Privacy Policy
The short version: the app works fully on your device, signed out, and in that mode we hold nothing about you. If you create an account, we store your email address and a copy of your journal, collection and specimen photos on EU servers so they can follow you across devices — photos go to private storage only your signed-in app can read, never a public link. Your PIN never leaves your device. Payment cards are handled entirely by Stripe. No ads, no trackers, no third-party analytics; the app sends us anonymous usage counts (which features get used, how often — no identity attached), and you can switch that off in Profile > Privacy.
1. Who is responsible
The Herbarium is operated by a sole trader based in Malta, who is the data controller for the processing described here. Contact: theherbarium.beta@gmail.com.
2. Data that stays on your device
- Everything, if you don't sign in. Signed out, your journal, vault, stash, preferences, photos, and settings live only in your device's browser storage. Nothing is transmitted to us.
- Photos, signed out, are stored in your device's local database (IndexedDB) and are not uploaded. If you sign in, they sync under your account — see section 3.
- Your app PIN (if you set one) is stored only on your device as a hash and never leaves it.
- Age and terms confirmation dates are recorded on your device and are not uploaded.
- Usage counts. The app tallies which features you use and how often, on the device. Once a day it reports the day's tallies to our own server (see section 5): event names and counts, the app version, and nothing else — no account or device identifier, no names of strains, no journal content, whether or not you are signed in. The report cannot be linked to you or across days. You can turn the reporting off in Profile > Privacy; the tallies then stay on the device only.
- Backups you export, plain or encrypted, are files saved to your device. The encrypted backup is locked with a passphrase you choose; we never see the passphrase and cannot recover it or open the file. If the passphrase is lost, the backup is unreadable by design.
3. Data we store if you create an account
Accounts are optional. If you create one, we store:
- Your email address, used to send sign-in links (there are no passwords) and for account and service messages such as replies to your support requests. Not for marketing.
- A copy of your collection, so it can sync across your devices: journal entries (including any text you write in them), your collected strains and the dates you collected them, stash jars, leaf marks, badges, completed sets, milestones, small display preferences, and the date of your last backup export.
- Your specimen photos, stored in a private bucket under your account. They are fenced to you by row-level security, are only ever fetched through the signed-in app, and are never given a public or shareable link. Deleting a photo in the app deletes the server copy; deleting your account deletes them all.
- Not synced, ever: your PIN, your invite code, and your age and terms confirmation dates. Your plan (free or Premium) is recorded on the server from billing events, never sent up from the app.
A sign-in token is kept in your browser's local storage so you stay signed in on that device. Sign-in links are single-use and the app removes the token from the address bar as soon as it arrives, so it is not left in your browsing history.
4. Payments
- Subscriptions are processed by Stripe through Stripe Checkout and the Stripe billing portal. Your card number and payment credentials go directly to Stripe; they never pass through the app or our database, and we cannot see them.
- What we store about billing: your Stripe customer reference, subscription reference, subscription status, plan, and the date your current billing period ends. This is what lets the app know your subscription is active.
- Stripe acts as its own controller for payment processing, including VAT calculation and fraud prevention, under the Stripe privacy policy.
5. Where data lives, and who processes it
- Supabase hosts account data (email, synced collection, billing status) on servers in the EU (region eu-west-1). Supabase is our processor for hosting and authentication, including delivery of sign-in emails.
- Stripe processes payments as described in section 4.
- Hosting logs. The servers that deliver the app process standard technical request data (such as IP address and browser type) in short-lived logs to serve the site and protect it from abuse. We do not use this data to identify you.
- Usage counts are received by our own endpoint on Cloudflare (theherbarium.eu) and stored as anonymous daily totals with no identifier and no IP address attached, self-purging after 100 days. They are aggregate numbers about the app, not records about you: they are never sold, never shared, and cannot be traced back to a person or device.
- The app loads no third-party fonts, scripts, ad networks, or tracking pixels. All assets are served with the app itself.
6. Legal bases
- Contract (GDPR art. 6(1)(b)): running your account, syncing your collection, and managing your subscription.
- Legal obligation (art. 6(1)(c)): keeping billing records where tax and accounting law requires it.
- Legitimate interest (art. 6(1)(f)): short-lived technical logs to keep the service secure and working.
7. Retention and deletion
- Account data is kept while your account exists.
- To delete your account, email theherbarium.beta@gmail.com from the address on the account. We will delete the server copy of your data and your authentication record. Billing records that tax law requires us to keep are retained for the legally required period only.
- Deleting the account removes the server copy, not the copy on your devices; you remove that on the device itself (or keep it and continue signed out). Likewise, clearing a device does not delete the server copy.
- Data you have emailed us (support, feedback) is deleted on request.
8. Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, portability, and objection. Much of this you can do directly in the app: export your data any time from Profile (this covers portability), correct it by editing, and erase local data by deleting entries or clearing the app's storage. For the server copy, email us and we will act on it. You also have the right to lodge a complaint with a supervisory authority, either the Information and Data Protection Commissioner in Malta or the data protection authority where you live.
9. What we don't do
- No third-party analytics or tracking scripts, no tracking cookies, no fingerprinting, no third-party fonts. The only usage measurement is the anonymous, identity-free counting described in sections 2 and 5 — switchable off in the app.
- No advertising networks.
- No selling, renting, or sharing of personal data with third parties beyond the processors named above.
- No automated decision-making or profiling with legal effect.
10. Children
The Herbarium is strictly for adults 18 and over. The app requires age confirmation before entry, and we do not knowingly allow use by minors. If you believe a minor has created an account, contact us and we will delete it.
11. Changes
If what we process or why changes, this policy will be updated first and the change flagged in the app before it takes effect.
12. Contact
Data controller and contact for all privacy matters: theherbarium.beta@gmail.com.