Plant Doctor Privacy Policy
Effective: 17 October 2026
Who we are
Plant Doctor ("the app") is a plant identification and plant health assessment app provided by Andria Labs, 30 N Gould St, STE R, Sheridan, WY 82801, USA ("we", "us"). We are the controller of the personal data described here. You can reach us at hello@askplantdoctor.com about anything in this policy.
If you are in the EU or the UK, you can send any privacy request or question to hello@askplantdoctor.com and we will handle it directly.
This policy explains what the app collects, why, who receives it, how long it is kept, and what you can do about it.
What the app collects
Account information
If you create an account, we store your email address, display name and avatar URL. You may sign in with an email address and password, with Apple, or with Google. If you use Apple or Google we receive the email address and name that provider releases to us; with Apple you can choose to share only a private relay address instead of your real email. Authentication and passwords are handled by Supabase; we never see your password.
Photos you scan
When you scan a plant, the photo you take or select is sent to Anthropic (api.anthropic.com) for analysis by its Claude models, from app version 1.0.12. Earlier versions of the app send it to OpenAI (api.openai.com) for analysis by its vision model, and the text that comes back is checked by OpenAI's moderation service. The app names the provider before you confirm each scan, and a photo only goes to the one it names. We store the analysis result (plant name, health status, disease name, severity, treatment and care notes) against your account.
We keep a copy of the photo and a small thumbnail in private storage (Supabase Storage) so you can see it again in your history. Only your account can view it, through private links that expire within 2 hours. Deleting a scan deletes its photo, and deleting your account deletes all of them.
OpenAI and Anthropic process the photo on our behalf. Under their API terms neither uses it to train its models. OpenAI may keep API data for up to 30 days to monitor for abuse before deleting it. Anthropic deletes API data within 30 days, unless it is flagged for review under its usage policy, in which case it may keep it longer.
Do not scan images containing people, documents, or anything else you would not want processed by a third-party AI service.
The app does not use GPS or your precise location. To pick seasonal tips and events for your hemisphere, it reads your device's region setting on the device; the region itself is not sent to us.
Your plants, care and activity
If you use these features, we store the plants you add (name, species, photos and notes), journal notes, care reminders and their schedules, care tasks you complete, your streak, your app settings, a record each time you share a scan result (which scan, not who you shared it with), and, if you answer it, whether you think a plant got better, stayed the same or got worse since its first photo. Photos you add to My Plants, with a small thumbnail of each for the plant list, are kept in the same private Supabase storage as scan photos. Some older My Plants photos, added before October 2026, are stored with Cloudinary; they are deleted with the plant or with your account.
We also store your time zone (so reminders arrive at the right local time) and the app language (so results come back in your language).
Notifications
If you enable reminders, we store your device's push notification token and send the reminder text through the Expo push notification service, which passes it to Apple's push service for delivery.
Usage analytics (only with your consent)
After you sign in, the app asks on each device whether you allow usage analytics. It is off unless you say yes, and you can change your answer at any time in Settings → Privacy → Analytics. On iOS, Apple's tracking prompt (below) is a separate choice from this one.
If you allow it, the app records in-app events (screen views, button taps, feature use, errors, and how long a screen was open), your answers to the onboarding questions, scan outcomes (for example whether a scan succeeded and whether a problem was found) and which plan you looked at or chose on the purchase screen, along with a random session identifier, the platform and the app version. These events are stored in our own database against your account and also sent to PostHog, a product analytics service in the US, together with your account id (never your email or name), device model, operating system, app version, and your device's language and time zone settings. PostHog is set not to work out your location from your IP address.
Advertising measurement (only with your consent and tracking permission)
So we can tell which advertising brings people to the app, we use AppsFlyer, a mobile measurement provider. AppsFlyer is only used if you allow analytics and, on iOS, allow tracking when Apple's App Tracking Transparency prompt asks. Apple shows its prompt at most once, and you can change your answer later in iOS Settings. AppsFlyer then receives app install and session events, your IP address, device identifiers including the advertising identifier (IDFA), and subscription events (such as a trial start, purchase or renewal) that RevenueCat forwards to it. AppsFlyer reports these, linked to the campaign you came from, to the advertising networks we use, such as Apple Search Ads, Meta and TikTok, so they can measure their ads. If you decline either choice, none of this happens.
In current versions of the app, if you allow analytics, the app also asks Apple for an Apple Search Ads attribution token and passes it to RevenueCat, so we can tell whether an install came from an Apple Search Ads campaign and whether it led to a trial or purchase. Apple issues this token without the advertising identifier or a tracking prompt, and it identifies the campaign, not you. It is not collected if you decline analytics.
Crash reports and performance
When the app crashes or hits an unexpected error, a report is sent to Sentry, an error-monitoring service in the US. A report contains the error and where in the code it happened, a short trail of recent app actions leading up to it (screens visited and requests made, without their content), device model, operating system and app version, and, if you are signed in, your account id. For about 1 in 10 sessions Sentry also receives performance timings (how long screens and requests took). For every session it also receives a short record of when the session started and ended and whether it crashed, to measure how stable each version is.
Our backend also reports its own errors and warnings to Sentry. Such a report contains the error, the part of the service and the operation that failed, and, if the request came from a signed-in account, your account id; email addresses and IP addresses are removed before it is sent.
Sentry reports do not include your email, name, photos or scan results. We rely on legitimate interests for this, so it is not controlled by the analytics setting.
Invites
If you invite friends or enter an invite code, we store your invite code, which code you entered and when, whether that invite has counted, and the rewards you received. Someone who invited you sees only how many of their friends joined and counted, never your name or email. To give a Pro reward we send your account id and the reward's end date to RevenueCat.
Purchases
Subscription and purchase state is handled by RevenueCat. It receives your account id, your purchase and subscription history, the AppsFlyer install id (only when advertising measurement is on), the Apple Search Ads attribution token (only if you allow analytics), and device identifiers only if you allow tracking. We receive whether your subscription is active. We never see your payment card; that stays with Apple or Google.
Server logs
Our backend and our website, askplantdoctor.com (including invite links), are hosted by Vercel in Dublin, Ireland. Like any web server it records request logs, including your IP address, to keep the service running and secure. To rate limit abuse and cap daily scans, our database also keeps your IP address (for IPv6, its network prefix) with a request count. Each count covers at most a day and is deleted after it ends, usually within a few days.
When you sign in, Supabase, our authentication provider, also records the sign-in event with your IP address, to protect your account.
Why we use it, and our legal bases
| Purpose | Legal basis |
|---|---|
| Running your account, scans, plants, reminders and history | Performance of our contract with you (these terms) |
| Analysing your photos with Anthropic (or OpenAI in versions before 1.0.12) and checking the output | Performance of our contract with you |
| Providing Pro and restoring purchases | Performance of our contract with you |
| Invite codes and rewards | Performance of our contract with you |
| Crash reports, performance monitoring, security, server logs and rate limiting | Our legitimate interests in a working, secure app |
| Usage analytics (PostHog and our own event log) | Your consent, which you can withdraw at any time |
| Advertising measurement (AppsFlyer, advertising identifier) | Your consent and your tracking permission |
| Apple Search Ads attribution (no advertising identifier) | Your consent |
| Keeping purchase and transaction records | Legal obligation (tax and accounting law) |
| Answering your emails and requests | Our legitimate interests, or our contract with you |
Where we rely on legitimate interests, you can object (see "Your rights").
Who we share it with
We do not sell your personal information. We share data only with the processors that run parts of the app for us, under contracts that limit what they can do with it:
| Processor (where known) | What it receives | Why |
|---|---|---|
| Supabase (US) | Account identity, auth tokens, sign-in events with IP address, scan and My Plants photos | Sign-in, account security and private photo storage |
| Turso (Ireland, AWS eu-west-1) | Account record, scans, plants, journal, reminders, care history, streaks, settings, usage events, IP addresses for rate limiting | Application database |
| Vercel (Dublin, Ireland) | Requests to our backend and website, including IP address | Hosting and request logs |
| OpenAI (US) | Photos you scan in app versions before 1.0.12; the generated text for moderation | Plant and disease analysis, content safety |
| Anthropic (US) | Photos you scan (app 1.0.12 and later) | Plant and disease analysis |
| Expo (US) | Push token and reminder text | Delivering reminders |
| Cloudinary | Older My Plants photos (added before October 2026) | Photo storage |
| RevenueCat (US) | Account id, purchase history; Apple Search Ads attribution token (only with analytics consent); AppsFlyer install id and device identifiers only with your permission | Subscription management, and whether an Apple Search Ads install led to a purchase |
| PostHog (US) | Usage events, onboarding answers, device model, OS, app version, language and time zone, account id (only with consent) | Understanding how the app is used |
| AppsFlyer | Install, session and subscription events, IP address, advertising identifier (only with consent and tracking permission) | Measuring which ads bring installs and subscriptions |
| Sentry (US) | App crash and error reports, breadcrumbs, performance timings, session records, device model, OS, app version, account id; backend error reports with account id | Finding and fixing bugs |
| Google (US) | Sign-in identity, if you sign in with Google | Authentication |
| Apple (US) | Payment; sign-in identity, if you sign in with Apple; push delivery | Billing, authentication and notifications |
We may also disclose information if the law requires it, to protect our rights or users' safety, or to a buyer if the app is ever sold (in which case this policy continues to apply).
International transfers
Some of these providers are in the US or other countries outside the EU and UK. When your data goes there, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK extension), or on the European Commission's Standard Contractual Clauses (with the UK addendum), together with the provider's security measures. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Account, scans, scan photos, plants, notes, reminders, streaks and settings: until you delete them or delete your account. Notes you wrote on a plant stay in your account when you delete the plant, and are deleted with your account. Ask us at hello@askplantdoctor.com to delete them sooner.
- Push token: until you turn off reminders or delete your account.
- Invite codes and invite records: until you delete your account. Rewards you earned from a friend stay with you if that friend deletes their account.
- Usage events in our database: deleted after 13 months, or when you delete your account.
- PostHog: while your account exists, for at most 7 years (PostHog's retention on our plan). Deleting your account erases it; turning analytics off stops new events.
- Sentry crash and error reports: up to 90 days.
- Vercel request logs: up to 30 days.
- Sign-in security logs (time, IP address and email, kept by Supabase, our sign-in provider): for a limited period, for security and abuse prevention.
- IP addresses for rate limiting: deleted after the count they belong to ends (each covers at most a day), usually within a few days.
- OpenAI: up to 30 days for abuse monitoring, then deleted.
- Anthropic: deleted within 30 days, unless flagged for a usage-policy review.
- Purchase records: Apple keeps transaction records for as long as tax and accounting law requires. Our RevenueCat customer record is deleted when you delete your account.
Deleted data can remain in our providers' encrypted backups for a short period before it is overwritten.
Deleting your account
Settings → Account → Delete account removes your account, scans, photos, plants, notes, reminders, care history, streaks, invites, settings and usage events, deletes your person data in PostHog and your customer record in RevenueCat, revokes Sign in with Apple for the app if you used it, and asks AppsFlyer to erase the data it holds about your device. It does not cancel an App Store subscription; cancel that in your Apple Account settings.
Some copies are not deleted early but expire on the schedule above: Sentry reports, Vercel request logs, OpenAI's and Anthropic's copies and the rate limiting counts.
If removing your sign-in record from our authentication provider (Supabase) fails at that moment, we keep only your account id and the error, retry automatically, and remove the record by hand if the retries keep failing. Your account cannot be used in the meantime.
Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, or US state laws such as the CCPA), you have the right to:
- access your personal data and get a copy of it. In the app, Settings → Privacy → Download my data gives you a file of your account data; you can also email us;
- correct inaccurate data (most of it you can edit in the app);
- delete your data (see "Deleting your account");
- export your data in a portable format (Download my data);
- object to processing based on legitimate interests, or restrict it;
- withdraw consent at any time, without affecting what happened before: turn off Settings → Privacy → Analytics, or on iOS turn off tracking in Settings → Privacy & Security → Tracking;
- complain to your data protection authority (in the UK, the ICO; in the EU, the authority where you live or work).
To exercise a right, email hello@askplantdoctor.com from the address on your account. We respond within one month, and may need to confirm it is you first.
US state privacy laws: we do not sell your personal information. Some US state laws treat sharing data with advertising measurement partners as "sharing" or "targeted advertising". That only happens through AppsFlyer, and only if you allow analytics and tracking; turning either off opts you out. We do not use sensitive personal information to infer characteristics about you.
You can also revoke camera or photo access in your device settings. The app continues to work; the features needing that permission will not.
Children
Plant Doctor is not directed at children under 13, and you must be at least 13 (or the higher age for agreeing to online services on your own where you live) to use it. We do not knowingly collect personal information from younger children; if you think we have, contact us and we will delete it.
Security
We use encryption in transit, private storage with expiring links, and access controls that limit your data to your account. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Changes to this policy
If this policy changes materially we will update the date at the top and tell you by email to the address on your account, and on askplantdoctor.com, before the change takes effect. Where a change needs your consent, we will ask for it.
Contact
Email hello@askplantdoctor.com, or write to Andria Labs, 30 N Gould St, STE R, Sheridan, WY 82801, USA.