Privacy Policy

1. Introduction

This Privacy Policy explains how MyGrowPal ("MyGrowPal", "we", "us" or "our") collects, uses, shares and protects your personal information when you use the MyGrowPal mobile application (the "App"). It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By creating an account and using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

2. Who we are

MyGrowPal is the data controller responsible for your personal data. You can contact us at any time at ciaran@mygrowpal.app.

3. What information we collect

We only collect the information we need to run the App and help you garden. This includes:

Category	What it includes	How we get it
Account details	Email address, password (stored securely as a hash, never in plain text), and an optional display name.	You provide it when you sign up or update your account.
Location information	Your UK postcode, and the approximate latitude/longitude and area name derived from it. We do not access your device's GPS.	You enter your postcode manually in your account settings. It is converted to coordinates using a geocoding service (see Third Parties).
Photos & images	Photos you take or choose of seed packets, plants and journal entries.	Captured via your camera or selected from your photo library, with your permission.
Garden content	Your seed library, sowing and harvest logs, garden beds and layouts, journal entries, notes, and the AI analysis generated from your seed/plant photos.	You create it as you use the App.
Notification data	Whether you have enabled weather/garden notifications, and a device notification token if you have.	Set when you turn notifications on.
Subscription & purchase data	Whether you hold an active subscription, your subscription tier, purchase history, and a RevenueCat-assigned user identifier. We do not receive your full payment card details — these are handled by the relevant app store (Google Play).	Generated automatically when you make a purchase or when the App checks your subscription status via RevenueCat.
Analytics & usage data	App interaction events (such as which screens or tabs you view, and actions like starting a subscription), an analytics identifier (anonymous before sign-in, linked to your account after sign-in), and basic app/device metadata (app version, device manufacturer/model, operating system, and locale and device settings such as timezone).	Collected automatically as you use the App via our analytics provider, PostHog (see Third Parties).
Technical data	Basic information needed to keep you signed in and operate the App, including authentication session tokens, device information, and — where advertising measurement is enabled — device advertising identifiers used for attribution and fraud prevention.	Generated automatically when you use the App.

4. How we use your information

We use your information to:

• Create and manage your account and keep you securely signed in.
• Provide local weather forecasts, frost-date guidance and climate insights based on your postcode location.
• Analyse photos of seed packets and plants to identify them and provide growing and plant-health guidance.
• Store and display your seed library, garden beds, calendars, harvest logs and journal entries.
• Send you garden and weather notifications, where you have enabled them.
• Manage your subscription, verify your entitlements and unlock premium features.
• Understand how the App is used, diagnose problems and improve features, using product analytics.
• Measure and improve the performance of our advertising campaigns, where applicable (see Section 7).
• Maintain the security, integrity and performance of the App.
• Respond to your support requests and communicate with you about the service.

5. Our legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Performance of a contract — to provide the App and the features you ask for (e.g. your account, seed library, weather data and any subscription you purchase).
• Consent — for optional features such as accessing your camera/photo library, sending you notifications, and (where required by applicable law) advertising measurement. You can withdraw consent at any time in your device or App settings.
• Legitimate interests — to keep the App secure, prevent abuse, understand and improve our service through product analytics (including via our analytics provider, PostHog), and measure and improve the performance of our advertising, balanced against your rights.
• Legal obligation — where we must process data to comply with the law.

6. Third parties we share data with

We use a small number of trusted service providers to run MyGrowPal. We share only the data necessary for each service to perform its function. These providers are:

Supabase (backend & storage)

Supabase provides our database, authentication and file storage. Your account details, location information, garden content and uploaded images are stored on Supabase's infrastructure. See the Supabase Privacy Policy.

Open-Meteo (weather data)

To provide forecasts and climate insights, we send your approximate coordinates (derived from your postcode) to Open-Meteo's weather API. We do not send your name, email or any other identifying information. See the Open-Meteo terms.

Postcodes.io (location lookup)

When you enter your postcode, we send it to Postcodes.io to convert it into approximate coordinates and an area name. Only the postcode is sent. See the Postcodes.io service.

Google Gemini API (AI analysis)

When you use seed-packet scanning or the plant assistant, the relevant photo and a text prompt are sent to Google's Gemini API for analysis, which returns identification and growing guidance. Please review Google's Privacy Policy and the Gemini API Terms for how Google handles data submitted to the API.

Expo (app platform & notifications)

MyGrowPal is built with Expo, which we use for app delivery and notification handling. Where you enable notifications, a device notification token may be processed to deliver them. See the Expo Privacy Policy.

RevenueCat (subscription management)

We use RevenueCat to manage in-app subscriptions and verify purchase entitlements. When you make or restore a purchase, information such as your RevenueCat user ID, subscription status, purchase history and basic device information is shared with RevenueCat. RevenueCat does not receive your payment card details — those remain with Google Play. See the RevenueCat Privacy Policy.

PostHog (product analytics)

We use PostHog as a product analytics service provider to understand how the App is used and to help us fix problems and improve features. PostHog processes analytics data on our behalf to provide product analytics services. We configure PostHog so that analytics data is used to analyse and improve the App rather than for advertising purposes. This includes in-app events (such as which tabs or screens you view, and actions like viewing the paywall or starting a subscription), together with an analytics identifier and basic app and device metadata (for example, app version, device manufacturer and model, operating system, and locale and device settings such as timezone).

Before you sign in, this data is tied to an anonymous identifier generated by PostHog and stored on your device. If you create an account or sign in, we link your subsequent analytics activity to your account by associating your Supabase user ID with your analytics identifier. When you are signed in, this may include your account identifier and email address associated with your account, where available, so that logged-in usage is not anonymous. If you sign out, this link is cleared and a new anonymous identifier is used going forward.

PostHog also groups related events into lightweight analytics "sessions" so we can understand journeys through the App. This is event grouping for product analytics only. Data sent to PostHog is encrypted in transit and processed on PostHog's EU infrastructure. See the PostHog Privacy Policy.

• Purpose: understanding app usage and improving features.
• Data: analytics events, identifiers (including account identifier and email when signed in), and app/device metadata.
• Role: PostHog processes this data on our behalf as a service provider.
• Not collected via PostHog: session replay, screen recording, photos, garden content or personal notes.

We may also use advertising partners such as Meta Platforms Ireland Limited for marketing measurement and app install attribution. These partners may process limited device and event data as described in Section 7 below.

We may also disclose information if required to do so by law, or to protect the rights, property or safety of MyGrowPal, our users or others.

7. Advertising & measurement (Meta / Facebook)

We use Meta (Facebook) advertising services to promote MyGrowPal and to understand how users interact with our advertising campaigns.

Where you install the App after viewing or clicking on a Meta advertisement, we may share limited device and event data with Meta Platforms Ireland Limited and its affiliates ("Meta") to measure the effectiveness of our advertising and improve campaign performance. This may include:

• Device advertising identifiers (such as the Google Advertising ID, where permitted by your device settings).
• Approximate install or app event information (e.g. first open, sign-up, subscription purchase).
• Basic technical information (e.g. device type, operating system version, app version).
• Hashed or pseudonymised identifiers used for attribution purposes.

We do not intentionally send Meta:

• Your name.
• Your email address.
• Your garden content.
• Your photos or personal notes.

Meta SDK

The Meta SDK integrated into the App may collect and process data as described in Meta's privacy policy. We use it for advertising measurement and attribution as described above. This SDK helps us measure installs and app activity, improve ad targeting and performance, and reduce irrelevant advertising. You can learn more in Meta's Privacy Policy.

Legal basis for advertising measurement

We process this data based on:

• Legitimate interests, to measure and improve advertising performance; and/or
• Consent, where required by applicable law.

Your choices

You can limit advertising tracking on your device at any time:

• Android: Settings → Privacy → Ads → Delete or reset your advertising ID.
• Or by adjusting personalised ads settings in your Google account.

8. International data transfers

Some of our service providers are based outside the UK and may process your data in other countries (including the United States and, in the case of PostHog, the European Economic Area). Where data is transferred internationally, we rely on appropriate safeguards such as the providers' standard contractual clauses or adequacy decisions, so that your data remains protected to UK standards.

9. How long we keep your data

We keep your personal data for as long as your account is active. If you delete your account or ask us to erase your data, we will delete or anonymise your personal information, including your stored images and garden content, except where we are required to retain certain information to comply with legal obligations. Analytics events held in PostHog are retained for as long as reasonably necessary to analyse app usage and improve the App, after which they are deleted or anonymised in line with PostHog's own retention settings.

10. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time where we rely on consent.

You can exercise many of these rights directly in the App (for example, editing your account details or deleting content). To make any other request, contact us at ciaran@mygrowpal.app. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

11. How we protect your data

We take reasonable technical and organisational measures to protect your data. Connections to our services use encryption in transit (HTTPS), passwords are stored as secure hashes, and access to your stored images is granted only through short-lived, signed links. No method of transmission or storage is completely secure, but we work to protect your information and review our practices regularly.

12. Children's privacy

MyGrowPal is not directed at children. The App is intended for users aged 13 and over (or the minimum age required in your country to consent to data processing). We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where appropriate, notify you in the App. We encourage you to review this page periodically.

14. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: ciaran@mygrowpal.app
• App: MyGrowPal (Google Play package com.hulton90.mygrowpal)