Privacy Policy

1. Controller

foodsoption UG (haftungsbeschränkt)
Dördelweg 24, 58638 Iserlohn, Germany
Represented by: Johannes Schmidt

Email: support@heyleafy.app

We have not appointed a data protection officer; we are not legally required to do so.

2. Overview of processing activities

Types of data processed

• Master data (email address, name if provided by Sign in with Apple or Google)
• Content data (photos of your plants, plant names, watering intervals, notes)
• Usage data (features used, timestamps, in-app events)
• Meta, communication and process data (device and push identifiers, IP addresses)
• Contract data (status of your subscription)

Categories of data subjects

• Users of the Leafy app
• Visitors of this website
• People who contact us

Purposes of processing

• Providing the app and its features (identification, watering schedule, reminders, diagnosis)
• Managing accounts and authentication
• Processing and managing subscriptions
• Security, troubleshooting and improving the app
• Answering support requests

3. Legal bases

Below is an overview of the legal bases under the GDPR on which we process personal data. In addition to the GDPR, national data protection rules may apply in your or our country of residence. Where more specific legal bases apply in an individual case, we state them in the relevant section.

• Consent (Art. 6 (1) (a) GDPR) — you have given consent to the processing for one or more specific purposes.
• Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR) — processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
• Legal obligation (Art. 6 (1) (c) GDPR) — processing is necessary for compliance with a legal obligation to which we are subject.
• Legitimate interests (Art. 6 (1) (f) GDPR) — processing is necessary for the purposes of our legitimate interests, provided your interests or fundamental rights do not override them.

4. Security measures

Taking into account the state of the art, implementation costs and the nature, scope and purposes of processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These include in particular encrypted transmission of all data (TLS), storage of plant photos in a non-public storage area, database-level access restrictions (row level security) limited to your account, as well as procedures ensuring the exercise of data subject rights and the deletion of data.

5. Transfers and international data transfers

As part of our processing we share data with service providers that support us in operating the app (see the sections below). We conclude the legally required data processing agreements with these recipients.

Where we process data in a third country outside the EU/EEA or transfer data there, we do so only in accordance with legal requirements — based on an adequacy decision (Art. 45 GDPR), standard contractual clauses (Art. 46 (2) (c) GDPR) or your explicit consent. Several of the providers listed below are certified under the EU-US Data Privacy Framework.

6. Your rights

As a data subject you have the following rights under the GDPR:

• Right to object: you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6 (1) (e) or (f) GDPR. Where your data is processed for direct marketing, you may object at any time.
• Right to withdraw consent: you may withdraw consent you have given at any time with effect for the future.
• Right of access: you may request confirmation as to whether we process data concerning you, access to that data and a copy of it.
• Right to rectification: you may request the completion or correction of inaccurate data.
• Right to erasure and restriction of processing: you may request that data concerning you be erased without undue delay, or that its processing be restricted.
• Right to data portability: you may receive the data you provided in a structured, commonly used and machine-readable format.
• Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.

To exercise your rights, an email to support@heyleafy.app is enough.

7. This website

This website is a purely static information page. It sets no cookies, embeds no analytics or tracking services, loads no external fonts and uses no contact forms. A cookie banner is therefore not required.

When you visit the site, our hosting provider processes technically necessary access data (server log files): IP address, date and time of access, page requested, amount of data transferred, referrer, and browser and operating system information. This data is required to deliver the page and serves the security and stability of the service. Legal basis: legitimate interests (Art. 6 (1) (f) GDPR).

Hosting provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The website is hosted on web space in a data centre within the European Union; a data processing agreement is in place with the provider. No transfer to a third country takes place.

8. App: account and sign-in

Using Leafy requires an account. Sign-in works via “Sign in with Apple” or “Sign in with Google”. We process the information provided by the respective service — usually an email address (with Apple optionally an anonymised relay address) and a unique user identifier. We do not store a password.

• Purpose: providing your account, associating your plants with it and backing up your data across devices.
• Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).
• Providers: Apple Inc. and Google Ireland Limited — their privacy notices apply to the sign-in service itself.

9. App: backend and storage (Supabase)

Account, plant and care data as well as your plant photos are stored with our backend provider Supabase. Photos are kept in a non-public storage area; access rules limit access to your account.

• Provider: Supabase, Inc., San Francisco, USA.
• Third-country transfer: processing outside the EU is possible, safeguarded by standard contractual clauses.
• Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).
• Deletion: you can delete individual plants along with their photos in the app at any time. Deleting your account removes all associated data.
• Privacy notice: supabase.com/privacy

10. App: AI identification and plant doctor (Google Gemini)

To identify the plant species automatically and for the doctor feature (assessment of possible problems), the photo taken is transmitted to Google's “Gemini” AI interface and analysed there. Only the image and — for the doctor feature — the plant name are transmitted. No account or profile data, no name, no email address.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (or Google LLC, USA).
• Third-country transfer: processing may take place in the USA, safeguarded by standard contractual clauses and the EU-US Data Privacy Framework.
• Legal basis: performance of a contract (Art. 6 (1) (b) GDPR) and your consent by using the feature (Art. 6 (1) (a) GDPR).
• Note: the AI provides general, non-binding assessments and does not replace expert advice.
• Privacy notice: policies.google.com/privacy

11. App: notifications

So that Leafy can remind you to water your plants, we process a push identifier (token) for your device — provided you allow notifications. Delivery runs through Expo's push service and the system services Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM).

• Providers: Expo (650 Industries, Inc., USA), Apple Inc. (USA/Ireland), Google Ireland Limited (Ireland).
• Legal basis: performance of a contract (Art. 6 (1) (b) GDPR) and your consent by granting the notification permission (Art. 6 (1) (a) GDPR).
• Withdrawal: you can disable notifications at any time in the app or system settings.

12. App: subscriptions (Leafy Pro)

Leafy Pro is offered as an in-app purchase through the Apple App Store or Google Play. Payment is handled exclusively by the respective store — we receive no payment data such as card or account numbers.

To manage entitlements we use the service RevenueCat, which processes a pseudonymous user identifier, the purchase status and technical information about device and store.

• Provider: RevenueCat, Inc., 300 Delaware Ave, Wilmington, DE 19801, USA.
• Third-country transfer: processing in the USA, safeguarded by standard contractual clauses.
• Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).
• Privacy notice: revenuecat.com/privacy

13. App: usage analytics

To understand which features are used and where people get stuck, we record individual product events inside the app — for example that onboarding was completed, a plant was added or the paywall was viewed. These events are stored in our own database at Supabase and associated with your account. We do not analyse the content of your photos, we build no advertising profiles, and we do not pass this data to third parties for analytics purposes.

• Purpose: error detection and improvement of the app.
• Legal basis: legitimate interests (Art. 6 (1) (f) GDPR).
• Objection: you may object to this processing at any time by email.

14. App: Meta SDK (advertising and reach measurement)

The app embeds Meta's (Facebook's) SDK, which allows the success of advertising campaigns to be measured and installations to be attributed. On iOS devices, advertising identifiers (e.g. IDFA) are processed only if you have explicitly agreed in the App Tracking Transparency (ATT) dialog. Without your consent no such tracking takes place.

• Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
• Legal basis: consent (Art. 6 (1) (a) GDPR).
• Withdrawal: you can withdraw your consent at any time in your device settings (iOS: Settings → Privacy & Security → Tracking; Android: reset or delete the advertising ID).
• Privacy notice: facebook.com/privacy/policy

15. Retention and deletion

We store your data for as long as it is necessary for the purposes stated or as long as statutory retention obligations apply. You can delete individual plants and their photos in the app at any time.

You can delete your entire account in the app under Settings → Delete account. This permanently removes your account and all associated plants, photos, care and event data. Alternatively you can request deletion by email.

16. Contact requests

If you contact us by email, we process your details in order to handle your request. The legal basis is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest in responding to enquiries (Art. 6 (1) (f) GDPR). We delete requests once they have been dealt with, unless statutory retention obligations apply.

17. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our processing changes. The current version is always available on this page. We will additionally inform you in the app about material changes.

This English version is provided for convenience. In case of any discrepancy, the German version prevails.