Leafmend privacy policy

Who we are

Leafmend is made by Wavista Apps, operated by William Tsao, an individual based in California, USA. Contact: [email protected].

What stays on your iPhone

Leafmend has no account. It saves these only in the app's storage on your iPhone:

• your garden: ZIP code, growing zone, frost dates, the nearest weather station's name, and the approximate center of your ZIP code (about 1 km precision);
• your beds, plantings and harvests;
• your diagnoses and re-checks, with their photos, your notes and checklists, and the AI results;
• your setup answers (ZIP code, experience, crops and what worries you most) and your settings.

The app finds your zone and frost dates from your ZIP code using a table built into the app, without going online. Reminders (frost, rain, heat and re-check) are scheduled on your iPhone; we do not use push notifications from a server.

If you back up your iPhone to iCloud or a computer, the backup includes this data, as it does for any app.

What leaves your iPhone, and who receives it

Our server and OpenAI (diagnosis and plant identification)

Photo analysis needs your permission. The app asks on a consent screen first, and nothing is sent if you choose Not now.

When you ask for a diagnosis or an identification with AI analysis allowed, the app shrinks each photo and removes its metadata, including any location, and sends to our server:

• Diagnosis: 1 to 3 photos, the crop name, your growing zone, a short weather summary (for example recent lows and rain) and any note you add (up to 300 characters).
• Re-check: the earlier "before" photo and the new photo, the crop, your zone, the earlier problem, how many days have passed and how it went.
• Plant identification: 1 photo.

Our server removes any remaining metadata and sends these to OpenAI to get the result. It keeps photos and text in memory only while it gets the result. It does not save them or write them to its logs.

OpenAI receives the photos and details, but not your name, your ZIP code or the app's anonymous ID. We send each request with OpenAI's storage option turned off (store=false), so OpenAI does not keep it as a stored conversation. OpenAI does not use API data to train its models. It may keep API data for up to 30 days only to check for misuse, and then deletes it.

The app keeps your diagnosis photos on your iPhone, with the diagnosis, until you delete them or use Delete my data.

Withdraw your permission at any time: Settings, Use AI analysis.

Our server and the National Weather Service (weather alerts)

For frost, rain and heat alerts, the app sends the approximate center of your ZIP code (a latitude and longitude rounded to about 1 km, not your iPhone's location) to our server. Our server asks the US National Weather Service (api.weather.gov) for the forecast at that point, without any ID. It keeps the forecast in memory, with no ID, so nearby requests can share it; a place is dropped after about 12 hours, or sooner if the server restarts. The app may also refresh the forecast in the background. Our server does not save the location in its database or its logs, and does not keep it with your anonymous ID.

What our server keeps

Every request to our server carries the app's anonymous ID (a random ID created by RevenueCat, see below), so the server can check your subscription and daily limit. Our server keeps:

• A record of each AI request: the time, the feature, which kind of AI answered, whether it worked, how long it took, its cost, the confidence of the answer and your answer to "Was this right?" if you give one. It is tied to a scrambled form of the anonymous ID (a salted hash), not the ID itself, and never includes photos, notes or weather. Records are deleted after 90 days.
• Daily usage counts, tied to the scrambled ID, deleted after 90 days.
• Your subscription status: the anonymous ID with the product, the expiry date, whether it is a trial and whether it was a test purchase. RevenueCat sends this to our server when your subscription changes. We keep it until you use Delete my data.

Our server uses your IP address for a moment, in memory, to limit how many requests one connection can make. It does not save it in its database or its logs. Our server runs on Fly.io, and its database is hosted by Supabase, both in the United States. Every hour we save a backup copy of that database in a separate private storage bucket at Cloudflare R2. Each copy is encrypted before it is uploaded, with a key that only we hold, so Cloudflare cannot read it. We use backups only to recover the database if something goes wrong.

RevenueCat (subscriptions)

RevenueCat runs the subscription for us. It receives the app's random anonymous ID, your App Store purchase records (what you bought, when, its price, and trial and renewal status) and technical details such as the iOS and app version. Its software also sends the identifier for vendor, an ID that Apple gives our apps on your iPhone. RevenueCat never gets your name, email or payment card. If you installed the app from an ad on the App Store (Apple Ads), Apple tells RevenueCat which ad campaign, ad group and search keyword led to the install, so we can see whether our ads pay for themselves. This is Apple's own ad attribution: it does not use the advertising identifier and needs no tracking permission. Apple handles payment.

PostHog (usage analytics, which you can turn off)

We use PostHog to see how the app is used, so we can find problems and improve it. Analytics are on when you install the app, and you can turn them off at any time in Settings, Share usage analytics. When they are off, the app sends nothing to PostHog. When they are on, PostHog receives, tied to the anonymous ID:

• the setup answers you pick from a list: your experience, the crops you grow and what worries you most. Your ZIP code is never sent;
• events such as opening the app, setup steps viewed, permission answers, your AI choice, when the subscription screen was shown, trials, purchases and restores, when a diagnosis started, finished (how long it took, its confidence) or failed (an error code), your thumbs answer, shares and review prompts;
• that you completed a diagnosis (the crop, the kind of problem and whether the photo was usable) or a re-check (the outcome), added a planting (the crop), viewed the calendar or opened a reminder (its type);
• details the PostHog software adds, such as the app version, iOS version, device model, language, time zone and screen size.

PostHog never receives your photos or notes. Session recording, touch tracking and location lookup from your IP address are turned off. PostHog does not store your IP address.

Sentry (crash reports)

If the app crashes or hits an error, it sends a report to Sentry so we can fix it: what went wrong and where in the app, the device model, iOS and app version, a random ID Sentry makes for the install, and a short trail of what the app did just before, which can include which of our server's addresses it called, but never the part of an address that carries details such as your location. For about 1 in 10 app starts and screen loads it also sends performance timings, with the same addresses cut short the same way. Reports do not include the anonymous ID. Before a report is sent, the app cuts a failed database save down to the kind of action and the table name, so a report never includes what you were saving, such as a note. It also leaves out request details and console logs. Sentry does not store your IP address.

Apple

Apple handles the App Store, payments and iPhone backups under Apple's own privacy policy.

Email to support

If you email us, we receive your email address, your message and the details that Contact support adds (app version, iOS version and the anonymous ID). We use them only to help you. We keep support emails for 2 years after your last message, then delete them. Cloudflare forwards them to our Gmail (Google) inbox.

Permissions

• Camera and photos: only to take or choose a plant photo.
• Notifications: for frost, rain, heat and re-check reminders.

Leafmend does not ask for your location, contacts, microphone or Apple Health. You type your ZIP code yourself.

How long data is kept

• On your iPhone: until you delete it, use Delete my data or delete the app.
• Photos and details on our server: not stored, only held in memory during the request.
• Weather forecasts on our server: in memory for about 12 hours, not tied to you.
• At OpenAI: up to 30 days, only for misuse checks.
• Request records and usage counts on our server: 90 days.
• Encrypted backups of our server's database: hourly copies for 3 days and daily copies for 35 days, then deleted automatically. Anything removed from the database, including by Delete my data, is gone from every backup within 35 days.
• Subscription status on our server: until you use Delete my data.
• RevenueCat: for as long as we offer the app, so your subscription can be restored.
• PostHog: up to 1 year, or until you use Delete my data.
• Sentry: 30 days.

Delete my data

Open Settings and tap Delete my data. The app deletes everything it saved on your iPhone right away (your garden, plantings, harvests, diagnoses, photos, answers and settings), cancels its reminders (a reminder before a free trial ends stays, like the subscription) and starts again from the beginning. Analytics are turned off on that iPhone until you turn them on again in Settings. Then it asks our server to:

• ask PostHog to delete your analytics profile and its events;
• delete your subscription status record;
• remove the scrambled ID from your request records, so they can no longer be tied to you (they are still deleted at 90 days);
• delete your usage counts from earlier days. Today's count stays until it expires, so daily limits still work.

Backups made before the deletion still hold the old records until those copies are deleted, at most 35 days later. Nobody can read a backup without our encryption key, and we use backups only to recover the database after a failure.

If your iPhone is offline or our server cannot be reached, the app tries again by itself. While the deletion is waiting for our server, Settings shows it and offers Email support. If you delete the app before then, it can no longer finish this step, so first email us from Contact support (it adds the anonymous ID we need) and we will delete the server copy.

Delete my data does not cancel your subscription and does not delete RevenueCat's purchase record, so you can still restore your subscription. To ask for your RevenueCat record to be deleted too, email us.

Your requests

You can email [email protected] to ask what we hold about you, or to delete it. Send the email from Contact support in the app so it includes the anonymous ID; we cannot find your data without it, because we do not know your name. We reply within 30 days.

What we do not do

We do not sell your personal information or share it for advertising. The app has no ads and does not track you across other companies' apps or websites.

The app does not track you across other companies' apps or websites, so there is nothing for a Do Not Track signal to turn off, and the app does not respond to one.

Children

Leafmend is not directed to children under 13, and we do not knowingly collect data from them. If you think a child has used the app, email us and we will help delete the data.

Where the law requires it, the app asks Apple for your age range. The answer stays on your iPhone, is used only to apply age protections, and is never sent to us or anyone else. If Apple says you are under 13, or you choose not to share your age range where it is required, the app turns off usage analytics, Apple Ads attribution (see RevenueCat above), the AI diagnosis that sends photos to our server and OpenAI, your answers about AI results, and weather alerts, because they send the approximate center of your ZIP code to our server. Any other feature that sends your ZIP code or ZIP area is off too. Your zone, frost dates and reminders keep working on your iPhone.

Security and where data is processed

The app talks to our server and service providers over encrypted connections (HTTPS). Our server stores the anonymous ID only in scrambled form, except in the subscription record. Our server, its database and our service providers process data in the United States. Database backups are encrypted before upload and kept in Cloudflare R2's Eastern North America region.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change affects how we use data you already gave us, we will tell you in the app first.

Contact

[email protected]

Back to top