Verdicord App Privacy Policy

Verdicord is local-first. Without an account, all your data (plants, journal, photos) stays exclusively on your device. It is never transmitted to us. Only once you create an account and sign in is data uploaded to the cloud for backup and sync.

This privacy policy applies to the mobile app Verdicord. A separate privacy policy applies to the website verdicord.com.

1. Controller

The controller responsible for data processing in the app is:
Georgios Minassidis
Welserstraße 3
87463 Dietmannsried, Germany
Email: info@verdicord.com

2. Use without an account (guest mode)

You can use Verdicord without registering. In this case, your plants, journal entries, notes, and photos are stored only in a database on your device. No data is transmitted to us or any third party. You can delete this data yourself at any time by resetting or uninstalling the app.

3. Account and sign-in

If you create an account, we process your email address and a password (stored encrypted). They are used for sign-in, email confirmation, and password resets. The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR).

4. Synchronized content

Once you are signed in, your garden content is synchronized to the cloud so it stays backed up and available across multiple devices. This includes:

• Plants (species chosen from the bundled encyclopedia, nickname, location in your home, light exposure, notes)
• Journal entries (action such as watering or fertilizing, note, timestamp, optionally a temperature snapshot)
• Profile details (optional name, units, reminder time and, if you share your location, your garden's coordinates)
• Photos of your plants (see section 5)

The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR). Every row is strictly tied to your account via row-level security and is not accessible to other users.

5. Photos

You can take growth photos of your plants with the camera or select an existing photo from your library. Photos are stored locally first. If you're signed in, they are resized and compressed (JPEG) and uploaded to a private storage area tied to your account. If you delete a photo in the app, the uploaded copy is deleted as well. The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR).

6. Location and weather

If you allow it, the app reads your approximate device location once to set your garden's location and show matching local weather. For this, the coordinates are transmitted to the following services:

• Open-Meteo to retrieve current and past weather data for the coordinates.
• BigDataCloud to convert the coordinates into a place and country name (reverse geocoding).

Sharing your location is voluntary; the legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the system settings. Without sharing it, the app continues to work, just without automatic location and local weather.

7. Permissions

The app only requests permissions when you use the relevant feature:

• Camera to take photos of your plants.
• Photos / media library to select existing images.
• Location to set your garden's location and for local weather.

8. Processors and third-party providers

We use the following services for operation and synchronization:

• Supabase (Supabase Inc.) for sign-in and synchronization of garden content. The database is operated in an EU region. supabase.com/privacy
• Cloudflare R2 (Cloudflare, Inc.) for storing uploaded photos in storage with an EU legal jurisdiction. cloudflare.com/privacypolicy
• Open-Meteo for weather data. open-meteo.com/en/terms
• BigDataCloud for converting coordinates into place names. bigdatacloud.com/privacy-and-cookie-policy
• RevenueCat (RevenueCat, Inc., USA) for managing and verifying Premium subscriptions (purchase status and a pseudonymous user identifier, no payment data, see section 9). revenuecat.com/privacy

We have data processing agreements pursuant to Art. 28 GDPR with our processors. Some providers are based outside the EU or process data outside the EU. Such transfers, where no adequacy decision exists, are based on the EU Standard Contractual Clauses or other appropriate safeguards under Art. 44 et seq. GDPR. Only the coordinates required for the function are transmitted to the weather and geocoding services, not your account data.

9. Premium subscription and payments

You purchase a Premium subscription directly through the Apple App Store or Google Play. Payment is handled entirely by the respective store as an independent controller; we do not receive any payment data (no credit card or bank details). We use RevenueCat to attribute and verify the subscription (see section 8). This involves processing a pseudonymous user identifier, basic device details, and the purchase status (e.g. active, renewed, or expired). The Premium status is linked to your account. The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR).

10. No tracking

Verdicord uses no analytics tools, no advertising tracking, and creates no usage profiles. No data is shared with advertising networks.

11. Retention period

Local data stays on your device until you delete it or remove the app. Data and photos synchronized to the cloud are stored for as long as your account exists. If you delete an entry or a photo, we also remove the corresponding copy on the server.

12. Deleting your account and data

You can remove local data yourself at any time by resetting or uninstalling the app. You delete your account, along with all synchronized content and photos, directly in the app: go to the Profile tab, scroll to the bottom and tap "Delete account", then confirm. The deletion is carried out immediately and permanently. Alternatively, you can request deletion informally by email at info@verdicord.com. A step-by-step guide is available at verdicord.com/en/konto-loeschen.

13. Minors

The app is not specifically targeted at children. If you are under 16, please only use an account with the consent of your parent or legal guardian.

14. Your rights

Under the GDPR, you have the right at any time to:

• Access your stored data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) and restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent given, with effect for the future (Art. 7(3))

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). An informal message to the address given in section 1 is sufficient to exercise your rights.

15. Changes to this policy

We update this privacy policy as the app or legal requirements change. The version published here, with the date noted above, applies.