Privacy Policy
Last updated: 13 August 2026
Leafy ("Leafy", "we", "us") is a mobile app that helps you diagnose plant health problems from photos, track your plants' recovery over time, and build simple care habits. This policy explains what information we collect, why, and how you can control it.
1. Information we collect
We only collect what's needed to run the app. Specifically:
| Category | What we collect |
|---|---|
| Account | Your email address and password (handled by our authentication provider, Supabase — we never see or store your raw password), and an optional display name. |
| Plants | Plant name, species, an optional free-text location label you type yourself (e.g. "kitchen windowsill" — not your device or GPS location), and any notes you add. |
| Plant & scan photos | Photos you take or choose to diagnose a plant or log a check-in, stored in our cloud storage and analysed by our AI provider. |
| Scan / diagnosis history | The AI's diagnosis output for each scan: identified species, confidence score, health severity, watering/sunlight assessment, symptoms, and suggested treatment steps. |
| Check-ins | Health ratings, mood, notes, check-in photos, and AI-generated observations comparing a check-in photo to your plant's previous photo. |
| Achievements & care tasks | Which in-app achievements you've unlocked, and your care reminders/tasks and completion history. |
| Device permissions | Camera and photo library access (to take/choose plant photos) and notification permission (for local, on-device watering reminders only — see Section 5). |
We do not collect your precise device location, contacts, or any data unrelated to the plant-care features described above. The mobile app does not use any analytics or tracking SDK — we do not know how you use the app beyond what's necessary to provide the features you interact with directly (e.g. error logs needed to diagnose a crash or failed request).
2. How we use your information
- To create and secure your account, and let you sign in across sessions.
- To run plant diagnosis and check-in comparisons through our AI provider.
- To store your plants, photos, and history so you can track progress over time.
- To schedule local watering/care reminders on your own device.
- To enforce the free-tier daily scan limit (see Section 6) and prevent abuse of the AI service.
- To respond to support requests you send us directly.
We do not sell your data, and we do not use your plant photos or data to train AI models ourselves.
3. Who we share data with
We use a small number of service providers ("processors") to run Leafy. We don't share data with anyone beyond what's needed to operate the app:
| Provider | Purpose | What they process |
|---|---|---|
| Supabase | Database, authentication, file storage, and server-side app logic | Your account, plant, scan, check-in, and achievement data; your uploaded photos |
| OpenAI | AI-powered plant diagnosis and check-in photo comparison | The specific photo you submit for a scan or check-in, sent at the moment of analysis |
| Resend | Transactional email (waitlist confirmation emails, sent before app launch) | Email address you provide when joining the waitlist |
| Vercel | Hosting for the leafyapp.click marketing website only | Standard web server logs (e.g. IP address, browser type) — this does not run inside the mobile app itself, and no analytics/tracking script is used on the website |
Each of these providers processes data on our behalf under their own privacy and security terms. We do not use any advertising networks, data brokers, or third-party tracking pixels.
4. Where your data is stored and how it's secured
Your account and app data are stored in a Supabase-hosted PostgreSQL database with row-level security enabled — meaning the database itself enforces that you can only ever access your own records, not other users' data. Photos are stored in Supabase Storage. Our AI provider's API key and other service credentials are kept server-side only and are never included in the mobile app itself.
5. Permissions
- Camera — used only when you choose to take a photo to diagnose a plant or log a check-in. Leafy does not access your camera in the background.
- Photo library — used only when you choose to select an existing photo instead of taking a new one.
- Notifications — used to schedule watering/care reminders that are stored and triggered entirely on your own device. Leafy does not use push notifications or a remote notification server, so we never receive a device push token.
You can grant, deny, or revoke any of these permissions at any time from your device's Settings app.
6. AI-assisted features
Plant diagnosis and check-in comparisons are generated by an AI model (via OpenAI) based on the photo(s) you submit. These results are informational indicators to help guide your plant care — they are not a professional horticultural, botanical, or scientific diagnosis, and we present them with that framing throughout the app. To keep the AI service sustainable while Leafy is free, free-tier accounts are limited to 3 plant scans per rolling day; this limit is enforced on our servers and resets automatically.
7. Data retention
We keep your account and app data for as long as your account is active, so you can see your plants' full history over time. We do not currently run any automatic process that deletes data while your account remains open. If you delete your account (Settings → Delete Account), your account, plants, photos, scan and check-in history, achievements, and reminders are permanently deleted, as described below.
8. Account deletion & your rights
You can permanently delete your account at any time from Settings → Delete Accountin the app. This immediately and permanently deletes your account, your plants, your uploaded photos, your scan/diagnosis history, your check-ins, your achievements, and your reminders. This action cannot be undone.
Depending on where you live, you may also have rights to:
- Access a copy of the personal data we hold about you.
- Correct inaccurate data (most of this you can already edit directly in the app).
- Request deletion of your data (see above).
- Object to or restrict certain processing.
To exercise any of these rights, contact us at hello@leafyapp.click.
9. UK GDPR
If you are located in the UK, the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 apply to how we handle your personal data. We process your data on the basis of: performing our contract with you (running the app you signed up for), our legitimate interests (keeping the service secure and working), and, where applicable, your consent (e.g. camera/photo permissions). You have the rights listed in Section 8, and the right to complain to the UK Information Commissioner's Office (ICO) if you believe we've mishandled your data.
10. Children
Leafy is not directed at children, and we do not knowingly collect data from anyone under 13.
11. Changes to this policy
If we make material changes to this policy, we'll update the "Last updated" date above and, where appropriate, notify you in the app.
12. Contact
Questions about this policy or your data can be sent to hello@leafyapp.click.