Watered privacy policy.

01The short version

Watered works from the copy of your plants held on your phone. That copy is the one the app reads and the one you edit; everything described below is either a mirror of it or a record about it, never the thing itself.

Four things reach a server. When you ask Watered to identify a plant, that photo is sent through our own server to OpenAI. If you sign in, your plants and their photos are mirrored to your account so they survive a new phone, and your email address is held by Firebase Authentication. Your subscription is recorded against you by Apple and by RevenueCat. And the app reports how it is used through Firebase Analytics.

Signing in is optional and Watered stays fully usable without it — but note that even signed out, the app holds an anonymous identifier on our server so that identification requests can be metered. The sections below set out each of these in turn.

02Your plants, on the phone and in your account

Everything you add to Watered is stored on your device:

• The plants you add, including their names and species
• Photos you take of them
• Watering schedules and the record of when you last watered each plant
• Your reminder settings

If you are signed in, most of that is also mirrored to your account so that a new phone does not start empty. Plant records — the name you gave a plant, its species, its watering class and the history of when you watered it — are copied to Cloud Firestore, and their photos to Firebase Storage, both under a path belonging to your account alone and readable by no one else. Reminder settings and the notification schedule stay on the device and are never copied.

The mirror is one-directional in the sense that matters: the device is always the source, and the copy exists so it can be restored. You can delete a plant, and its photo, from either side by deleting it in the app; deleting your account removes everything held under it. Firestore and Storage are Google services, acting as our processor, and the data sits on servers in the European Union.

If you never sign in, none of this happens and no plant or photo of yours is stored on a server at all.

If you back up your phone through iCloud or Google, that backup may include Watered's data. Those backups are controlled by Apple or Google under your own account settings and are governed by their privacy policies, not this one. We have no access to them.

03Identifying a plant

Watered can identify a plant from a photo. To do that, the app sends a copy of that one photo to a server of ours, which passes it to OpenAI and returns the species and its typical watering needs. The server runs on Google Cloud in the European Union; OpenAI is based in the United States, so the photo is transferred outside the European Economic Area.

OpenAI does not use data sent through its API to train its models. It holds the photo briefly for abuse monitoring and then deletes it. The transfer is protected by the Standard Contractual Clauses approved by the European Commission.

Our own server handles the photo only for as long as the request takes — it is held in memory, passed on, and never written to disk or to any database of ours. What we do keep is a count: how many identifications your installation has made, stored against the identifier described in section 04, so that a feature which costs us money per call cannot be run without limit. That counter records a number and a date, never a photo, a species or a plant.

The original photo stays on your phone with the rest of the plant's record, and is mirrored to your account only if you are signed in, as described in section 02. If you never use the identification feature, no photo is ever sent for it.

The legal basis for this is that it is necessary to provide the feature you asked for — identification only happens when you point the camera at a plant and request it.

04The identifier behind all of this

Watered gives every installation an account with Firebase Authentication, even before you sign in. Until you do, it is an anonymous account: a random identifier and nothing else — no email address, no name, nothing supplied by you and nothing that reaches back to you.

It exists because two things have to be counted per user rather than per request: the identification quota described above, and whether a subscription is active. Without an identifier, one person's free allowance would be everybody's, and a paid feature could not be unlocked for the person who paid for it.

The app also asks Apple or Google to attest that the request came from a genuine copy of Watered on real hardware, through Firebase App Check, using App Attest on iOS and Play Integrity on Android. That check is about the app, not about you, and returns no information about your device to us.

Signing in, as described in section 06, replaces the anonymous identifier with one tied to your Apple or Google account, so it survives a new phone. Signing out returns you to a fresh anonymous one.

05If you subscribe

Watered offers a paid subscription, described in the terms of service. We do not process the payment and never see your card details, your name or your billing address — the purchase happens entirely through Apple, under Apple's privacy policy.

Managing the subscription itself is handled for us by RevenueCat. When you buy, restore or renew, RevenueCat records the purchase against the identifier described in section 04 — the app tells it which identifier you are, so that the subscription follows you rather than the device. What it holds is the purchase: which product, when it started, when it renews or expires, whether it was refunded, and the store's own transaction identifier. It does not receive your name, your email address, your card details or anything about your plants.

RevenueCat then tells our server whether your subscription is currently active, and our server stores that one answer — active or not, and until when — against the same identifier. That is what unlocks the paid features, and it is checked on the server because a device claiming to have paid cannot be taken at its word.

RevenueCat is based in the United States, so this data is transferred outside the European Economic Area under the Standard Contractual Clauses, as set out in RevenueCat's privacy policy. The legal basis is the performance of our agreement with you: we cannot give you what you paid for without a record that you paid. Apple additionally shows us aggregated sales totals in App Store Connect, which do not identify individual purchasers, and whether a purchase happened is recorded in our analytics as described in section 07, without anything that identifies you or the transaction.

06If you sign in

Watered can be used without signing in. If you choose to, you can sign in with Sign in with Apple or Google Sign-In, which keeps your plants attached to you rather than to one installation, so that a new or reset phone can restore them.

Accounts are handled by Firebase Authentication, a service provided by Google. When you sign in, Google creates an account record for you and holds it on our behalf as our processor. That record is your email address, the sign-in provider you used and an account identifier Firebase generates. If you use Sign in with Apple and choose to hide your email, Apple gives us a relay address instead of your real one and we never see the real one.

We never receive a password: authentication happens with Apple or Google and Watered only sees the result. We hold no copy of the account beyond what sits in Firebase, and we do not use your email address to market anything to you. What signing in additionally does is described in section 02: your plants and their photos begin being mirrored to your account. Google is based in the United States, so this data is transferred outside the European Economic Area under the Standard Contractual Clauses approved by the European Commission and Google's own privacy documentation.

The legal basis is the performance of our agreement with you: without an account we cannot keep your subscription and your plants attached to you across devices and reinstalls. You can delete the account from inside the app at any time — see deleting your data.

07Analytics

Watered uses Google Analytics for Firebase to understand how the app is used — how many people finish onboarding, whether an identification succeeded or failed, which screen a subscription was bought from, whether a reminder was opened. We use it to decide what to fix and what to build next.

This data is pseudonymous, not anonymous. Firebase assigns your installation an app instance ID, and on iOS it may read the vendor identifier your device gives to our apps. Neither names you, but both distinguish one installation from another, which is why we do not describe the data as anonymous.

What we record with it is deliberately narrow. Analytics events never carry:

• Your name, email address or account identifier
• Any identifier for a plant, a photo or a notification
• Photographs, or anything derived from the content of one
• The names you give your plants, or free-form species text
• Error messages or any other free-form text

That restriction is not a promise about intent: the event contract in the app's source code will not compile if an event carries any of the above, so it cannot be broken by accident.

Analytics is switched off entirely in development builds. Google acts as our processor for it, under the terms above; the legal basis is our legitimate interest in understanding whether the app works, balanced against how little the data says about you. You can object to that processing by writing to us at igor@nextpace.app.

08What we do not collect

The sections above set out what we do collect. This is the other side of it, and we want to be specific because most apps do collect these things and Watered does not:

• No password — Apple or Google verifies you and we never see one
• No advertising, no ad identifiers and no third-party ad networks
• No location data
• No contacts, calendar or health data
• No card details, billing address or anything else about how you paid
• No plants or photographs at all unless you sign in, and none of them in analytics
• No selling or sharing of personal data with anyone, for any purpose

09Permissions the app asks for

Watered asks for the minimum it needs, and only at the moment it needs it. You can refuse any of these and still use the rest of the app.

• Camera and photo library — to take or choose a picture of a plant. Used only for the photo you select.
• Notifications — to remind you when a plant needs water. Reminders are scheduled on your device; we do not send them from a server.

10If you email us

If you write to us for support, we will have your email address and whatever you tell us. We use it to answer you and nothing else. We keep support conversations for up to two years so we have context if you write again, then delete them.

11Your rights

Under the GDPR you have the right to access your personal data, correct it, delete it, object to how it is used, and receive a copy of it. In Watered's case most of this is in your hands already: the data is on your phone, so you can view, edit and delete it directly in the app at any time.

What we hold outside your phone is set out in sections 02 to 07: the identifier and its quota counter, your subscription state, the account record if you signed in, and the plants and photos mirrored to that account. Deleting your account from inside the app removes all of it, and you can export or correct the plant records directly in the app, since the device holds the authoritative copy. Analytics is keyed to an installation rather than to you, so we cannot single your events out to hand them over; deleting the app stops the collection and the events age out on Firebase's own retention schedule.

For anything else we hold — realistically, an email conversation — write to support@nextpace.app and we will respond within 30 days.

If you think we have handled your data badly, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority in your own country.

12Deleting your data

If you signed in, you can delete your account from inside the app. That removes the account record from Firebase Authentication together with everything held under it on our side — your mirrored plants and photos, the quota counter and the stored subscription state — and the app returns to working without an account. Deleting the app from your phone deletes everything Watered stored on the device, and you can delete individual plants and their photos inside the app whenever you like. Deleting the account does not cancel a paid subscription: that is managed by Apple and you must cancel it yourself. Full details, including both routes, are on the account deletion page.

13Children

Watered is not made for children. We do not knowingly collect personal data from anyone under 16, and we do not ask for an age. The app can be used without signing in at all, and if a child has signed in, an adult can delete that account from inside the app or write to us at support@nextpace.app and we will delete it.

14Changes to this policy

If we change how Watered handles data, we will update this page and change the date at the top. If a change is significant — a new service receiving your data, for example — we will say so in the app before it takes effect.

15Contact

Watered is published by NEXTPACE APP, registered in Cyprus under number HE475440, at Agiou Pavlou 115, Office 3, 2360 - 2373 Agios Dometios, Cyprus. We are the data controller for the processing described here.

Questions about this policy go to igor@nextpace.app. Support questions go to support@nextpace.app.