This policy describes how Ezina LLC, doing business as Ezina ("Ezina," "we," or "us"), collects, uses, and shares information when you use the Ezina app and related services.
What we collect
When you use Ezina, we collect:
- Account information. Your email address, used to sign in and to contact you about the service. We don't require a password if you use magic-link sign-in. We don't ask for your name, phone number, or social-account credentials.
- Plant information. The plants, seeds, and observations you add to your garden, along with any notes, nicknames, or photos you attach.
- Photos you submit. Photos you take or upload for plant identification, disease checks, or social posts. Identification and health-check photos are also used to improve our plant recognition accuracy unless you opt out (see "How we use what we collect" below).
- Location. If you grant location access, we use it to generate weather-adjusted watering schedules. You can decline location access and enter a hardiness zone or ZIP code manually instead. We do not track your real-time location.
- Device information. Standard technical data (device type, operating system, app version, language preference) needed to deliver the service and diagnose issues.
- Subscription status. Whether you have an active subscription, trial dates, and credit balance.
We do not collect contacts, calendar data, microphone access, or web browsing history.
How we use what we collect
- To deliver the service: identify plants, generate watering schedules, fire reminders, save your garden across devices.
- To communicate with you about your account or important service changes.
- To improve the product. We record which screens you open and which features you use, tied to your account ID, so we can tell whether something works before we build more of it. The same account ID is attached to crash reports so we can fix the bug for the person it happened to. We do not sell this, and it does not leave the service providers listed below.
- To keep the community safe. Photos posted to the community are checked by an automated moderation service before they publish, and unsafe content is withheld. When you report a post, comment, or profile, we review the reported content along with the account that posted it.
- To improve plant identification accuracy. We use photos you submit to identification and health checks, plus any corrections you give us when we get an identification wrong, to train and improve the models behind plant recognition. Photos are de-identified before they enter the training process: account ID, email, and precise location are stripped, and the photos are never published or shared with third parties. You can opt out at any time in Settings → Privacy. If you opt out, future identifications are not used for training, and we remove any of your photos already in the training set within 30 days. For users in the EU and UK, we ask for explicit consent before using identification photos this way; declining does not affect your ability to use the app.
- To meet legal obligations and respond to lawful requests.
We do not use your information for advertising, retargeting, or behavioral profiling. We run product analytics, described above, and none of it is shared with advertising networks or used to track you across other apps and websites.
Who we share information with
We share information only with services that help us run Ezina, and only the information they need to do their job.
- Plant.id receives photos you submit for plant identification and health assessment. It returns species matches, similar reference images, and disease findings. Plant.id receives image bytes and an optional location hint. It does not receive your name, email, account ID, or any other identifying field.
- PlantNet receives photos you submit for identification. It returns species matches drawn from citizen-science contributions. PlantNet receives the same scope as Plant.id: image bytes and optional location hint.
- Sightengine (operated by Kozelo SAS, a French company) receives photos you post to the community, through a short-lived private link, so it can check them for unsafe content before they become visible. It returns category scores describing what an image may contain. It does not receive your name or email address, and it does not use your photos to train its models. Sightengine is bound by a data processing agreement under EU law and acts only on our instructions.
- Supabase hosts our database, authentication, and storage infrastructure on our behalf. It holds your account, plant records, social posts, and uploaded photos. Supabase is bound by a data processing agreement and acts only on our instructions.
- Open-Meteo receives an approximate location when we build your watering forecast. We round the coordinates to a coarse grid before sending them, so what Open-Meteo gets is a weather cell, not your address. It receives no account identifier.
- PostHog receives product analytics: which screens you open, which features you use, and your Ezina account ID, so we can tell whether a feature works before we build more of it. We self-report no advertising identifiers to it and it is not connected to any ad network.
- Sentry receives crash reports and error diagnostics, including device model, operating system, app version, and your Ezina account ID, so we can find the person a bug actually happened to and fix it.
- RevenueCat manages subscriptions on our behalf. It receives your Ezina account ID and your subscription state so entitlements follow you across devices. It does not receive your payment method.
- Apple and Google receive subscription transaction information through their respective in-app purchase systems. We do not see your payment method or billing address through this channel.
- Google Firebase Cloud Messaging receives a device push token so care reminders can reach your phone. The notification content passes through it on the way to you.
- Cloudflare serves our website and sits in front of our API. It processes request metadata, including IP address, to deliver pages and to block abuse.
- Wikimedia Commons is not a recipient of your data. We retrieve plant reference photos from Wikimedia on our side and display them alongside identification results. The flow is one-way: we read from Wikimedia, we send nothing to it.
Every company on this list is a service provider acting on our instructions under a data processing agreement, not an independent user of your data.
We do not share data with advertisers, data brokers, analytics resellers, or any company whose business is targeting users.
We may disclose information when required by law (subpoena, court order, regulatory request) or to protect rights, safety, or property. When practical and lawful, we will notify you before disclosure.
Data retention
- Account data: retained while your account is active and for 30 days after deletion, to allow recovery in case of accidental deletion. This covers your profile, posts, comments, and garden plans.
- Plant care data: your plant records, care history, and observations are retained while your account is active and for 30 days after deletion, then deleted. When you delete your account you can choose to leave this data behind in de-identified form, to improve our care and identification data. That choice is off unless you turn it on. De-identified records are stripped of anything connecting them to you, including your account, email, device, photos, and precise location, which is replaced with a general region. We do not attempt to re-identify them.
- Photos: retained while you keep them in your garden. Deleted photos are removed from our active systems within 30 days, and from backups within 90 days. Photos you contributed to identification-accuracy training are handled under the opt-out described below.
- Photos you allow us to use in marketing: when you delete your account you can choose to let us keep using photos you have already uploaded in our own marketing and communications. That choice is off unless you turn it on, and deletion goes ahead either way. If you turn it on, we keep those photos for up to 3 years from the date you delete, then remove them. We do not sell them, license them to anyone else, or use them to identify you, and we never attach your name, handle, or email. To withdraw this before the 3 years are up, email [email protected] and we will remove the photos from our materials going forward.
- Subscription records: retained for 4 years after account deletion, as required by tax and accounting regulations.
- Aggregated, non-identifying analytics: retained indefinitely.
Your rights
You can:
- Access your data through the app (your garden, observations, settings).
- Export your data in machine-readable format from Settings.
- Delete your account at any time. Your profile, posts, comments, garden plans, photos, and plant care data are removed, and deletion is permanent after a 30-day recovery window. Subscription and payment records are kept for 4 years, as tax and accounting regulations require. During deletion you can choose to leave your plant care data behind in de-identified form; if you do not turn that on, it is deleted with everything else. Deleting your account also gives up any early-access pricing attached to it.
- Correct any inaccurate information through Settings or by emailing [email protected].
- Opt out of identification-accuracy training in Settings → Privacy. The opt-out takes effect immediately for future submissions; photos already in the training set are removed within 30 days.
- Withdraw the marketing-photo permission you granted at deletion by emailing [email protected]. We stop using the photos going forward and remove them from materials we control.
If you're in the EU, UK, or California, you have additional rights under GDPR, UK GDPR, and CCPA respectively, including the right to object to processing and the right to lodge a complaint with your local data protection authority.
To exercise any right, email [email protected]. We respond within 30 days.
Children's privacy
Ezina is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided information to us, contact [email protected] and we will remove it.
For users aged 13 to 17, we recommend parental consent.
International users
Ezina is operated from the United States. If you use Ezina from outside the US, your information is transferred to and processed in the US. By using Ezina, you consent to this transfer.
For EU users, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers where required.
Security
We use industry-standard measures to protect your information, including encrypted connections (TLS), encrypted storage, and access controls. No system is perfectly secure, but we take responsibility for protecting what you trust us with.
If we ever experience a data breach affecting your information, we will notify you as required by law and within a reasonable time of discovery.
Changes to this policy
We may update this policy as Ezina evolves. When we do, we'll update the effective date at the top. For material changes, we will notify you through the app or by email before the change takes effect.
Contact
For privacy questions or to exercise any right above:
Ezina
13 Flag Road
Little Rock, AR 72205-5051
[email protected]