This Privacy Policy explains what personal data the Phyllo mobile application and the phylloapp.com website collect, how it is used, and the choices you have. The service is operated by Yevhen Stryzh (individual, Ukraine) — "Phyllo", "we", "us".
Data controller: Yevhen Stryzh, an individual operating under the laws of Ukraine.
Contact: [email protected].
Account data. The identifier provided when you sign in with Apple or Google, or your e-mail address if you sign in with e-mail and password. We never receive your Apple or Google password.
Your plants. Everything you record about a plant: nickname, species, the photos you take, the room or location label, light level, watering schedule, and care events such as waterings, fertilising, repotting, pruning and notes.
Conversations with the assistant. Your messages to Phyllo's chat and its replies, stored against your account so the assistant remembers the history of that plant.
Voice dictation. Speech recognition runs on your device, performed by the operating system. We receive only the resulting text — never an audio recording.
Device data. A push notification token and the platform ("ios" or "android"), used to deliver watering reminders and weekly digests.
Usage and diagnostics. We use Google Firebase Analytics (feature-usage events, for example "plant added" or "photo uploaded") and Firebase Crashlytics (crash reports) to understand how the app is used and to fix defects. These tools collect device identifiers and technical data as described in Google's documentation.
Credits and transaction records. Your credit balance, the AI actions charged against it, purchases and subscription status.
Consent records. The version of the Terms and Privacy Policy you accepted, and when.
To provide the service: identify plants from your photos, assess their health, compare growth photos, answer your questions about a specific plant and write your weekly garden notes.
To operate the product: send watering reminders and weekly digests, keep your credit balance, provide support.
To keep the service safe: prevent abuse, enforce our Terms, protect against fraud.
To improve the product: aggregated analytics about how features are used.
To comply with legal obligations, including accounting and record-keeping.
Phyllo is an AI product. When you identify a plant, check its health, track growth or send a chat message, the photo and/or text is transmitted to a third-party large-language-model provider for the duration of processing. The providers configured by the operator currently include Anthropic, OpenAI, Google and DeepSeek, and the aggregators Kie.ai and laozhang.ai. They process the data on our instructions to produce your result.
Infrastructure processors we use: Supabase (database, file storage and authentication; EU region, Frankfurt), Vercel (backend hosting), Google Firebase (analytics and crash reporting), Expo (push notification delivery) and Apple (app distribution and in-app purchase processing).
We do not sell your personal data and we do not share it with advertisers.
Performance of a contract (providing the service you signed up for); legitimate interests (product analytics, abuse prevention, service communications); consent where required (you can withdraw it at any time); and compliance with legal obligations.
Where the UK GDPR applies, the same bases apply under that regime.
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
Your plants, photos, care history and conversations are kept while your account exists. You can delete an individual plant, and with it its photos and history, at any time in the app.
When you delete your account, your plants, watering history, registered devices and the photo files themselves are deleted. We retain transaction, billing and audit records (AI charges, purchases, consent records) for as long as the law requires, in a form that minimises personal data.
Backup copies are purged within 30 days.
Analytics and crash data are retained according to Google Firebase retention settings.
You may access, correct, export or delete your data, object to or restrict certain processing, and lodge a complaint with a supervisory authority.
In the app: Settings → Export my data produces a copy of your plants, waterings, registered devices and usage events; Settings → Delete account removes your data. See also our Data Deletion page.
Or e-mail us at [email protected] — we respond within 30 days.
If you live in California, the CCPA/CPRA gives you the right to know what personal information we collect and why, to receive a copy of it, to ask us to correct or delete it, and not to be discriminated against for exercising those rights.
The categories we collect are the ones listed above: identifiers (the account identifier or your e-mail address), your own content (plant photos, notes and chat messages), commercial information (purchases and credit balance), and internet or device activity (usage and crash diagnostics).
We do not sell or share your personal information as those words are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. We do not knowingly sell or share the data of anyone under 16.
Exercise any of these rights in the app (Settings → Export my data, Settings → Delete account) or by writing to [email protected]. You may use an authorised agent; we verify a request through the account it concerns.
The service is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.
Our processors may process data outside your country. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
Data is transmitted over encrypted connections and stored with access controls; each account can reach only its own rows and its own photo files. No system is perfectly secure, and we protect your data proportionately to the risk.
We may update this policy. Material changes are announced in the app, and you may be asked to review the updated documents. The current version and its effective date are always available at phylloapp.com/privacy.
Yevhen Stryzh — [email protected].