Legal
Privacy Policy
Last updated: November 5, 2026
1. Introduction
PlantRitual ("we," "our," or "us") operates the PlantRitual mobile application and the website at plantritual.com (collectively, the "Service"). This Privacy Policy explains how we collect, use, store, and share your information when you use our Service.
The data controller for the Service is Fatih Tasdemir, based in Türkiye. For questions about your personal data or to exercise your privacy rights, contact myplantritual@gmail.com.
By using PlantRitual, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address — used for authentication through an email magic link.
- Authentication provider — which sign-in method you use.
We do not collect your name, phone number, or mailing address.
2.2 Plant Care Data
When you use the app, we store:
- Plants you add (species, nickname, room assignment, photos).
- Care schedules and task history (watering, fertilizing, pruning, etc.).
- Care logs and feedback you provide (e.g., "on time," "too early").
- Environment observations (light, humidity, temperature — entered manually, not sensed).
- Notes you write about your plants.
2.3 Optional Profile Data
During onboarding, you may optionally provide:
- Experience level (beginner, casual, enthusiast) — used to personalize care recommendations.
- Plant relationship archetype — used for content personalization.
This data is optional and can be changed at any time in Settings.
2.4 Device & Technical Data
We automatically collect:
- Device identifier — a stable ID used to associate your device with push notifications. This is not your advertising ID.
- Device timezone — to schedule reminders at appropriate times.
- Platform (iOS or Android) and app version.
- Language/locale preference.
2.5 Usage Analytics
We collect usage events to improve the app. These events are linked to your account via an internal identifier (not your email) and are deleted when you delete your account. Events we collect include:
- Screens viewed, features used, and actions taken (e.g., task completed, plant added).
- Onboarding completion status.
- Notification interactions (scheduled, tapped).
Analytics events include your experience level and app version for cohort analysis. They do not include your email, plant names, or notes.
2.6 Photos
If you upload plant photos, they are stored in a private, access-controlled storage bucket. Only you can access your photos. We do not use your photos for AI training, advertising, or any purpose other than displaying them to you within the app.
2.7 Payment Information
This release is free and does not offer subscriptions or in-app purchases. We do not collect payment credentials, purchase receipts, or subscription information, and the app does not include a billing SDK.
2.8 Optional City Location
If you select a city in Settings, we store its name, country, city coordinates, and your weather setting with your account. This is approximate location (city), used to adjust your plant care schedule using local weather forecasts. We do not collect your device’s GPS location or track your movements.
3. How We Use Your Information
- Adjust watering dates using local weather forecasts when you enable weather adjustments.
- Provide the Service — store your plants, generate care schedules, send reminders.
- Personalize your experience — adjust care recommendations based on your experience level and plant data.
- Send notifications — care reminders at your preferred time, respecting quiet hours you set.
- Improve the app — analyze aggregated usage patterns to prioritize features and fix issues.
- Communicate with you — respond to support requests sent via email.
We do not use your data for advertising, sell your data to third parties, or create advertising profiles.
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:
| Data category | Legal basis |
|---|---|
| Optional approximate location (city) and weather preferences | Contract performance (Art. 6(1)(b)), to provide the weather-adjusted care schedule you request. Providing a city is optional. |
| Account information (email, auth provider) | Contract performance (Art. 6(1)(b)) — necessary to create and maintain your account and provide the Service. |
| Plant care data (plants, schedules, tasks, logs, notes, photos) | Contract performance (Art. 6(1)(b)) — core functionality you signed up for. |
| Optional profile data (experience level, archetype) | Consent (Art. 6(1)(a)) — you choose to provide this; you can change or remove it at any time in Settings. |
| Device & technical data (push token, timezone, platform, locale) | Legitimate interest (Art. 6(1)(f)) — necessary to deliver notifications at the right time and maintain app compatibility. You can disable notifications at any time. |
| Usage analytics (feature usage and notification interactions) | Legitimate interest (Art. 6(1)(f)) — to improve the Service, fix issues, and understand how features are used. Events are linked to an internal identifier, not your email. |
Where we rely on legitimate interest, we have assessed that our interests do not override your rights. You may object to processing based on legitimate interest by contacting us at myplantritual@gmail.com.
Providing account information (email) is a contractual requirement to use the Service with an account. If you choose not to provide it, you may still use limited local-only features without signing in. All other data is voluntary.
5. Third-Party Services
We use the following third-party services to operate PlantRitual:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, file storage | All user data (encrypted in transit and at rest) |
| Open-Meteo | City search and local weather forecasts | City search text and app language are sent from your device to Open-Meteo (which also receives your IP address). Forecast requests from our server contain coordinates rounded to two decimal places, without your account identifier or plant data. |
| Expo | Push notification delivery and app update delivery | Push tokens, notification content, and technical update request information such as IP address, app platform, and runtime version |
Each service has its own privacy policy. We encourage you to review them.
6. Data Storage & Security
- Your data is stored in Supabase cloud infrastructure withRow-Level Security (RLS) enforced — you can only access your own data.
- Authentication tokens are stored on-device usingsecure encrypted storage (iOS Keychain / Android Keystore) with the protection level "when unlocked, this device only."
- All data in transit usesHTTPS/TLS encryption.
- Plant photos are stored in aprivate storage bucket with access restricted to the photo owner.
7. Data Retention
- Your saved city remains until you remove it in Settings or delete your account. Turning weather adjustments off stops further adjustments and restores affected pending watering dates; it does not delete your saved city.
- Plant care data — retained as long as your account exists.
- Analytics events — retained for the lifetime of your account and deleted when you delete your account. We do not retain analytics data after account deletion.
- Local cache — 24 hours on device (AsyncStorage).
- Auth tokens — until you sign out or the session expires.
When you delete your account, all your data is permanently removed (see Section 9).
8. Your Rights
You have the right to:
- Access your data — export all your plant data (plants, rooms, schedules, tasks, logs, notes) in JSON format from Settings → Export Data.
- Delete your data — permanently delete your account and all associated data from Settings → Delete Account.
- Modify your data — edit or delete individual plants, notes, and preferences at any time within the app.
- Withdraw consent — disable notifications, revoke permissions, or stop using the Service at any time.
- Object to processing — you may object to processing based on legitimate interest (such as analytics) by contacting us.
- Data portability — export your data in a machine-readable format (JSON).
If you are a resident of the European Economic Area (EEA) or the United Kingdom, you have additional rights under the GDPR, including the right to lodge a complaint with your local supervisory authority. You can find your supervisory authority at edpb.europa.eu/about-edpb/about-edpb/members (EEA) or the Information Commissioner's Office (UK).
If you are a California resident, you have rights under the CCPA/CPRA including the right to know, delete, and opt out of the sale of personal information. We do not sell your personal information.
9. Account Deletion
You can delete your account at any time from Settings → Delete Account. This action:
- Permanently deletes your plants, care data, schedules, tasks, logs, notes, photos, rooms, saved city, weather adjustments, analytics events, notification data, and experiment assignments.
- Deactivates your push notification tokens.
- Isirreversible — deleted data cannot be recovered.
10. Children's Privacy
PlantRitual is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at the email below and we will delete it.
11. International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our service providers Supabase and Expo operate. Applicable safeguards, such as Standard Contractual Clauses or other transfer mechanisms described in each provider's data processing agreement, apply to these transfers.
12. Cookies & Website
The plantritual.com website is a static site and does not use cookies, tracking pixels, or third-party analytics. No personal data is collected when you visit the website. If this changes in the future (e.g., when we add a web app with user accounts), this policy will be updated.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the app or updating the "Last updated" date above. Continued use of the Service after changes constitutes acceptance of the updated policy.
14. Contact Us
If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:
Email: myplantritual@gmail.com