored alongside it, so it cannot be traced back to you or joined to your other data. Searches that return results are never recorded. | To find out which plants are missing from our database and add them |
Stored only on your device and never transmitted: your onboarding completion status.
We do not collect your phone number, contacts, web browsing history or payment information. The app currently offers no purchases. The only search information that reaches us is the unsuccessful-plant-search record described above, which carries nothing identifying you.
On this website
- Waitlist registration. We collect your email address when you join the waitlist, and use it only to tell you about the launch. We will never sell or rent it.
- Analytics. We use Vercel Analytics, which is cookieless and privacy-friendly. It records pages visited, referrer, and approximate geographic region. It assigns no persistent identifier to your browser and collects nothing personally identifiable.
3. Device Permissions We Request
The app asks for these only when you use the feature that needs them. Each can be refused or withdrawn at any time in your device settings.
| Permission | When we ask | If you decline |
|---|---|---|
| Camera | When you photograph a plant, or scan one for identification | You can still choose existing images from your photo library |
| Photo library | When you attach an existing image to a plant, journal entry or support request | You can still take a new photo with the camera |
| Location | Once during onboarding to derive your growing zone, and for weather features | Choose your growing zone manually; weather features stay off |
| Notifications | When you enable reminders or alerts | The app works normally; you receive no push notifications |
We access the camera only to capture an image you have asked to capture. There is no background or continuous capture, and we do not access your photo library beyond the individual images you select.
4. How We Use Your Information
- Email. Account authentication and password recovery. We do not send marketing email to app users.
- Photos and content. Your photos, journal entries and plant records are shown only to you. This version of LeafMeGrow has no community, social or messaging features, so none of your content is published to other users. Identification photos are sent to our plant-identification provider to suggest a match.
- Location. The derived growing zone personalises planting timelines; the rounded coordinates fetch local forecasts. We never store your precise ongoing location.
- Push token. Used solely to deliver the notifications you enabled, and removed when you disable them or the token becomes invalid.
- Diagnostics. Crash and performance reports help us fix bugs. These reports are linked to your account — they include your user ID, email and username so we can reproduce a problem you report. They do not include your photos, journal content or precise coordinates.
5. What Other Users Can See
This version of LeafMeGrow has no community, social or messaging features, so there is only one place your details can appear to anyone else.
- The achievements leaderboard. If your profile is public, it shows your username or display name, avatar and score. If your profile is private, you appear anonymised.
- Nothing else you create — plants, photos, journal entries, care history — is visible to other users.
- Your email address, push token and location coordinates are never visible to other users.
6. Third-Party Services
We use the following services to operate LeafMeGrow:
- Supabase — authentication, database and photo storage. Privacy policy
- Sentry — crash reporting and performance monitoring. Reports are linked to your account. Privacy policy
- PlantNet — plant identification. Photos you submit for identification are sent to PlantNet for analysis. Privacy policy
- OpenWeatherMap — weather forecasts. Your rounded coordinates are sent to retrieve local weather. Privacy policy
- Expo — push notification delivery. Your push token and notification content pass through their service. Privacy policy
- Resend — sends the email containing your data export when you request one. Privacy policy
- Vercel — hosts this website and provides the cookieless analytics described above. Privacy policy
- Google and Apple sign-in — only if you choose them, and governed by your provider's policy.
7. Data Storage and Security
- Account data is stored on Supabase cloud servers with row-level security enforced on every database table.
- Photos are stored in private buckets and served through short-lived signed links, never public URLs.
- Passwords are hashed using industry-standard algorithms. We never store passwords in plain text.
- All communication between the app and our servers uses HTTPS.
- Old delivered in-app notifications are automatically deleted on a rolling schedule.
8. How Long We Keep Your Data
We keep personal data only as long as it is needed for the purpose it was collected for.
| Data | Retention |
|---|---|
| Account and content (profile, plants, care history, journal, photos) | Kept while your account is open. Deleted when you delete your account. |
| Deleted accounts | If you schedule deletion, your data is retained during a 30-day grace period so you can cancel, then permanently deleted. Immediate deletion removes it straight away. |
| In-app notifications | Deleted 30 days after you read them, and in all cases after 90 days. |
| Cached weather data | Held for about 4 hours against a coarse location area, then refreshed or discarded. It is not tied to your identity beyond that area. |
| Crash and performance reports | Retained by Sentry under their own schedule. We do not keep a separate copy. |
| Unsuccessful search terms | Deleted automatically after 90 days. Because they are stored without any identifier linking them to you, they are unaffected by account deletion — there is nothing in them to delete. |
| Waitlist email address | Kept until you ask us to remove it, or twelve months after public launch, whichever comes first. |
Backups may retain copies for a short period after deletion, until they age out of the normal backup cycle. They are not used to restore deleted accounts.
9. Your Rights and Choices
- Access and portability. Request a copy of your data in the app, at Profile → Settings → Data & Storage → Export My Data. It is emailed to your account address.
- Deletion. Delete your account in the app, either immediately or on a scheduled date you can cancel. See Delete Your Account for full instructions and an email route if you cannot sign in.
- Location opt-out. Location permission is optional. You can select your growing zone manually, and weather features simply stay off without it.
- Notifications opt-out. Disable any notification category in the app or in your system settings.
- Profile visibility. Set your profile to private at any time, which anonymises you on the leaderboard.
- Waitlist. Email us to be removed from the launch list at any time.
If you are in the UK or the European Economic Area
The UK GDPR and EU GDPR give you additional rights. You may request access to your data, rectification of inaccurate data, erasure, restriction of processing, portability in a machine-readable format, and you may object to processing carried out on the basis of our legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting processing already carried out.
Exercise any of these in the app where a control exists — export and deletion are both self-service — or by emailing privacy@leafmegrow.com. We respond within one month, as the GDPR requires. To protect you, we may verify that the address is yours before acting on an access or erasure request.
Legal bases we rely on
| Purpose | Legal basis |
|---|---|
| Creating and running your account, delivering the core plant-care features | Performance of a contract |
| Location, weather features, push notifications, camera and photo access; the waitlist email | Consent, withdrawable in device or app settings |
| Crash and performance diagnostics, and website analytics | Legitimate interests |
| Responding to legal obligations | Legal obligation |
International transfers
Our infrastructure providers may process data outside the UK and EEA. Where they do, transfers rely on the safeguards those providers offer, such as Standard Contractual Clauses.
Complaints
You have the right to complain to a data protection supervisory authority. Our lead authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt. You may also complain to the authority where you live or work — for example the Information Commissioner's Office (ico.org.uk) in the UK. We would always appreciate the chance to address your concerns directly first.
10. Cookies and Browser Storage
This website uses no analytics cookies. Vercel Analytics is entirely cookieless. The only browser storage we use is a theme preference in localStorage, which is strictly necessary to deliver the light and dark mode you select. Full detail is in our Cookie Policy.
11. Children's Privacy
LeafMeGrow is not directed at children under 13, and we do not knowingly collect personal information from them. This applies to the app and to the website waitlist alike.
Between 13 and 16 the rules vary by country. The GDPR sets the default age for consenting to a service like ours at 16, and allows each country to lower it to as little as 13. Portugal, where we are established, uses 13; some countries — Germany and the Netherlands among them — keep 16. If you are under 16, ask a parent or guardian before using the features that rely on consent: location, weather, notifications and camera access.
If you believe a child has given us personal data without that permission, contact privacy@leafmegrow.com and we will delete it promptly.
12. Changes to This Policy
We may update this policy as the product and our legal obligations evolve. When we do, we will update the effective date at the top of this page and notify users of significant changes in the app where possible. Continued use after changes are posted constitutes acceptance of the updated policy.
13. Contact
Privacy enquiries: privacy@leafmegrow.com. Legal matters: legal@leafmegrow.com. Support: support@leafmegrow.com.