Privacy Policy

LeafLovers is a plant care app built by a small team that genuinely cares about your privacy. We collect what we need to make the app work, run it reliably, and understand how to make it better - things like care-flow progress, feature usage, plant species, when you last signed in, and your broad device type. We never sell your data, and you can export or delete everything at any time. We use Google Analytics 4 only with your consent, and we do not send Google your name, email, account ID, plant names, notes, or photos.

LeafLovers ("we", "us", "our") operates the web application at leaflovers.app. For privacy questions, contact us at hello@leaflovers.app.

Account information

• Name and email — to create your account and identify you
• Password — stored securely hashed (bcrypt), never in plain text
• Hemisphere — to adjust seasonal care advice
• Household info — whether you have cats, dogs, or small children (for pet/child safety warnings)

Plant data

• Plant names, species, nicknames, birthdays, rooms, and care schedules
• Care events (watering, fertilizing, repotting, pruning, notes)
• Photos you upload (plant images, growth journal)
• All plant data belongs to you and is tied to your account

Push notifications

• If you opt in, we store your device's push subscription endpoint and encryption keys
• Used solely to send care reminders you've requested

Feedback you choose to send

• Bug reports, feature ideas, and optional first-care check-in answers or comments
• We store this with your account so we can understand the experience and respond to problems
• This private feedback stays separate from Google Analytics and does not depend on analytics consent

Contact messages

If you use our public contact form, we send your name, email address, chosen topic and message to our business inbox so we can reply. You do not need an account to contact us. These messages are separate from app feedback and are not sent to Google Analytics.

Usage data

• We use Google Analytics 4 (GA4) to understand how visitors use the app - page views, CTA clicks, signup flow, add-plant flow, feature usage, and general navigation patterns. GA4 only loads if you give consent when the banner appears on your first visit
• When useful for improving care guidance, analytics events may include non-personal plant details such as species, broad plant type, care mode, whether a photo was attached, and whether a species lookup was used
• We send no user ID, email address, account identifier, plant ID, plant name, nickname, private notes, or photos to GA4
• GA4 sets first-party cookies (_ga, _ga_*) in your browser to distinguish visits over time. These cookies are only set after you accept analytics
• When analytics consent is enabled, we send privacy-filtered in-app events such as signup method and plant-add flow steps to GA4 - still with no account identifiers
• You can change your analytics preference at any time by clearing your browser cookies or site data for leaflovers.app, which will re-show the consent banner on your next visit
• You can also opt out globally at Google's opt-out page
• For Cloudflare AI requests, we keep a private account-linked usage record for about 90 days: the feature, model, request outcome, token and Neuron counts when reported, image count, and processing time. This record does not contain your prompt, messages, photos, or the model response. We use it to monitor reliability and capacity and to manage fair use

Beyond your account information and plant data, we store a small set of operational fields that help us keep the app stable and improve the experience for everyone. None of this is sent to Google, Cloudflare Workers AI, or any other third party.

• When you last signed in — so we can deploy updates safely without interrupting active users
• When you were last active in the app — same reason, at a finer cadence, so background jobs don't fire while you're in the middle of something
• Your country (a 2-letter code, such as "PT" or "NL") — a 2-letter code from your infrastructure path - we never receive or store your raw IP address. Used to serve the right language and legal terms, and to plan content for the regions our community lives in
• Your device type (a broad category such as "iOS device" or "desktop") — so we can verify the app works correctly on your device. We never store your full browser fingerprint or User-Agent string - only the categorised value
• Whether you installed LeafLovers as a home-screen app — so we can improve the install flow for people who haven't installed it yet

We hold this data under legitimate interest (GDPR Article 6(1)(f)) - it is necessary to operate the service reliably and fairly. You can ask us to delete it at any time by contacting hello@leaflovers.app.

• We do not use precise GPS location for marketing analytics
• We do not use advertising or ad-targeting cookies
• We do not sell, rent, or share your personal data with third parties for marketing
• We do not read or store the content of your notifications
• We do not store raw IP addresses or full browser User-Agent strings - only derived values (country code, device category)

• Core app functionality — storing your plants, calculating care schedules, sending reminders
• Reliable operation — the operational fields described in Section 3 (last login, activity, country, device type, install status) help us deploy safely, serve the right experience, and keep the app stable
• AI features — when you use AI Import, your text and up to five screenshots you choose for one plant are sent to Cloudflare Workers AI for parsing. When you request a Premium toxicity check, the plant name and your relevant household flags (cats, dogs or children) are sent to Cloudflare Workers AI. When you use Plant Doctor, the relevant plant profile, care history, messages and selected photos are sent to Cloudflare Workers AI for the requested advice. For Premium users, uploading a new plant photo may also send it with an earlier photo and relevant care history to Cloudflare for an automatic health comparison
• When you ask Plant Doctor about your garden, the names, species, watering due dates, last-watered dates, and latest health-check severity and date for the plants in your selected filter are sent with your question and recent garden conversation to Cloudflare Workers AI. Choosing all plants includes your whole garden. Photos and private plant notes are not sent. Garden messages are saved separately from individual plant files until you clear the garden conversation or delete your account.
• Gift plant scan trial — when you choose to scan an uploaded plant photo, the photo is sent to Cloudflare Workers AI for a possible name and visible-clue suggestion. Your other plant records and care history are not sent with this scan. We save a private identification record containing the photo reference, validated suggestion, model and prompt version, and your acceptance when you choose to use the identity. A model suggestion is not an expert-reviewed botanical fact
• Photo-based AI features — when you choose a plant-health review or plant identification, your photo is processed only for that feature. We do not send plant photos to GA4 or use them for marketing analytics
• Weather-aware care — if we add weather-based reminders, we may ask for an approximate location such as city/region or let you enter it manually. We will use it to adjust care advice, not for ad targeting
• Improving the app — feedback you choose to send helps us understand the experience. If you've opted in to analytics, privacy-filtered usage data also helps us understand which features matter most and where people get stuck
• Communication — push notifications you opt into, and essential account-related emails

We use the following services that may process your data:

• Stripe — processes payments for Premium subscriptions. Stripe receives your payment details directly; we never see or store your card number. Stripe may transfer data outside the EEA under their approved data transfer framework. See Stripe's Privacy Policy
• Pl@ntNet — processes the photo you choose for Premium Plant ID to suggest a species. We do not send your account profile or care history with this request. See Pl@ntNet's API terms
• Cloudflare Workers AI — processes text and optional screenshots for AI Import, plant names and relevant household flags for Premium toxicity checks, the photo you choose for a gift plant scan, relevant details and photos for Plant Doctor, and two plant photos with care history for an automatic Premium health comparison. Cloudflare says it does not use customer inputs or outputs to train models or improve services without explicit consent. See Cloudflare's Workers AI data-use information
• Google Analytics 4 — privacy-filtered usage analytics, loaded only with your consent. We send no user ID, email, account identifier, plant name, private notes, or photos to Google. GA4 sets cookies (_ga, _ga_*) to distinguish visits. Google may process data outside the EEA under their approved data transfer framework. See Google's Privacy Policy
• Web Push (browser-native) — push notifications use your browser's built-in push service

• Your data is stored on secure servers in Europe
• Passwords are hashed with bcrypt (12 salt rounds) and never stored in plain text
• All connections use HTTPS encryption
• Authentication uses signed JWT tokens
• Uploaded images are stored with randomized filenames to prevent guessing
• We apply security headers (XSS protection, frame denial, content-type enforcement)

You have the right to:

• Access your data — view everything in your account at any time
• Export your data — download your account, plant, care-history and private identification records as JSON from Settings. Image links are included; image files are not embedded. CSV exports the current plant list
• Correct your data — edit your profile, plants, and care history
• Delete your data — delete an individual identification from Your saved scans in Add Plant, delete individual plants, or delete your entire account in Settings
• Withdraw consent — unsubscribe from push notifications at any time in Settings. Turn off Analytics in Settings to withdraw analytics consent
• Object to processing — contact us at hello@leaflovers.app

If you're in the EU/EEA, these rights are protected under the General Data Protection Regulation (GDPR). We will respond to any request within 30 days. You also have the right to lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados — Portugal's data protection authority) at www.cnpd.pt.

• Your data is kept for as long as your account is active
• Deleting a plant removes its active care and journal records. Images newly queued by deletion become eligible for cleanup after one day; new unused uploads after 30 days. Images still referenced by your account are kept. Older unqueued files require a separate retention review
• Deleting an account removes its active account records and cancels recurring subscriptions before completion. Restricted recovery backups expire through rotation, with monthly recovery copies retained for up to six months. Minimum payment records may remain with our payment provider
• Private identification records remain until you delete the scan, its linked plant, or your account. Deleting a scan preserves any saved plant. Its photo becomes eligible for cleanup after one day and is kept while another account record still references it
• AI usage logs are retained for billing and rate-limiting purposes only

LeafLovers is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete it promptly.

We may update this policy from time to time. If we make significant changes, we'll notify you through the app. The "Last updated" date at the top reflects the most recent revision.

Questions or concerns? Reach us at hello@leaflovers.app.