Privacy policy

Soleaf · updated October 6, 2026

Draft: the owner details must be completed before publication.

In short. We use your data only to make Soleaf work: sign-in, plant sync, AI photo analysis, reminders and subscription. In the free plan we show ads through Google AdMob, personalized only if you allow it. We do not sell your data. You can delete your account and data at any time from the app.

1. Data controller

Gabriele Ruiz.

For any privacy question or to exercise your rights: gabrieleruiz.dev@gmail.com.

2. What data we process and why

Account: Identifier, email and name received from Apple or Google at sign-in (with Apple you can use an anonymous address). Used to sign in and find your plants on all your devices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Plants and photos: Name, species, care plan, health status, activity dates and plant photos. Used to provide the service and sync it. Legal basis: performance of a contract.
Photos sent for analysis: The photo is sent to the artificial intelligence to identify the plant and assess its health. Legal basis: performance of a contract.
Plan and monthly analyses: Number of analyses used in the month and subscription status, to manage the free and Premium plans. Legal basis: performance of a contract.
Preventing abuse of the free plan: A code derived irreversibly from the identifier of your Apple or Google sign-in, with the number of free analyses used in the month, and the number of analyses your account makes each day. They stop free analyses from being renewed by deleting and recreating the account, and limit anomalous use. Legal basis: legitimate interest in preventing abuse of the service.
Advertising (free plan only): Device advertising identifier, technical device data and interactions with ads, processed by Google AdMob. Legal basis: consent (Art. 6(1)(a)) for personalized ads; legitimate interest (Art. 6(1)(f)) for non-personalized ads and fraud prevention.
Feedback: The message you send us from Settings, its type (idea, problem, other), operating system and app version; your email only if you choose to be contacted. Used to reply and improve the app. Legal basis: legitimate interest, and consent for the use of your email.
Location (only if you turn on weather alerts): Your phone's approximate location, rounded to about 1 km, or the city you choose. It stays on your phone: for forecasts we send MET Norway only the rounded coordinates, and the city name you search for goes to Photon to find it. Legal basis: consent: you turn it on and can turn it off at any time in Settings → Weather.
Technical data: Date, outcome and duration of requests to our server, without photos or IP address. The IP address is used only in memory, to limit abuse, and is not stored. Legal basis: legitimate interest in the security of the service.

These stay only on your phone: scheduled reminders and the counter used for ad frequency. Reminders are generated by your phone: we do not collect push notification tokens.

Providing your account data and photos is necessary to use the app; without them we cannot provide the service. We do not process special categories of data: photograph only plants, avoiding people and documents.

3. Artificial intelligence

Species, care advice and health status are generated by artificial intelligence models from the photo. The photo goes through our server and is analyzed by an external provider, which depends on your plan; Premium uses a more advanced model. We send the provider the photo and the analysis request, never your name or email.

Premium plan: the photo is analyzed by Anthropic (United States), whose commercial terms exclude the use of data sent through its API to train models. Free plan: the photo is analyzed by DeepSeek (China), whose terms do not exclude that the data sent is kept and used to improve its models; if its service does not respond, the photo is analyzed by Anthropic.

We do not make automated decisions that produce legal effects concerning you (Art. 22 GDPR). We ourselves do not use your photos to train artificial intelligence models.

4. Who processes data on our behalf

We use these providers, appointed as processors or acting as independent controllers for their own services:

Google Firebase: authentication, database and photo storage. Privacy
Anthropic (United States): analysis with artificial intelligence. Privacy
DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): photo analysis in the free plan. Terms
Google Cloud Run: the server that forwards analyses to the AI (data center in Belgium). Privacy
RevenueCat: subscription management. Payments are handled by Apple and Google: we never see your card details. Privacy
Google AdMob: ads in the free plan. How Google uses data
Apple and Google: sign-in, payments and app distribution, under their own privacy policies.
MET Norway (Norwegian Meteorological Institute): forecasts for weather alerts; it receives only the rounded coordinates, directly from your phone. Terms
Photon (komoot): city search for weather alerts, with © OpenStreetMap data; it receives only the text you search for. Privacy

5. Transfers outside the European Union

Some providers are based in or have servers in the United States. Transfers take place under the EU-U.S. Data Privacy Framework, for certified providers, or the Standard Contractual Clauses approved by the European Commission.

In the free plan, photos are analyzed in China: there is no European Commission adequacy decision for this country, and its law does not guarantee data protection equivalent to that of the Union. The transfer is necessary to provide the analysis you request (Art. 49(1)(b) GDPR) and covers only the photo and the analysis request. If you prefer that your photos are not processed in China, use the Premium plan or do not send photos for analysis.

6. Advertising and consent

In the free plan we show a video ad during the analysis and, occasionally, when you open your saved plants or when you return to the home screen. On first use we ask for your consent through Google's form; on iPhone we also ask for permission to track (App Tracking Transparency). If you do not consent, you will see non-personalized ads.

You can change your choice at any time from Settings → Privacy and legal → Ad privacy preferences, and on iPhone also from iOS Settings → Privacy & Security → Tracking. The Premium plan contains no ads.

7. Links to Amazon

Next to some care tasks (for example a pest treatment or a fertilizer) you will find a Search on Amazon link. The link only contains the search and our affiliate code: none of your data.

If you open it you leave Soleaf, and Amazon's privacy notice and cookies apply from there. As an Amazon Associate, Soleaf earns from qualifying purchases, at no extra cost to you.

8. How long we keep data

Account, plants and photos: as long as you keep your account.
Analysis counter: tied to the month it refers to, deleted with the account.
Photos sent to the AI: the provider keeps them for the time set by its own terms; the free plan's provider does not state a period.
Free-plan abuse code: until the end of the month it refers to, even if you delete your account earlier; then it is deleted automatically.
Server usage statistics (analyses per account per day, without photos or content): 90 days at most.
The result of an analysis (without the photo), so you can get it back if the connection drops or the app closes before it arrives: 24 hours.
Server technical logs: at most 30 days.
Feedback: in the app as long as you keep your account; the email forwarding it to us at most 24 months.
Purchase data: for the time required by tax and accounting obligations.

9. Deleting your data

From Settings → Delete account you delete your account, plants, photos and feedback from all devices and from our servers. Only the free-plan abuse code and the usage statistics remain, until they expire (see above). Your subscription must be cancelled separately in your App Store or Google Play settings. If you sign out without deleting your account, the data is removed from the phone but stays in your account.

10. Security

Communications are encrypted (HTTPS). Each user can read and change only their own data, thanks to security rules enforced by the server.

11. Children

Soleaf is not intended for people under 14 (the age of digital consent in Italy); if the law of your country sets a higher age, that age applies. If you believe a minor has given us data, write to gabrieleruiz.dev@gmail.com and we will delete it.

12. Your rights

You can request access to your data, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. You can withdraw your consent at any time, without affecting processing already carried out. Write to gabrieleruiz.dev@gmail.com: we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) or with the supervisory authority of the country where you live.

13. Changes

If we change this policy in a significant way we will let you know in the app. The date of the last update is shown at the top.