Privacy Policy for the “Plabro” app
1. Controller
Andre Müller, Eisenbergstraße 11, 37247 Großalmerode, Germany, email: dev@buggxs.com. No data protection officer has been appointed, as none is legally required.
2. Summary
Your plants, photos, care logs, reminders and settings stay on your device. Data leaves your device only for: the optional AI plant scan (photo; not stored by us, retained by Google for a limited period solely to detect abuse), an anonymous sign-in that happens only when you use the scan (random ID, no name or email), an app integrity check, and crash reports only if you opt in. Backups and share images go only where you send them, never to us. No ads, no analytics, no location.
3. Local storage
Plants, album photos, watering/fertilizing logs, guide progress and settings are stored only in the app's private storage on your device. We have no access to them. They remain until you delete them in the app or uninstall it. Legal basis: strictly necessary for the service you request (Sec. 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR). If Android backup to your Google account is enabled on your device, Android may include this app data in that backup.
Backup file
You can save your data (plants, care history, seedlings, photos and a few settings such as reminder time and appearance) as a file. The file is created locally and handed to a place of your choice via your device's share menu. Plabro does not upload it and has no access to it. The file is not encrypted. Photos are saved as they are stored in the app; photos taken from your gallery may contain embedded metadata (e.g. location). If you store the file in a cloud service or send it to someone, that service's privacy terms apply. When you restore a backup, you pick the file in your device's file picker; the data is processed only on your device and replaces your current data.
Share or save as image
You can share a plant or a seedling success as an image or save it to your gallery. The image is created on your device without embedded metadata. Your plant photo appears on it only if you switch it on (off by default). You can hide the name and time span. The image goes only to the target you choose in your device's share menu, or to the “Plabro” folder in your gallery. Nothing is sent to us. When you share via other apps, their privacy terms apply.
4. AI plant scan
- Purpose: Identify a plant from a photo and suggest care information. Optional; you can always add plants manually.
- Flow: The app resizes the photo (max. approx. 1024 px) and removes metadata (EXIF, incl. GPS) before sending it via HTTPS, together with your sign-in token, an App Check token and your device language (for the language of the result), to our server on Google Cloud Run in Frankfurt, Germany (
europe-west3). Your IP address and request time are processed for technical reasons. Our server forwards the photo to a Google Gemini model and returns the result, which is stored only on your device. - No storage: Our server does not store photos or AI responses; the photo exists only in memory for the duration of the request.
- Processing via the paid Gemini API. Google acts as our processor under its Data Processing Addendum and does not use the photos for training. Google retains prompts and responses for a limited period solely to detect abuse and may cache data transiently in any country where it operates facilities, including the USA (see section 9).
- Legal basis: Art. 6(1)(b) GDPR. Please photograph only the plant, not people.
- AI results are labelled as such and may be wrong. Toxicity information is provided without guarantee. No automated decision-making within the meaning of Art. 22 GDPR.
5. Anonymous sign-in (Firebase Authentication)
A random user ID (UID), a short-lived ID token, IP address and technical device information (e.g. user agent) are processed by Google Firebase as our processor so that only genuine app installs can use our server and the daily scan limit works. The sign-in happens only when you start your first scan; if you never scan, no ID is created. You do not create an account. Once the ID exists, the app shows a shortened “support ID” in your profile that you can copy and give us with questions or deletion requests. Processing takes place in the USA (section 9). Legal basis: Art. 6(1)(b) and (f) GDPR. Retention: until you use “Delete all data” in the app, which deletes the anonymous account.
6. Abuse protection (Firebase App Check / Play Integrity)
An integrity token generated by Google Play on your device and the user agent are checked on each request to confirm the request comes from an unmodified Plabro app. According to Firebase, this is not linked to a user or device ID. Legal basis: Art. 6(1)(f) GDPR (security). We do not store the token.
7. Server logs and scan limit
- Logs: time, endpoint, status, duration, IP address, user agent and a hashed user ID; no photos, no AI responses. Purpose: operation, debugging, security. Legal basis: Art. 6(1)(f) GDPR. Retention: 30 days.
- Scan limit: 3 scans per user ID per day. Our server keeps a counter of your anonymous user ID, the date and the number of scans in Google Firestore (Frankfurt am Main,
europe-west3) as our processor, deleted automatically after 2 days at the latest. There is also a daily cap for all users combined; that counter contains no user ID. “Delete all data” removes the counters tied to your user ID. Legal basis: Art. 6(1)(f) GDPR (cost and abuse protection); you may object (section 14), after which the scan is unavailable but the app remains fully usable.
8. Crash reports (Firebase Crashlytics) – opt-in only
If you agree, the app sends crash reports (stack trace, app version, device model, OS version, device state, Crashlytics installation ID; no plant data or photos) to Google Firebase as our processor, possibly processed in the USA. Legal basis: your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). Without consent Crashlytics is disabled. It is off by default; you choose in onboarding or later. Withdraw at any time under Profile > Privacy and data > Privacy. Retention: 90 days.
9. Transfers to third countries
Firebase Authentication, Crashlytics and the Gemini API may process data in the USA. Transfers are based on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR; Google LLC is certified) and, in addition, EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
10. Permissions
| Permission | Details |
|---|---|
| Camera | To take a plant photo; requested only when you open the camera. If denied, choose a photo from the gallery or add the plant without a photo. |
| Photos | The app uses the Android system photo picker; it only sees the photos you select. No separate permission. |
| Notifications | For one daily care reminder, scheduled locally on your device; no server push. Requested after you add your first plant. If denied, you just won't get reminders. |
| Location | No location access. |
| Backup, sharing, gallery | No additional permission needed. |
11. Email contact
If you email us (e.g. via “Report result”), we process your email address and message to handle your request (Art. 6(1)(b)/(f) GDPR) and delete it once resolved unless legal retention applies. Our mailbox is hosted by IONOS SE (Montabaur, Germany).
12. Google Play and this website
Google Play distributes the app as an independent controller (https://policies.google.com/privacy).
Review prompt: After you have used Plabro for a while and completed some care tasks, the app may occasionally ask Google Play to show Google's review dialog. Google Play decides whether it appears. You submit a review directly to Google Play under Google's terms. We receive no data from you and do not learn whether or how you rate the app. The counters needed for this (e.g. completed care tasks, time of the last prompt) are stored only on your device.
This website is provided via Google Firebase Hosting. When you visit it, Google processes technically necessary data (e.g. IP address, time, browser) to deliver and secure the site. Legal basis: Art. 6(1)(f) GDPR. We use no cookies and no tracking.
13. Security and deletion
All app–server traffic uses TLS. A backup file is not encrypted, so keep it somewhere you trust. “Delete all data” (Profile > Privacy and data > Privacy) removes all local data and, if it exists, your anonymous account and its scan counters. On our server: no photos stored (for Google's limited retention see section 4), scan counters deleted after 2 days, logs after 30 days. You may also request deletion at dev@buggxs.com; since we store no names or emails, the in-app deletion is the most reliable way (your support ID is in your profile once you have scanned). Backup files and shared images you saved or sent outside the app are not held by us; you delete them yourself.
14. Your rights
Access, rectification, erasure, restriction, data portability, objection to processing based on Art. 6(1)(f) GDPR, and withdrawal of consent at any time (Arts. 15–18, 20, 21, 7(3) GDPR). Contact: dev@buggxs.com. You may lodge a complaint with a supervisory authority (Art. 77 GDPR); ours is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden, Germany
https://datenschutz.hessen.de
15. Children and changes
The app is not directed at children under 16. We will update this policy when the app or the law changes.