Privacy Policy

Only the German version of this policy is legally binding. This translation is provided for convenience.

1. Controller

The controller for the processing of your data within the meaning of Art. 4(7) GDPR is:

Alexej Kossmann
Keplerstraße 25
01237, Dresden
Germany

Email: support@growos.eu

2. Overview

GrowOS is an app for looking after houseplants. To use it you create an account; your plants, readings and photos are stored on a server operated by IONOS SE in Germany.

We use no analytics, tracking or crash-reporting services. There is no advertising and no profiling. The same goes for our emails: they contain no tracking pixel that would report an open.

3. What data we process

3.1 Account

3.2 Sign in with Google (optional)

If you sign in with Google, we receive your Google account ID (sub), your email address including its verification status, and your first and last name from Google. We store this to recognise your account. The legal basis is Art. 6(1)(b) GDPR (contract) — you choose this sign-in method yourself. The provider is:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Google may transfer data to its parent company Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). In addition, Google has entered into standard contractual clauses under Art. 46(2)(c) GDPR. What Google processes under its own responsibility is set out in Google’s privacy policy: https://policies.google.com/privacy.

3.3 Plant data

Plant name, species, self-chosen location name (free text such as “living room” — not a geographic location), watering interval, moisture range, watering events and sensor readings with timestamps.

3.4 Photos

Photos you add to a plant are stored in our object storage. The legal basis is Art. 6(1)(b) GDPR (contract) — the photo is part of the plant entry you create.

Metadata is stripped before upload. Camera photos carry technical extra information (EXIF data) — depending on your device settings, this includes the GPS coordinates of the place the photo was taken. The app removes this data on your device before the image is transmitted; the photo arrives on our server without EXIF data, and only that version is stored. So we learn neither where nor with which device a photo was taken.

One single value is read out beforehand: the capture date. It is attached to the plant entry as a plain date so that your photos appear in the right chronological order. Without this step every photo would be dated to the moment of upload.

3.5 Push notifications

If you enable reminders, we store your device’s push token and platform. The legal basis is your consent under Art. 6(1)(a) GDPR; you can turn reminders off again at any time in the app settings.

Delivery runs through Firebase Cloud Messaging operated by:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

The token and message content are transmitted to Google in the process. The same applies to the transfer to the United States as under 3.2: Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR), supplemented by standard contractual clauses under Art. 46(2)(c) GDPR. See Google’s privacy policy for details: https://policies.google.com/privacy.

3.6 Server logs

When our servers are accessed, the access logs record the IP address, the time and the resource requested. The IP address is truncated as it is written: the last block is replaced with a zero (for IPv6 we keep only the first two groups). The full address is never stored, so the log only shows the network an access came from. The legal basis is Art. 6(1)(f) GDPR (operating and securing the service). Retention: 7 days

3.7 Email

We only write to you when there is a reason to, and all three of our emails are ones you trigger yourself: the code to reset your password, the confirmation after a successful password change and — if your account uses Sign in with Google — the note that there is no password to reset. We send no newsletter and no advertising.

The data involved is your email address, your first name and the content of the message (for a reset, the six-digit code). Delivery goes through our own support@growos.eu mailbox at:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

IONOS operates the mailbox on our behalf (processing under Art. 28 GDPR); the servers are located in Germany. No transfer to a third country takes place.

We deliberately use no delivery service that would evaluate or alter the message.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract) — without this email there would be no way back into your own account — and, for the confirmation of a password change, additionally Art. 6(1)(f) GDPR (security of your account).

No open tracking. Our emails contain no tracking pixel — no invisible image that loads when you open the message and reports that you read it. We do not learn whether or when you open an email from us. No click tracking takes place either; our emails contain no links.

How long the resulting data is kept is set out under Retention.

4. Cookies

This website sets no cookies and stores nothing in your browser — no local storage, no session storage, no tracking pixels. There is therefore no cookie banner and nothing to consent to. The same applies to the emails we send — see 3.7.

The site also loads no content from third-party servers: fonts and images are served from our own server, and there are no maps, videos, social media buttons or analytics tools embedded. Opening this page opens no connection to any third party.

The app stores no cookies either. It only keeps your sign-in token in the operating system’s encrypted keystore so that you do not have to sign in again on every launch; it is deleted when you sign out.

5. Recipients

• Hosting: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur (Germany). The server is located in Germany; no transfer to a third country takes place. Processing is carried out under a data processing agreement pursuant to Art. 28 GDPR.
• Push delivery: Google Ireland Limited, Dublin (Ireland), see 3.5 — with onward transfer to Google LLC (USA) on the basis of the EU-US Data Privacy Framework
• Sign in with Google: Google Ireland Limited, Dublin (Ireland), see 3.2 — only if you use this sign-in method
• Email delivery: IONOS SE, Montabaur (Germany), see 3.7

We do not pass your data on beyond this.

6. Retention

We store account data and content for as long as your account exists. If you delete your account, the account, plants, readings, watering history, photos and push tokens are deleted. Server logs (3.6) are kept for 7 days and then deleted automatically. Backups are kept for no longer than 35 days and are then deleted automatically and permanently. A deletion in the live system takes effect immediately; in backups it takes effect only after that delay.

For email delivery (3.7) in detail:

• The reset code is never stored in plain text, only as an irreversible hash. It is valid for 15 minutes. The invalidated record — hash, timestamp and the link to your account — remains afterwards and is removed when your account is deleted.
• From the send job we delete the content immediately after delivery, so the code is only there for a matter of seconds. Recipient address, timestamp and delivery status are kept for traceability and are likewise removed when your account is deleted.
• Delivery logs at IONOS are subject to their retention period.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). To exercise them, contact support@growos.eu or write to the postal address given under 1.

You may also lodge a complaint with a data protection supervisory authority — the one where you live, or the authority at the controller’s place of business:

Die Sächsische Datenschutzbeauftragte
Devrientstraße 5
01067 Dresden
Germany

8. Deleting your account

How to delete your account and all associated data — in the app or without installing it — is described under Delete account.

↑ Back to top