Privacy Policy

Growena is operated by Dejan Todorović, an individual based in Serbia. A company has not yet been incorporated for Growena — this section will be updated with the company's legal name and registered address once that happens.

Contact for privacy questions: growena.deki@gmail.com

• Account: name, email, password (or Google account info if you sign in with Google), and when you accepted the Terms and this Privacy Policy
• Profile: timezone, gardening experience level, time commitment, interests
• Garden data: garden location/climate, plant records, care schedules, journal entries
• Photos you upload of your plants
• Feedback: the messages you send us through Feedback (bug reports, suggestions, reviews) and our replies
• Usage data: AI credit usage, upload counts (for fair-use limits)
• App use: the last day you opened Growena, and on how many days of each week you used it — not which days or what you looked at. On your own journal entries and plants we also note where in the app they were made (for example the plant's page or the + button) and how a plant was chosen (from the catalog, from a suggestion, or by its own name), and how far you got in the first set-up
• Support notes: short, factual notes we write about your account while answering you or looking into a problem
• AI interactions: prompts and responses when you use AI features (recommendations, photo analysis)
• Technical data: IP address, browser/device type, and error/crash reports — collected automatically by standard web infrastructure and error monitoring, for security and reliability

• Account, profile, garden data, photos, AI interactions — necessary to provide the Growena service you signed up for (performance of a contract)
• Usage data (credit usage, upload counts) and technical data — our legitimate interest in preventing abuse, keeping the service secure, and fixing bugs
• Feedback conversations — to answer you, and our legitimate interest in fixing what you report and improving Growena
• App use and support notes — our legitimate interest in seeing whether Growena works for the people who try it, noticing when someone gets stuck, and answering you consistently. They use no cookies and are never used for advertising

We use the following processors to run Growena:

• Supabase — database, authentication, file storage
• Anthropic — AI plant recommendations and photo analysis (US-based). Anthropic does not use the content of these requests to train its models.
• Resend — transactional email (reminders, account notices) (US-based)
• Google — optional sign-in with Google (US-based)
• Vercel — application hosting (US-based)
• Sentry — error monitoring/crash reports, so we can find and fix bugs (US-based; inactive until we configure it in production)
• Lemon Squeezy — payment processing (once billing launches)

When you place your garden on the map, your browser contacts these services directly, so each of them receives the point you select or the place name you search for, and your IP address:

• MapTiler — map and satellite imagery shown in the location picker (Switzerland)
• OpenStreetMap Foundation (Nominatim) — finding a place you search for, and naming the country and region of a dropped pin (UK)
• Open-Meteo — the elevation of the pin you drop (Switzerland). Open-Meteo keeps request logs, including IP addresses, for up to 90 days.

Open-Meteo also receives your garden's stored location to return the weather shown in the app, but that request is made by our server, so it does not receive your IP address.

A garden's location is often your home. We store it rounded to two decimal places — about a kilometre, enough for climate and weather but not to find a house. The map services above see the exact point you click, before it is rounded. We send only the location — never your name, email, or any other account data — and none of these services receive a way to identify you as a Growena user.

Your account, garden data and photos are stored by Supabase in the European Union (Ireland).

Several of our processors are US-based and may process data outside the European Economic Area. Those transfers rely on the following safeguards, set out in each provider's own data processing terms:

• Anthropic — the EU Standard Contractual Clauses (and the UK and Swiss addenda) in its Data Processing Addendum
• Supabase — the EU Standard Contractual Clauses in its Data Processing Addendum, for any access to the data from outside the EU
• Resend — the EU–U.S. Data Privacy Framework and the EU Standard Contractual Clauses
• Sentry — the EU–U.S. Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback
• Google — the EU–U.S. Data Privacy Framework
• Vercel — the EU Standard Contractual Clauses in its Data Processing Addendum

TODO: Vercel's Data Processing Addendum applies only to its Pro and Enterprise plans — confirm the project is on Pro before publishing, or this line is not true.

The map and weather services in section 4 are in Switzerland and the United Kingdom, both covered by EU adequacy decisions.

Anthropic automatically deletes the content of AI requests (prompts and responses) within 30 days of processing, and does not use it to train models. If a request is flagged by Anthropic's automated safety systems, its content may be kept for up to 2 years for trust & safety review, and the safety classification scores for up to 7 years.

Your account, profile, garden data, photos and feedback conversations are kept for as long as your account is active, and so are support notes. How often you used the app is kept for 12 months; where an entry or a plant was made is part of that entry or plant and is kept and deleted with it. If you delete your account, everything is permanently erased 30 days later (see section 8) — unless you cancel the deletion before then.

Technical/server logs and error reports are kept only briefly and are not linked to your account beyond what's needed to fix the underlying bug.

One exception to the above: when we act on a request to access or delete your data, we keep a minimal record of it — your email address, what was requested, and the dates it was received and completed. Nothing else, and none of your garden content. We keep it so we can demonstrate that we honoured the request, including after the account itself is gone, which is the point at which such a record matters most.

We only use strictly necessary cookies — to keep you signed in (authentication session). These don't require consent under GDPR. We don't currently use analytics or advertising cookies; if that changes, we'll update this section and add a consent banner.

• Access and export your data — available any time in Settings (one-click export for Pro, on request for all plans)
• Correct your data — editable directly in the app
• Delete your account — Settings → Danger zone, 30-day grace period, then permanent erasure
• Object to processing / withdraw consent

For anything not available directly in the app, email us at growena.deki@gmail.com. We will respond within 30 days.

Growena is not intended for children under 16. We do not knowingly collect data from children under this age. If you believe a child has created an account, contact us at growena.deki@gmail.com and we will delete it.

We may update this policy from time to time. If we make material changes, we'll notify you by email or an in-app notice before they take effect. The "last updated" date at the top of this page always reflects the current version.