Privacy Policy for TrackYourGrow

1. Data Controller

Guido Schwarz
Marienstr. 96, 50825 Cologne, Germany
Email: support@trackyourgrow.com

2. Types of Data Processed

TrackYourGrow collects and processes the following data, all of which is stored locally on your device unless otherwise specified:

• Email address, subject, and message: Provided voluntarily when you contact our support team via the in-app “Help & Support” feature. This data is transmitted to Web3Forms (https://web3forms.com) so that your message can be delivered to us.
• User-created plant photos: Taken or selected via the camera or photo library for tracking plant growth, stored in the app’s local file system.
• Plant-specific data: Watering schedules and reminders; expected harvest dates; growth progress data; plant-to-grow box associations; reminder preferences and notification settings.
• PIN data: A user-defined PIN for app access, stored locally in an encrypted format (not in a database).
• Backup data: Data exported or imported via the backup feature, including plant photos, plant-specific data, system logs, and timeline logs, stored in a ZIP file. Backup files may be encrypted with a user-provided password and can be shared via email or messaging apps at your discretion.
• Technical usage data: Limited to data required for support form submission and in-app purchase processing.

No data is stored on external servers or transmitted to third parties, except for support form submissions (via Web3Forms), in-app purchases, and user-initiated backup sharing as described below.

3. Purpose of Data Processing

We process your data solely to provide the following app functionalities:

• Camera Access: To allow you to take or select photos of your plants for tracking purposes. Photos are stored locally.
• Notifications: To send reminders (e.g., for watering plants) and use the device’s vibration feature for alerts.
• Internet Access: To submit your support inquiry via the Web3Forms service so that your message is delivered to support@trackyourgrow.com, and to provide access to external services (website, social media, community platforms).
• File Storage and Access: To save and load plant photos, and to export/import backup files (ZIP format) containing plant data, photos, and logs.
• PIN Authentication: To secure app access with a user-defined PIN, if enabled.
• Local Data Management: To store and manage plant-specific data, such as watering schedules, harvest dates, growth progress, and grow box configurations, locally using SharedPreferences.
• Backup and Restore: To allow you to export and import app data (photos, plant data, logs) as a ZIP file, optionally encrypted with a user-provided password.
• User-Initiated Sharing: To enable sharing of backup files via email or messaging apps, if you choose to do so.
• User Support: To facilitate communication with our support team when you submit inquiries via the in-app support form (delivered through Web3Forms).

4. Data Storage Location and Security

All data is stored locally on your device using SharedPreferences and the device’s file system (for photos and backup files). We implement the following measures to protect your data:

• Local Storage: Plant photos, plant-specific data, PIN data, and reminder settings are stored securely on your device.
• Encrypted PIN: The PIN, if set, is stored in an encrypted format locally and is not stored in any external database.
• Encrypted Backup Files: Backup files are encrypted using AES with PBKDF2 key derivation if you provide a password. Unencrypted backups are stored temporarily during export/import and deleted afterward.
• Support Form Transmission: Support form submissions (email address, subject, message) are sent over HTTPS to Web3Forms, which forwards them to support@trackyourgrow.com. Web3Forms processes this data only for delivery; see Section 7 for third-party details.
• No Server Storage: No data is uploaded to or stored on our own servers.
• Access Control: Only you, as the device user, have access to the locally stored data. If a PIN is set, the app requires PIN entry for access.
• Temporary File Cleanup: Temporary files created during backup/import are deleted automatically after the operation completes or is canceled.

5. Legal Basis for Processing

We process your data based on the following GDPR legal bases:

• Email Address: Processing is based on Art. 6(1)(b) GDPR (contract performance) to enable support communication.
• Plant Photos: Processing is based on Art. 6(1)(a) GDPR (consent) when you choose to take or upload photos.
• Plant-Specific Data and Reminders: Processing is based on Art. 6(1)(b) GDPR (contract performance) to provide app functionalities.
• PIN Data: Processing is based on Art. 6(1)(a) GDPR (consent) when you enable the PIN feature.
• Backup Data: Processing is based on Art. 6(1)(a) GDPR (consent) for creating, importing, or sharing backup files, and Art. 6(1)(b) GDPR (contract performance) for file storage and access.
• Internet Access for Support Form: Processing is based on Art. 6(1)(b) GDPR (contract performance) to submit and deliver support inquiries via Web3Forms.

You may withdraw consent (e.g., for photos, PIN, or backups) at any time by deleting the relevant data in the app, disabling the PIN, or disabling notifications in your device settings.

6. Your Rights

Under the GDPR, you have the following rights regarding your data:

• Right of Access (Art. 15 GDPR): View your locally stored data (plant data, photos, logs) within the app.
• Right to Rectification (Art. 16 GDPR): Edit your plant data, settings, or PIN within the app.
• Right to Erasure (Art. 17 GDPR): Delete your data by removing plant entries, photos, or uninstalling the app. If a PIN is set and forgotten, resetting the app will delete all data.
• Right to Restriction of Processing (Art. 18 GDPR): Limit processing by disabling features like notifications, PIN, or backups.
• Right to Data Portability (Art. 20 GDPR): Export your data (photos, plant data, logs) using the backup feature or device file management.
• Right to Withdraw Consent (Art. 7(3) GDPR): Stop using features requiring consent (e.g., photos, PIN, backups).
• Right to Lodge a Complaint (Art. 77 GDPR): Contact a supervisory authority if you believe your data rights are violated.

To exercise these rights, manage your data directly in the app or contact us at support@trackyourgrow.com.

7. Data Transfer to Third Parties

Your data is not transferred to third parties, except:

• Support Form (Help & Support): When you submit the support form in the app, your email address, subject, and message are sent to Web3Forms (https://web3forms.com). Web3Forms forwards the message to support@trackyourgrow.com. Web3Forms processes this data for delivery in accordance with their privacy policy. Legal basis: Art. 6(1)(b) GDPR (contract performance / handling your request).
• In-App Purchases and Subscriptions: See Section 11 for details on data shared with RevenueCat.
• User-Initiated Sharing: If you choose to share a backup file via email or messaging apps, the file (which may contain plant data, photos, and logs) is transferred to the selected service (e.g., Gmail, WhatsApp) based on your explicit action (Art. 6(1)(a) GDPR). We are not responsible for the recipient service’s data handling practices.

8. Data Retention Period

Your data is stored locally on your device:

• As long as the app is installed: Data (plant data, photos, PIN, logs) persists until you delete it or uninstall the app.
• Manual Deletion: Delete individual plant data, photos, PIN, or reminder settings within the app. If you forget your PIN, resetting the app deletes all data.
• Backup Files: Exported backup files are stored in your chosen location (e.g., device storage or shared via email/messaging). Temporary files created during backup/import are deleted automatically.
• Support Form Submissions: Data submitted via the support form is delivered to support@trackyourgrow.com via Web3Forms. We retain it only as long as necessary to respond to your inquiry, unless you request deletion. Web3Forms’ retention is governed by their privacy policy.

9. Data Deletion and Export

• Deletion: Delete plant photos, plant data, PIN, or reminder settings directly in the app. Uninstalling the app removes all locally stored data. If you forget your PIN, you must reset the app, which deletes all data.
• Export: Export plant photos, plant data, and logs using the backup feature (as a ZIP file, optionally encrypted). You can also access photos via your device’s file management system.
• Support Requests: To delete or access data related to support emails, contact support@trackyourgrow.com.

10. Changes to the Privacy Policy

We may update this privacy policy to comply with legal requirements or reflect app updates. The current version is available in the app’s About page and takes effect upon posting.

11. In-App Purchases and Subscriptions

When you make an in-app purchase or subscribe to a premium feature in TrackYourGrow, we may collect and process the following data:

• Transaction details, including the type of purchase, date, and amount.
• Subscription status and history.
• Device identifiers necessary for validating purchases and managing subscriptions.

This data is shared with RevenueCat, our third-party service provider for managing in-app purchases and subscriptions. RevenueCat uses this data to verify purchases, manage subscriptions, and provide analytics to help us improve our services. RevenueCat’s privacy policy can be found at https://www.revenuecat.com/privacy.

We do not store any payment information on our servers. All payment processing is handled directly by Apple or Google, depending on your device, and we do not have access to your payment details.

12. External Links and Third-Party Services

TrackYourGrow may contain links to external websites and services, including:

• Our official website (trackyourgrow.com)
• Social media platforms (Instagram)
• Community platforms (Discord)

When you click on these links, you will be redirected to external services that are not operated by us. We do not store or process personal data regarding your use of these links, but technical information (e.g., your IP address) is transmitted to the provider as part of the standard redirection process.

These external services have their own privacy policies. We are not responsible for the privacy practices of these third parties and encourage you to review their policies.

13. Contact

For questions or to exercise your data rights, email support@trackyourgrow.com.