This policy explains what PlantScan collects, why, and who it's shared with. PlantScan is built to collect as little as possible: your plant photos and care data stay on your device (and, if you enable it, in your own iCloud account) — we do not operate a database of your plants, and we cannot see them.
Account info: if you sign in with Apple, we receive the identifier Apple assigns your account for this app and, only if you choose to share it, your name. If you sign in with email, Firebase Authentication (operated by Google) stores your email address and a securely hashed password on our behalf — we never see or store your plaintext password.
Content you create: plant photos you analyze, the identification/diagnosis results, care notes, and your Botanist chat messages (including any photos you attach) — see "Where your data is stored" below for exactly where this lives.
Support requests: if you email us, we receive whatever you include in that email (e.g. your email address and message).
Request metering: to enforce free-trial and subscription limits, our server records, per account, how many identification/chat requests you've made and when your subscription (if any) expires. It does not store the content of those requests.
Device identifier for fraud prevention: to prevent the free trial from being reset by deleting and recreating an account on the same phone, we also record a per-device identifier (Apple's identifierForVendor) against the number of free requests used on that device. This identifier is specific to this app and this device — it isn't shared with, or readable by, other apps or other developers.
Subscription receipts: if you subscribe, Apple's StoreKit sends us a cryptographically signed transaction (proving the purchase happened) so we can verify it server-side; we store the product you purchased and its expiry date.
We do not collect your precise location, contacts, health data (outside of what you voluntarily photograph and ask about), advertising identifiers, or browsing history. We do not use any advertising or analytics SDKs, and PlantScan does not track you across other companies' apps or websites.
When you analyze a plant, run a health check, or chat with the Botanist, the photo and/or text you provide is sent — through our server, which never stores it — to OpenAI's API to generate the identification, diagnosis, or answer. We use this solely to give you that response; we do not use it to train our own models, and we do not sell it. OpenAI processes this data under its own privacy policy and API data-usage terms, which (at the time of writing) exclude API inputs from being used to train OpenAI's models by default. We encourage you to review OpenAI's policy directly, since it can change independently of ours.
We rely on a small number of service providers to operate PlantScan, each acting as a data processor on our behalf:
• Apple — Sign in with Apple, App Store subscription processing, and local notifications.
• Google Firebase — authentication, the server-side functions that proxy AI requests and verify purchases, and the minimal per-account usage counters described above.
• OpenAI — generates plant identification, diagnosis, and Botanist chat responses from the photo/text you submit.
We do not sell your personal information, and we do not share it with data brokers or advertisers.
Plant records, photos, and Botanist chat history are stored in the app's local storage on your device. If you enable iCloud syncing (Settings-dependent — see the app's iCloud capability), that same data also syncs through your personal iCloud account so it's available on your other devices signed into the same Apple ID; it is still encrypted and controlled by your Apple account, not by us. We do not operate a database containing your plants, photos, or chat history — uninstalling the app (or turning off iCloud sync) removes it from our reach entirely, because we never had a copy.
Local/iCloud content (plants, photos, chat) persists until you delete it in the app or delete your account. Server-side usage counters and device fraud-prevention records are retained for as long as your account exists, and for a limited period afterward solely to prevent free-trial abuse from account deletion and recreation; they contain no plant or chat content. Subscription receipts are retained as needed for accounting, tax, and fraud-prevention purposes.
Depending on where you live (for example, under the GDPR in the EU/UK or the CCPA/CPRA in California), you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can exercise most of these rights yourself, at any time, from Profile → Delete Account, which permanently deletes your account and locally/iCloud-stored data. For anything our systems retain beyond that (see "Data retention"), or any other privacy request, contact us using the details below and we will respond within the time required by applicable law.
PlantScan is not directed at children and we do not knowingly collect personal information from anyone under 13 (or the minimum age required by your local law). If you believe a child has provided us with personal information, contact us and we will delete it.
Our service providers (Apple, Google/Firebase, OpenAI) operate infrastructure in multiple countries, which may include locations outside your own. Where required, these providers rely on legally recognized transfer mechanisms (such as Standard Contractual Clauses) to safeguard data moved across borders.
We use industry-standard measures where we have control over them — for example, requests to our servers are encrypted in transit, and the OpenAI API key used to process your requests is never embedded in the app itself. That said, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
We may update this policy as the app changes. Material changes will be reflected by updating the "Last updated" date above; if a change significantly affects your rights, we'll make reasonable efforts to notify you in-app.
Questions, requests, or complaints about this policy or your data: ozgepehriz@gmail.com