Privacy Policy
What we collect, why we collect it, and what we never do with it.
What we collect, why we collect it, and what we never do with it.
Last updated: October 15, 2026 · What changed
We collect what we need to run the app, and a little more to understand, across all our users, who uses it. We don't sell your data. We don't run ads. We don't share it with data brokers. You can export what we hold about your account, or delete your account and have it wiped, at any time from inside the app.
You can use UrbanTreelogy, including purchasing Pro, without creating an account. On the free plan without signing in, your garden and profile stay on your phone, and our servers hold little more than a count of the AI actions you use. If you sign in with Google or Apple, or have Pro, your garden, plans and history are also stored in our database so they can sync between devices and come back after a reinstall. In the table below, we call this your garden syncing.
Two things we ask about rather than assume: the app can report usage analytics, tied to a random account ID rather than to your name, and this website counts visits. Both stay off until you agree, apart from the minimal signals described in those sections. See Diagnostics and analytics in the app and Analytics on this website below.
One use goes beyond running the app, so we name it here: we look at which phone models and platforms people use, across all our users, as a rough indicator of our audience's spending power, to inform our business decisions. It never changes what any one person sees or pays. See Device details below.
The rest of this page explains the details (what's collected, why, who the third parties are, and how to exercise your rights) in language we hope is plain enough that you don't need a lawyer to read it.
UrbanTreelogy ("we", "us", "the app") is a smart gardening assistant built and operated by a husband-wife duo: Sayan Biswas and Abritty Bose. If you have any questions about this policy, you can reach us at urbantreelogy@gmail.com.
Here's everything UrbanTreelogy collects, the reason we collect it, and where it lives.
| What | Why | Stored where |
|---|---|---|
| Name & email | If you sign in with Google or Apple, we receive the name and email associated with that account so we can show your profile and recover your data on a new device. Apple's "Hide My Email" relay is fully supported. They are also shared with RevenueCat, our subscription provider, so we can find your purchase if you contact us about it (see Third-party services). | Firebase Auth + Firestore |
| Account ID (Firebase UID) | The internal random identifier that ties your garden, care plans, check-ins, and subscription state together. It's a random string, not derived from anything you can be identified by outside the app. | Firebase Auth + Firestore |
| Nickname | The name you choose for yourself during setup, for example LeafWhisperer. It appears in the app and as your name on the plant-sitter guide. If your garden syncs and you rank among the top 50 gardeners at your level, your nickname also goes, with your account ID, score, plant count and streak, onto a ranking kept in our database. Only our server can read that ranking: the app doesn't display it, and no copy of the app, yours or anyone else's, can read it. | Your device; Firestore if your garden syncs |
| Device ID | An identifier the app reads from your phone's operating system. On iPhone it is the identifier Apple gives apps from the same developer on your device; the app keeps the first one it reads, so restoring an iPhone backup onto a new phone can carry it over. On Android, from version 2.0, it is the identifier Android gives this app on your phone, which changes if the phone is factory reset. Versions before 2.0 sent the identifier of the phone's system software build instead, which phones running the same software share; our server no longer counts AI actions against that one. It is not an advertising identifier and can't be used to follow you across other companies' apps. The app sends it with each AI request and when you delete your account. For the fair-use limits, our server uses it only if you aren't signed in, so one device can't create many anonymous accounts for unlimited free quota. When you delete your account, our server also uses it to read this device's weekly count of AI actions, so the app can show the right free allowance afterwards. It is also saved with your device details (next row), which we look at across users as described there. It is never sent to our AI provider. | Your device + Firestore |
| Device details | Your phone's platform, maker and model, operating system version, app version, and language and region setting, together with the device ID above. We save them on your account record when your garden syncs, so we can fix problems specific to particular devices, and we look at them across all users to understand which kinds of phones and app versions people use. We also look at the device model and platform across users as a rough indicator of our audience's spending power, to inform our business decisions. We don't use them to change what any one person sees or pays: nothing in the app or on our server reads them back to decide that. They are part of your account record rather than the usage analytics you can switch off, so they are saved whether or not you agree to analytics, and they are deleted with your account. | Firestore, if your garden syncs |
| Garden & activity | The plants you add, your light spots, care you mark done, watering and weather records, weekly check-ins (with any note you write), plant health history, care plans, vacation plans, saved nurseries, and your shopping list. This is the app. Without it, there's nothing to come back to. Photos are not kept: a photo you pick is used for that one request and isn't saved by the app or by us. Separately, if you wishlist a plant that isn't in our library, its name is added, with no account or device ID, to a shared tally we use to decide which plants to add next; this happens whether or not your garden syncs. | Your device; Firestore if your garden syncs |
| Photos sent to the AI | If you send a photo to the Plant Assistant, or add a plant by photographing it, the image is sent to our AI provider for analysis. A photo file can carry details stored inside it, such as the camera model, the time and, if your camera recorded it, the place the photo was taken. Before a photo reaches our AI provider, our server removes the camera, time, location and text details stored inside it. The picture itself is not changed, and a few technical details stay with it, such as its colour profile and, for a JPEG, which way up it goes. This works for JPEG and PNG photos, the formats the app normally sends; a photo in another format, such as a GIF from your library, or a file our server can't read, is passed on unchanged. The photo travels from your phone to our server with those details still inside it, over an encrypted connection. Photos are checked automatically for inappropriate content, either before or while they are analysed (see Keeping the AI features safe). We don't save your photos on our servers. For the weekly limit we record that an AI action was used. Our server logs also note which kinds of details were removed from a photo and whether it carried a location, never the details themselves. A photo flagged by the safety check leaves the safety record described below. Your latest diagnosis stays on your phone so you can work through its checklist. If you add a plant from a photo, the plant's name and the short description and care tip the AI wrote are saved with it in your garden, which syncs like the rest of it. | The photo: transient, passed through to our AI provider, not retained by us |
| Your contact details (plant-sitter guide) | Only if you make a care guide for someone looking after your plants while you're away. The guide needs your phone number so they can reach you, and you can add a backup contact and notes on where things are kept. These go only into the guide, a PDF or text message made on your phone, and leave it only when you share or print the guide yourself. They have never been sent to our AI provider or our servers, and the app doesn't save them once you leave the screen. | On your device only, inside the guide you share |
| Plant sitter's name (plant-sitter guide) | Only if you make a care guide. The name of the person looking after your plants is used to greet them in the guide. From version 2.0 of the app the guide is built on your phone and the name is not sent anywhere. Versions before 2.0 wrote the guide with help from our AI provider, so the name you entered was also sent to them as part of that request. We have never stored it on our servers. | On your device only (versions before 2.0: also passed through to our AI provider, not retained by us) |
| Your area (location) | If you set where you live, you pick an area such as a city, district or neighbourhood, never a street or building. We save the area's name, state, country and the coordinates of its centre, and use them for weather, climate-matched advice and nearby nurseries. Your phone sends those coordinates to Open-Meteo for weather, and our server sends what you type in the search box, with your saved coordinates, to Google Places to find your area and nearby nurseries. From version 2.0 your area is not sent to our AI provider. Versions before 2.0 included your city, with the trip's expected weather, in the request that wrote the plant-sitter guide, and the earliest versions did the same in the request that wrote a vacation plan. We never ask for GPS location. | Your device; Firestore if your garden syncs |
| Life stage | Optional. A coarse, self-declared band you can pick during onboarding: student, professional, self-employed, at home, retired, or prefer not to say. If you agree to usage analytics, it helps us tell whether a feature works better for one group than another; nothing else in the app uses it. We don't ask for your age, job title, or employer. | Your device; Firestore if your garden syncs |
| Plant budget | Optional. A rough spending comfort band you can pick during onboarding: thrifty, moderate, premium, splurge, or prefer not to say. It helps Find Plants put plants near what you'd actually buy first. It's a stated preference, not income, and we never see what you spend. | Your device; Firestore if your garden syncs |
| Setup answers and settings | Your answers to the other setup questions: how your plants have fared so far, what you want from them, and how hands-on you like to be, which shapes your care plan. Also your notification and theme choices, and your phone's time zone offset, which our server uses to start your weekly AI allowance at the start of your local week. | Your device; Firestore if your garden syncs |
| Usage data | How many AI actions you use per week (counted per feature), how many care tasks you complete, your check-in streak. This powers the weekly free-tier quota and the in-app proficiency score. If you aren't signed in, a weekly count of AI actions is also kept against your device ID (see Data retention). | Firestore (care tasks and streak only if your garden syncs) |
| Subscription state | Whether you're on the Free or Pro tier, which plan you bought, when it renews. Apple/Google handle the actual payment; we never see your card details. | Firestore (synced from RevenueCat) |
| Safety record | Only if a photo you send is flagged by our automated safety check: the type of problem and the time, not the photo. Repeated flags can switch off AI features, and the location and nursery search that run through our server, for your account (see Keeping the AI features safe). | Firestore, deleted with your account |
Life stage and plant budget are the only two setup questions about your life rather than your gardening, so here's exactly where they stand. Both are optional: every one has a prefer not to say option, you can skip the step entirely, and no feature is locked or degraded if you do. Both are fixed-choice, with no free-text box, so you can't accidentally tell us more than the options above. Both stay on your profile and are never sent to our AI provider. If you agree to usage analytics, they are also attached to your analytics data as broad groups (see Diagnostics and analytics in the app); if you don't, they go nowhere else. You can change either answer at any time by running setup again from Your Profile, and choosing prefer not to say withdraws it.
Some features send a request to our AI provider, Google's Gemini API. Your phone never contacts it directly: every request goes through our own server, which adds only the context that feature needs. These features are:
Find Plants is worked out on your phone and doesn't use AI. Vacation plans haven't used AI since version 1.6.3, and from version 2.0 the plant-sitter guide is built on your phone too. Earlier versions, which some people still use, send more:
It never receives the name or email on your Google or Apple account, your account ID, your device ID, your nickname, your life stage or your plant budget. We don't keep your questions, your photos or the Plant Assistant's answers on our servers. When you save a result, such as a plant identified from a photo or a plant name you typed, with the description and care tip the AI wrote, or a care plan the AI wrote for a plant outside our library, it becomes part of your garden and syncs like the rest of it. We don't use your data to train AI models. Google processes these requests under its Gemini API terms for paid use. Under those terms, Google doesn't use the requests we send or its responses to improve its products. It logs them for a limited period, solely to detect and prevent violations of its Prohibited Use Policy, and may store them transiently or cache them in any country.
Photos are checked automatically for inappropriate content, either before or while they are analysed. If a photo is flagged, we record on your account that it happened and when (not the photo), and repeated flags can switch off the AI features, and the location and nursery search that run through our server, for that account. That record is deleted with your account, and you can email us if you think we got it wrong. We also check typed questions automatically for attempts to misuse the assistant. A match is noted in our server logs with your account ID, but it never blocks your question and never counts against your account.
The app uses two Google services that are worth keeping apart, because we treat them differently and so does the law. One keeps the app working. The other tells us whether a feature was worth building.
When the app crashes or hits an unexpected error, we receive a report: what went wrong, where in the code, the app version, the device model and operating system version it happened on, and a random identifier Crashlytics keeps for this installation. A report can also include short technical notes about what the app was doing just before, such as which kind of network error occurred, or how many plants and spots you had against your plan's limits. Builds are tagged as store or test builds so our own test phones don't skew the numbers. It is how we find faults we cannot reproduce ourselves, including ones that only appear on particular devices or network conditions.
This runs whenever you use a released build, and we do not ask permission for it. Keeping the app working is what you installed it for, and a crash reporter that only runs for some people cannot tell us whether a fault is rare or everywhere. Reports carry your account identifier, so we can tell one person's repeated crash from many people's single ones. They are not designed to carry your garden, your photos, your questions to the assistant, or anything you typed. The one exception: if data saved on your phone, or a reply from our server, is damaged and can't be read, the report can include a short fragment of it so we can see what broke. Because the Plant Assistant's answers arrive as replies from our server, that fragment can include part of an answer.
Analytics tells us which features get used and where people give up. It is off until you agree. We ask once, inside the app. From version 2.0, nothing is sent until you answer, first open included. In versions before 2.0, nothing about how you use the app is collected until you answer, apart from the standard signals the analytics library may send automatically the first time a newly installed app starts, such as first open. If you decline we do not ask again.
If you agree, we record events about which features get used, for example: finishing onboarding, adding a plant, opening the upgrade screen or tapping a Pro feature, starting, completing or failing a purchase, redeeming a promo code, signing in, generating a vacation plan, adding or ticking items on your shopping list, opening a shop or setup guide link, opening a plant fact, seeing or answering an update prompt, the plan limit screen opening (with how many plants and spots you have against the limits), and network or store errors the app recovered from. Earlier versions of the app record fewer of these. Events carry short labels, such as which store or which fact, and never what you typed, which plants you grow, or your photos. Alongside those, the Google Analytics SDK records its own standard events for any app that uses it, such as first open and session starts, together with your device type, app version, an analytics identifier for this installation, and a coarse location derived from your IP address. Your account identifier is attached so repeat use is not counted as a new person each time. From version 2.0 it is attached only while analytics is on; versions before 2.0 set it in the analytics library whether or not you had agreed.
If you have filled in the optional life stage and plant budget questions, those two answers are attached as broad segments, so we can tell whether a feature works better for one group than another. We do not record what you typed, which plants are in your garden, your photos, or anything you asked the assistant.
You can change your answer at any time with the Usage analytics switch on Your Profile. Switching analytics off stops collection and resets the analytics identifier for this installation, and from version 2.0 it also removes your account identifier from analytics. Your account identifier itself doesn't change, so if you switch analytics back on, new events can be linked to the ones sent before. Data already sent stays in Google Analytics until it expires under our retention setting. Deleting your account also stops collection and resets the question, so a fresh start on the same device is asked again rather than assumed.
Everything above describes the mobile app. This website, the pages you are reading right now, is a separate thing, and it does one thing the app does not: it counts visits, using Google Analytics 4, so we can tell whether anyone is finding us at all. It is not connected to your app account. There is no way for us to tie a visit here to a garden in there.
Analytics storage is off by default. We ask on your first visit to our home page, and nothing is stored until you answer.
_ga and _ga_<id>) so a repeat visit is recognised as the same person rather than counted twice. It records which pages you viewed, how you arrived (referring site or search), your device and browser type, and a coarse location derived from your IP address, city level at finest. We never see the IP address itself.We use this to answer questions like "did anyone visit this week" and "which page do people land on first". We do not run ads, remarketing, Google Signals, or cross-site tracking. Ad storage and ad personalisation are switched off permanently, not merely until you consent. To change an answer you have already given, clear this site's data in your browser settings and we will ask again on your next visit to the home page.
If you would rather not be counted at all, your browser's tracking protection or Google's opt-out add-on will block it, and every page here works exactly the same.
UrbanTreelogy uses the OS notification permission only for reminders that come from your own plans and settings: care-plan task reminders (and their Remind me in 3 hours option), vacation departure and return reminders, a reminder to try out a watering setup before you leave (from version 2.0), and reminders you set on shopping-list items. These notifications are scheduled locally on your device; no third-party push service is involved and no notification content leaves your phone. You can revoke the permission at any time from your system settings, and the app continues to work with notifications disabled.
We do not use your information for advertising, profiling for ad networks, or selling to data brokers. We don't use your data to train AI models. If that ever changes, we'll update this page before it happens.
UrbanTreelogy is built on a small set of trusted infrastructure providers. Each one only sees the slice of data it needs to do its job.
| Provider | Role | What they see |
|---|---|---|
| Firebase (Google) | Authentication, database (Firestore), and the cloud functions that run our server logic, plus App Check, which confirms that requests to our servers come from a genuine copy of the app. | Almost everything in the table above, and, like any server, your device's IP address. They process this on our behalf under Google's data-processing terms. For App Check, Google Play Integrity (Android) or Apple App Attest (iPhone) vouches for your device and the app; those checks carry no garden data, name or email. |
| Google Generative AI (Gemini API) | Powers the Plant Assistant (answering questions and diagnosing a plant from photos), identifying a plant from a photo, checking a plant name you type, and care plans for plants outside our built-in library. Versions of the app before 2.0 also used it to write the plant-sitter guide, and versions before 1.6.3 to write vacation plans. Called only from our servers. | What you type or attach for that feature (a photo, with the details stored inside it removed as described under Photos sent to the AI), context about a garden plant you attach and, for Pro, your recent care activity and trip dates, and a broad climate band for care plans. Versions before 2.0 also sent the plant names, the sitter's name, your city and the trip's dates and expected weather when writing a sitter guide, and versions before 1.6.3 sent the plant names, the trip's dates and your area's climate, or in the earliest versions your city and its expected weather, when writing a vacation plan. Full detail in The AI features. They never receive the name or email on your Google or Apple account, your account ID or your device ID. Under Google's terms for paid use, Google doesn't use these requests to improve its products and logs them for a limited period only to detect and prevent violations of its usage policy. |
| Google Analytics | Counts visits to this website, and separately, records feature events in the app if you agree to it. | On the website: which pages you viewed, your referrer, your device and browser type, and a coarse location from your IP. In the app: the feature events described above, your device type and app version, an analytics identifier for this installation, your account identifier (from version 2.0, only while analytics is on), and your optional life stage and plant budget answers. Both are only with your consent, and the two are not joined together. |
| Firebase Crashlytics (Google) | Reports crashes and unexpected errors in the app so we can fix them. | The error and where it happened in our code, the app version, your device model and operating system version, a Crashlytics installation identifier, your account identifier, and short technical notes about what the app was doing. Not designed to carry anything from your garden, photos, or assistant conversations, apart from the one exception described above. |
| RevenueCat | Manages subscription state across the App Store and Google Play, so we can tell whether you're on Free or Pro. | Your account ID, whether you're signed in, the product you bought, and whether the subscription is active. If you signed in with Google or Apple, also the name and email on that account, so we can find your purchase if you contact us about it. Like any service your phone talks to, they also see your device's IP address, platform and app version. They never see anything from your garden. |
| Google Sign-In / Sign in with Apple | Optional sign-in, so your garden syncs across devices. | That you signed in to UrbanTreelogy. They share your name and email (or Apple's private relay address) with us. Nothing from your garden goes to them. |
| Open-Meteo | Weather forecasts, past weather and sunrise and sunset times for your area, used for care plans, weather alerts, vacation plans and the app's day and night ambience. | The coordinates of the area you chose, and your device's IP address, because your phone asks them directly. Never your name, email or account ID. |
| Google Places (Google Maps Platform) | Suggests areas as you type your location, and finds plant nurseries near you. | The text you type in the location search and the coordinates of the area you have saved. Requests go through our server, so Google does not see your IP address, name, email or account ID. |
| OpenStreetMap (Nominatim) | A backup location search, used only when our usual location search is unavailable. | The text you type in the location search and your device's IP address, because your phone asks them directly. Never your name, email or account ID. |
| Apple App Store / Google Play | Process the actual payment for Pro subscriptions. | Your payment details and Apple/Google account. We never see your card number, billing address, or payment method. |
All of them are established providers with their own published privacy practices.
Some buttons open another site in your browser: online plant stores, Google Maps for a nursery, Google Images to see a plant or pest, and guides for watering setups. The link carries only what it needs, such as the plant or product you're searching for, never your name, email or account ID. Once you're there, that site's own privacy policy applies. Some store links may carry a referral code that credits us if you buy, and setup guide links labelled Sponsored are paid placements; neither changes what we share about you, which is nothing. If you paste a Google Maps link for a nursery, your phone opens that link to read the nursery's name and address.
We keep your data until you delete it. We don't currently delete accounts that stop being used, so if you're leaving for good, please tap Delete account before uninstalling. If you've already uninstalled, email us and we'll help. When you tap Delete account in the app, what happens next depends on whether you have an active App Store or Google Play subscription at the time.
We delete it straight away, while you wait:
After this, signing in again with the same Google or Apple account creates a brand-new account with no historical data. There is no way for us, or you, to recover what was deleted.
Apple and Google do not allow third-party apps to cancel a paid subscription on the user's behalf, so deleting your account in our app would still leave you being charged. To prevent that, we use a two-step deletion when an active subscription is detected:
softDeletedAt timestamp marking the deletion. Your Firebase Authentication record is also kept alive, and so is your RevenueCat customer record, including the name and email on it if you had signed in.The 90-day grace exists purely to give you a recovery window for the Pro you've already paid for. If you'd prefer immediate full deletion regardless of subscription state, cancel your subscription first via Settings → Apple ID → Subscriptions (or the equivalent on Google Play), wait for it to expire, and then tap Delete account.
One small record outlives account deletion on purpose: a count of AI actions for each week, kept against your device ID, with no name, account ID or content attached. Only AI actions used without signing in are counted this way; before October 15, 2026, signed-in use was counted too. It exists so that deleting and recreating an account can't reset the free weekly limit. We don't currently delete these weekly counts.
Our servers keep short technical logs so we can fix problems. Some include your account ID and, like any web server's logs, your device's IP address, but never your questions, photos or garden, and they are deleted automatically after a limited period.
Crash reports, and usage analytics if you had agreed to them, that were sent before you deleted your account stay with Google until they expire under its retention settings. If you want them removed sooner, email us and we will make the erasure request to Google on your behalf.
If your phone backs up apps (Android backup or an iPhone backup), the app's on-device data is included in that backup, which is kept in your own Google or Apple account under their settings. Restoring it can bring your previous garden back.
Some residual data may persist briefly in our cloud providers' backup snapshots before rotating out. We may also retain anonymous, aggregated metrics that can no longer be linked back to you as an individual, such as total active gardens, or the tally of wishlisted plant names described under Garden & activity.
Regardless of where you live, UrbanTreelogy gives every user the same controls:
If you're in the EU, UK, or California, you also have the rights granted under GDPR / UK GDPR / CCPA respectively (including the right to lodge a complaint with your local data-protection authority). Email us first. We'd rather fix it.
UrbanTreelogy is operated from India, and our service providers (Firebase and Google, including Google's AI and Maps services, RevenueCat, Open-Meteo, OpenStreetMap, and Apple) operate in many countries. By using the app you understand that your data may be processed in countries outside your own, including the United States. Firebase and Google, RevenueCat and Apple rely on standard contractual clauses or equivalent legal mechanisms for cross-border transfers. Open-Meteo and OpenStreetMap are public services that your phone contacts directly, under their own terms.
Plants don't care about your age, and neither does our app. UrbanTreelogy is rated 4+ and family-friendly: a curious eight-year-old learning to water a basil plant is just as welcome as their grandparent tending a balcony of succulents. Use it together. We'd love that.
Nothing in the app asks for an age or a date of birth, and the optional onboarding questions aren't a back door to one: "student" covers a ten-year-old with a windowsill herb pot and a forty-year-old back in evening classes alike, and we make no attempt to tell them apart.
That said, we don't knowingly collect personal information from children under 13 without a parent or guardian's involvement, and the app doesn't need any such information to work. If you're a parent and you'd like a child's account removed, email us at urbantreelogy@gmail.com and we'll take care of it.
Your data is transmitted over HTTPS and stored in Firestore with project-level access controls. Authentication uses Firebase's tokens. Your password (if any) is held by Google or Apple, not by us. Cloud Functions run with least-privilege service accounts, and our RevenueCat webhook is protected with a shared secret.
No system is perfectly secure, but we treat your data the way we'd want our own treated.
If we change this policy in a material way, we'll update the "Last updated" date at the top and summarise what changed below. Minor wording fixes don't get a summary but will still be reflected here. You can find this page at any time from the About screen in the app.
We checked this page line by line against the app and our server and corrected it. Several corrections describe things the app already did that the earlier page left out or got wrong, so they are worth reading even if you have read this page before. Some changes took effect on our server on October 15, 2026, for every version of the app; others come with version 2.0 of the app. Each is noted below.
Questions, concerns, or want to exercise a right we listed above?