PlantPal
EN
DeutschEnglishEspañolFrançaisPortuguês日本語한국어简体中文
Get it

Privacy Policy

App “PlantPal” · Last updated: October 2026

The app contains no advertising, no analytics tools and no tracking. For identification, care tips, the plant check, the sensor bridge, sharing the collection, the weather and the subscription check the app communicates with a server of mine (api.bumberger.at, hosted by World4You in Austria).

What is sent to my server

For identification and the plant check (“Check plant”) the app sends the photo you took, for care tips the plant’s name (botanical and common), each with the selected language, over an encrypted connection (HTTPS) to my server. If the plant already has a check, it also sends the earlier photo and the last finding for the comparison. For “Ask about this plant” it sends your question, up to the last three questions and answers of that conversation, the plant’s name and a short summary of what the app knows about it (care tips, last check and your notes on this plant). The server forwards the request to Anthropic’s API (Claude) and returns the answer to the app. I do not store photos, questions or answers and do not write them to any log; on my server they exist only for the duration of the request. The app does not save a conversation either; it ends when you close it.

What my server stores

To limit usage, the server counts requests per kind and calendar month. They are assigned to a random identifier of your app installation (not linked to your name, Apple ID or email address) or, with a subscription, to the pseudonymous original transaction number issued by Apple. In addition the server logs for each request the time, kind, number of tokens processed and response time – without photo, plant names or answer text – as well as technical error messages. I delete the counters after 13 months and the request log after 90 days. The hosting provider World4You keeps the usual technical access logs (for example with the IP address); its privacy policy applies to these. The legal basis is providing the app’s functions (Art. 6(1)(b) GDPR) and my legitimate interest in abuse protection and cost control (Art. 6(1)(f) GDPR).

Protecting the free allowance (Apple DeviceCheck)

So that the free allowance cannot be reset over and over by deleting or reinstalling the app, the app uses Apple’s DeviceCheck service. Without a subscription, the app sends a token generated by Apple to my server. With it, my server queries two yes/no values that Apple stores for your device and sets one of them to “free requests were used this month” as soon as you make your first free request of the month. Another identifier on the same device then gets no new free allowance. Without this device check, no free requests are possible. I receive no other information about you or your device from Apple; I do not store the token. The value expires by itself at the turn of the month. The legal basis is my legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

Deleting data on my server

In the app under “About → My data → Delete data on the server” you immediately delete the counters and log entries that my server has stored for your installation or subscription. Afterwards the app creates a new random identifier. Your allowance is not reset by this: if you have already used free requests this month, your device stays blocked from further free requests through Apple DeviceCheck (see above) until the month ends. With a subscription, the counters for the current month are kept so that the monthly allowance cannot be reset by deleting; everything else, including counters from earlier months, is deleted. An existing subscription stays valid. Any sensor bridges you set up are deleted too, along with their readings, and if you are in a shared household you leave it (see “Share collection”). Because I do not know you by name, I can assign this data only through this function in the app; an email to me is not enough for that. Short-lived technical counters for the per-minute request limit expire by themselves within an hour. I cannot delete data held by Apple (purchases, account and the DeviceCheck value), in your iCloud (you delete it with the app function “Delete all plants and data” or in your iCloud settings), by Anthropic (its terms apply) and the technical access logs of my hosting provider.

Anthropic (Claude)

The requests are processed by Anthropic PBC (USA); data may be transferred to the USA. How Anthropic processes data is governed by its terms and privacy notices. My server transmits no information about you personally (no name, no Apple ID, no email address). A photo can, however, contain information visible in the picture – so please photograph only plants and not people. Please do not write personal data such as names, addresses or health details about people into questions and notes; they are sent to Anthropic with the question.

“PlantPal Plus” subscription

You buy and manage the subscription through Apple. Apple processes payment data, name and email address; I do not receive them. To unlock the subscription the app sends the transaction of your subscription, signed by Apple, to my server, which checks its authenticity and validity.

Collection on your device and in iCloud

The app stores plants, photos, journal entries, notes, care tips, plant checks and the dates for watering, fertilizing and repotting on your device. If you are signed in to iCloud, they sync to your other devices through your private iCloud area (CloudKit), as do your household and winter watering settings. I have no access to them. Apple’s privacy policy governs what data Apple processes as part of iCloud.

Notifications

Reminders for watering, fertilizing and repotting as well as reminders for the next plant check are local notifications on your device; no data is transmitted for them. This also applies to the frost and heat alerts (PlantPal Plus); the app fetches the forecast for them as described under “Weather for balcony and garden”.

Widget and vacation plan

For the widget, the app stores the names, watering dates and small thumbnails of your plants in a storage area on your device that only PlantPal and its widget can read. The vacation plan is created as a PDF on your device and is only passed on if you share it yourself. No data is sent to me or to Anthropic for either.

Plant sensor (Bluetooth)

When you connect a plant sensor (Flower Care), the app searches for nearby sensors via Bluetooth. It reads soil moisture, light, soil conductivity, temperature and battery level, plus the hourly values stored in the sensor. iOS asks once for your permission to use Bluetooth; you can withdraw it at any time in your device settings. The app stores the link between sensor and plant and the readings with the plant in your collection. Like the collection, they are synced to your other devices via your private iCloud space if you are signed in to iCloud, so your iPad, for example, shows the values your iPhone has read. They are sent to my server only if you set up the sensor bridge (see below), and never to Anthropic. The target values for moisture, light and fertilizer come with the care tips; as there, only the plant’s name is sent. If you disconnect the sensor or delete the plant, the app also deletes its readings, on all devices and in iCloud.

Sensor bridge (PlantPal Plus)

With PlantPal Plus you can set up a sensor bridge: a small ESP32 at your home running my PlantPal Bridge firmware. It receives the radio packets of your Flower Care sensors via Bluetooth and sends them to my server every 5 minutes over an encrypted connection (HTTPS): for each sensor an identifier made of the last three bytes of its Bluetooth address, plus soil moisture, light, conductivity and temperature, and the battery level if the sensor transmits it. During setup the app creates a random bridge key, registers it with my server and transfers it, together with the Wi-Fi name and Wi-Fi password, to the bridge via Bluetooth. The Wi-Fi name and password stay on the bridge; they are not sent to my server. So you don’t have to enter everything again for the next bridge, the app remembers the Wi-Fi name and password in your device’s keychain; from there they are not passed on and not synced via iCloud. My server stores only a checksum (SHA-256) of the key, linked to the pseudonymous identifier of your subscription, plus the latest readings and hourly readings for each sensor. I delete the readings after 7 days, and a bridge whose readings no app with a subscription has retrieved for 40 days together with all its readings. Only the app with your subscription can retrieve the readings, so they appear with your plants. The app keeps the bridge key in your private iCloud storage so you can also remove the bridge from your other devices. With the trash button next to the bridge under “Settings → Sensor Bridge” and with “Delete data on the server” you delete bridges and readings immediately; on the bridge itself, holding the BOOT button for 5 seconds erases the Wi-Fi access and the key. As with every request, my hosting provider sees the IP address of your internet connection (see above). The legal basis is providing the feature you chose (Art. 6(1)(b) GDPR).

Share collection (household)

You can share your collection with family or flatmates. Because this should also work with Android, the shared household runs through my server, not through iCloud. Only PlantPal Plus subscribers can create a household and invite members; anyone can join with an invitation code. When you first create or join a household, the app generates a random member key and stores it in your iCloud Keychain so that your other devices see the same household; my server stores only a checksum of it (SHA-256). No account, name or email address is needed; the name you enter in the household (your first name, say) is seen only by the other members.

While you are in a household, the app sends over an encrypted connection (HTTPS) to my server, and from there to the other members: for each plant its name, family, notes, care tips, the last three plant checks, the dates for watering, fertilizing and repotting, the plant photo reduced to at most 1024 pixels, and for a plant sensor its identifier (Bluetooth address) and latest reading. The server also records which member watered, fertilized or repotted when. Journal entries, the sensor’s hourly history, questions and the full-size photo stay on your device. If the founder has set up a sensor bridge, all members see its readings, even without their own subscription; only members, not guests, can connect and disconnect sensors. This data is stored unencrypted on my server; I could technically view it, but I do so only for troubleshooting when you ask me to. Please do not write personal details about other people in notes, as the other members of the household read them too.

Invitation codes are valid for seven days. A holiday stand-in joins as a guest, sees the plants and can only log watering, fertilizing and repotting; after the period you chose they leave automatically. The founder can remove members. If you leave the household (Settings → Share Collection) or use “Delete data on the server”, your plants stay on your devices and the others no longer receive changes from you. When the last member leaves, my server deletes the household with its plants, photos and history. Deleted plants are kept for 90 days as an empty deletion marker, the “who watered” entries for at most one year. The legal basis is providing the feature you chose (Art. 6(1)(b) GDPR). As with every request, my hosting provider sees the IP address of your internet connection (see above).

Weather for balcony and garden

If you set a plant to “Balcony” or “Garden”, the app shows the weather for the coming days. For this you type in a town or a postcode; the app does not ask for your location and does not determine it. The app sends the search term and then the coordinates of the chosen town, rounded to about 10 kilometres, over an encrypted connection (HTTPS) to my server. My server uses them to ask the weather service Open-Meteo (open-meteo.com) for matching places and, per day, the lowest and highest temperature and the amount of rain. Open-Meteo only receives the search term or the rounded coordinates and the address of my server, no information about you or your device. My server caches search results for up to one day and forecasts for one hour, without any link to your installation; these requests do not count towards the allowance and are not written to the request log. The app stores the chosen town on your device and syncs it with your other devices via your private iCloud area. It stores each plant’s location (indoors, balcony, garden) with the plant; in a shared household the other members see it too, as well as when rain last counted as watering and how much. With PlantPal Plus, rain of 5 mm or more in a day counts as watering, the app reminds you to water earlier on hot days, and on the evening before frost or heat you get a local notification; for this the app also fetches the forecast in the background. The legal basis is providing the feature you have chosen (Art. 6(1)(b) GDPR).

Report a problem

“Report a problem” opens an email to support@bumberger.at that you can read and edit before sending. It contains the app version, device model, iOS version, language, the number of your plants and checks and your subscription status – no photos or notes.

Mac version

This policy also applies to PlantPal on the Mac. Identification, care tips, the plant check, questions, the subscription, the free allowance with Apple DeviceCheck, the iCloud sync and sharing the collection work there exactly as described above. The differences:

  • Photos: With “iPhone” you take a photo with the camera of a nearby iPhone or iPad (Apple’s Continuity Camera). The photo goes straight from your iPhone to the app on your Mac, not through me. You can also choose photos from the Finder or the Photos library, or drag them into the window. The app only sees the photo you choose.
  • Plant sensor: The app reads the sensor over your Mac’s Bluetooth. macOS asks for your permission once; you can revoke it at any time in System Settings under “Privacy & Security”.
  • Widget: As on the iPhone, the desktop widget gets its data from a storage area on your Mac that only PlantPal and its widget can read.
  • Weather: The Mac has no background fetch; the app gets the forecast while it is open.
  • Report a problem: The email contains the macOS version instead of the iOS version.

Android version

This policy also applies to the Android version of PlantPal, with the following differences:

  • Free allowance: Apple DeviceCheck is not available on Android. With every request, the app sends the random identifier of the installation and the note “Android”. My server counts free requests per identifier and limits the free requests of all Android installations together to a monthly cap. No further information about your device is sent for this.
  • Subscription: On Android you buy and manage the “PlantPal Plus” subscription through Google Play. Payment details, name and email address are processed by Google; I do not receive them. To unlock it, the app sends your subscription’s purchase token to my server, which checks with Google whether the subscription is valid. For this, my server stores a hash of the purchase token, the state of the subscription and the time of the check; allowance and Bridges are tied to this subscription, not to your Google account.
  • Sensor Bridge: Works as described above. The keys of your Bridges are stored on this device only (no iCloud). The Wi-Fi password you enter during setup goes only to the Bridge; for the next setup, the app remembers it in its app data on this device, not on my server.
  • Share collection: Works as described above. The app keeps the member key only in its app data on this device (no iCloud); on another Android device you join the household with a new invitation code.
  • Weather: Works as described above. The app stores the chosen town only on this device (no iCloud); in the background it fetches the forecast at most every three hours when a network connection is available.
  • Collection: The app stores plants, photos, notes, care tips and checks only in your device’s internal storage. Apart from a shared household, they are not synced to other devices, and the app is excluded from Android backup to your Google account. Uninstalling the app deletes this data.
  • Notifications and widget: The app schedules watering reminders and follow-up check reminders locally on your device. The widget reads names, watering dates and small thumbnails directly from the app’s storage. No data is transmitted for this.
  • Plant sensor: To find and read a Flower Care sensor, Android asks for the “Nearby devices” permission. Up to Android 11 it asks for the location permission instead, because the system ties Bluetooth scanning to it there. The app does not determine or store your location. Without a Sensor Bridge, the link between sensor and plant and the readings stay on your device only; they are not sent to my server or to Anthropic.
  • Report a problem: The email contains the app version, the manufacturer and model of your device, the Android version and the number of your plants and checks, no photos or notes.
  • Deletion: “Delete data on the server” works as described above. There is no device value at Apple on Android.

No tracking

PlantPal contains no ads, no analytics or tracking services and creates no account.

Contact by email

If you email me, I use your address and message only to answer your request.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing and objection, and the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at). You delete plants, photos and checks in the app under “About → My data → Delete all plants and data”; this also removes the copy in your iCloud. You delete the data on my server there with “Delete data on the server” (see below). You cancel a subscription in your Apple account settings.

Controller

Christian Bumberger
Falkenweg 12
4050 Traun, Austria
support@bumberger.at