FloraCure — Plant Health App
Last updated: July 11, 2026
FloraCure is a mobile application for plant health diagnosis. The data controller responsible for your personal data is:
[COMPANY_NAME]
[COMPANY_ADDRESS], Kingston, Ontario, Canada
Email: [COMPANY_EMAIL]
"We", "us", or "our" in this policy refers to the data controller above.
Our Privacy Officer is accountable for our compliance with this policy and applicable privacy law, and can be reached at [COMPANY_EMAIL].
When you create an account, we collect your email address and optionally your display name. This is processed by our authentication provider, Clerk.
When you scan a plant, the image you capture or select from your photo library is sent to Google Gemini (an AI service by Google LLC) for analysis. Images are processed transiently and are not stored by Google for training purposes under our agreement. We store the diagnosis result (text) linked to your account, not the raw image permanently.
We assign an anonymous device identifier to track scan usage for free-tier limits. This identifier is not linked to your name or email unless you create an account.
If you use the weather and care forecast feature, we request your device location (GPS coordinates). These coordinates are sent to the Open-Meteo weather API to retrieve local weather data. We do not store your precise location permanently — only the weather result is cached.
If you opt in to push notifications during onboarding, we store your device's push notification token to send you plant care reminders. This is optional and can be revoked at any time in Settings.
If you subscribe to FloraCure Premium, purchase transactions are processed by the app store (Google Play or Apple App Store) and by RevenueCat Inc., our subscription management provider. We receive confirmation of your subscription status but do not process your payment card details.
We use Sentry for crash reporting. This is opt-in only — you must explicitly enable crash reporting in Settings. If enabled, Sentry collects anonymized diagnostic data (device model, OS version, app version, error stack traces). No personal data or plant images are included in crash reports. You can withdraw consent at any time in Settings → Crash Reports.
If you consent to product analytics, we use PostHog to understand how the App is used (screens viewed, features used, anonymized usage events). This is opt-in only and separate from crash reporting — you must explicitly enable it, and can withdraw consent at any time in Settings. Session replay is disabled, and analytics data is hosted on PostHog's EU Cloud. No plant images are included in analytics events.
If you use a referral code or share one, we record the referral relationship (which user referred whom) to credit bonus scans. No additional personal data is collected for this purpose.
| Data | Legal Basis |
|---|---|
| Account data (email, name) | Performance of contract (Art. 6(1)(b)) |
| Plant scan images & AI analysis | Performance of contract (Art. 6(1)(b)) |
| Device identifier for scan limits | Legitimate interest (Art. 6(1)(f)) — to prevent abuse of the free tier |
| Location for weather | Consent (Art. 6(1)(a)) — requested in-app before access |
| Push notification token | Consent (Art. 6(1)(a)) — opt-in during onboarding |
| Subscription status | Performance of contract (Art. 6(1)(b)) |
| Crash reports | Consent (Art. 6(1)(a)) — explicit opt-in in Settings |
| Product analytics (PostHog) | Consent (Art. 6(1)(a)) — separate explicit opt-in in Settings |
| Referral relationships | Legitimate interest (Art. 6(1)(f)) — to credit referral rewards |
| Deletion audit logs | Legal obligation (Art. 6(1)(c)) |
We do not sell your data. We do not use your plant images to train AI models. We do not use your data for advertising.
We use the following third-party services to operate FloraCure. Each is bound by a Data Processing Agreement (DPA):
| Service | Purpose | Country |
|---|---|---|
| Clerk Inc. | User authentication & account management | USA |
| Convex Inc. | Database & backend infrastructure | USA |
| Google LLC (Gemini) | AI-powered plant image analysis | USA |
| RevenueCat Inc. | Subscription & purchase management | USA |
| Sentry (Functional Software) | Crash reporting (opt-in only) | USA |
| PostHog Inc. | Product analytics (opt-in only) | EU (PostHog EU Cloud) |
| Open-Meteo | Weather data (location coordinates only) | Switzerland / EU |
| Expo (650 Industries) | Push notification delivery | USA |
| Brevo (Sendinblue SA) | Transactional email (account deletion notices) | France / EU |
AI provider note: We currently use Google Gemini for plant image analysis. If we change AI providers in the future, this policy will be updated with a new "Last Updated" date.
[COMPANY_NAME] is based in Canada. The European Commission recognizes Canada as providing an adequate level of data protection for organizations subject to Canada's federal privacy law (PIPEDA), so transfers of EU/EEA personal data to us in Canada do not require additional safeguards.
If you are in Canada, note that several of our service providers process data in the United States and the EU. While your data is stored or processed outside Canada, it may be subject to lawful access requests by the courts or authorities of those countries.
Several of our service providers are located in the United States. Transfers of personal data to the USA are made on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of protection for your data.
Open-Meteo is based in Switzerland (and operates EU infrastructure), which the European Commission has recognized as providing adequate data protection.
Brevo (Sendinblue SA) is headquartered in Paris, France and operates within the EU, with no transfer issues.
| Data Type | Retention Period |
|---|---|
| Account & scan data | Until account deletion is completed |
| Soft-deleted accounts | 30-day grace period, then permanently deleted |
| Immediately deleted accounts | Deleted within minutes of hard-delete request |
| Device identifiers (anonymous) | Maximum 1 year of inactivity, then purged |
| Deletion audit logs | 90 days from deletion date |
| Crash reports (if consented) | Governed by Sentry's retention policy (90 days) |
As a resident of the EU/EEA or the UK, you have the following rights regarding your personal data:
To exercise any of these rights, contact us at [COMPANY_EMAIL]. We will respond within 30 days.
If you are in Canada, under the Personal Information Protection and Electronic Documents Act (PIPEDA) you have the right to:
To exercise these rights or ask a question, contact our Privacy Officer at [COMPANY_EMAIL]. We will respond within 30 days.
FloraCure is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. Where a lower age of digital consent applies in a user's country (as low as 13 in some EU/EEA countries under Art. 8 GDPR), that national threshold applies instead. In Canada, we do not knowingly collect personal information from a minor without parental or guardian consent. If you believe we have inadvertently collected data from a child below the applicable age, please contact us at [COMPANY_EMAIL] and we will delete it promptly.
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For material changes that affect how we process your personal data, we will notify you via the app or by email.
We encourage you to review this policy periodically.
If you are in Canada and believe we have not handled your personal information in accordance with applicable law, you may lodge a complaint with:
Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec K1A 1H3
Website: www.priv.gc.ca
If you are in the EU/EEA or the UK, you may lodge a complaint with the data protection supervisory authority of your country of residence (see edpb.europa.eu; in the UK, the ICO at ico.org.uk).
For any questions, data requests, or concerns about this Privacy Policy, please contact:
[COMPANY_NAME]
[COMPANY_ADDRESS], Kingston, Ontario, Canada
[COMPANY_EMAIL]