1. Data Controller
Responsible under GDPR:
Christoffer Montenero
privacy@permaplans.com
2. General Information
We process personal data only in accordance with applicable laws (GDPR, TMG, etc.).
Data is processed solely to provide functionality, ensure security, analyze usage, and improve the app.
3. Collected Data
a) User Account & Profile
When creating an account or using profile features, we may collect:
- First and last name (optional)
- Nickname
- Email address
- Avatar image (optional)
- Language
- Country of origin (optional)
- Bio, interests (optional)
- Referral code (optional)
Purpose: Identification, profile functionality, community features
b) Usage Data
We store the following usage data:
- Last login
- Usage time
- Number of games played
- In-app currency ("Pachams")
- Feature usage counters (e.g., plant search, PlantNet queries)
- Reported content
- App version, device model, language
- Onboarding completed (yes/no)
- Push notifications enabled (yes/no)
Purpose: Feature logic, monetization, abuse detection, app improvement
c) Location Data
If you consent, your location may be collected via GPS or network.
Purpose: Garden localization, regional offers, weather features (planned)
d) Gardens & Content
We store the following user-generated content:
- Gardens, plant lists, notes, photos
- Favorites, comments, reviews
- Marketplace entries (offers and requests)
- Feedback & abuse reports
- Game progress
Purpose: App functionality, community interaction, moderation, as well as the display and illustration of plants within the PermaPlans app and in printed Permaplay plant portraits.
Usage is strictly limited to the features, content, and products of PermaPlans and Permaplay. Content will not be shared with third parties or used for external advertising purposes.
d2) Admin Access for Support & Consulting
For technical troubleshooting and personal garden consulting (e.g., when you send a garden vision to our designer), the controller may obtain read access to the content of your garden (plants, layout, vision, notes, photos) – but not to your password, your private direct messages, or your payment data.
Access is strictly occasion-based and limited to what is necessary to fulfill the respective purpose. Content will not be shared with third parties.
Legal basis:
- Art. 6 (1) (b) GDPR – performance of a contract or pre-contractual measures (e.g., when consulting is actively requested)
- Art. 6 (1) (f) GDPR – legitimate interest in troubleshooting and the security of the app
Objection: You may object to this processing at any time by email to privacy@permaplans.com.
e) Plant Identification via PlantNet
Uploaded plant photos are sent to the PlantNet API (plantnet.org).
Their privacy policy also applies.
Purpose: Plant identification
4. Permissions & Device Access
Permissions are only used with your consent and for the purposes described:
| Permission | Purpose |
|---|---|
| Internet | API access, plant identification |
| Storage | Upload and display user photos |
| Camera | Capture photos directly |
| Microphone | (only if audio recording is used) |
| GPS/Location | Determine garden location |
| Push Notifications | Tips, task reminders |
| Alarm & Boot Events | Schedule reminders after reboot |
| Vibration | Haptic feedback |
5. Third-Party Services
Apple OAuth (optional)
When signing in via Apple, we receive your name, email, and profile image.
Purpose: User authentication.
Google OAuth (optional)
When signing in via Google, we receive your name, email, and profile image.
Purpose: User authentication.
Payment Providers (planned)
If using Google Pay or similar, processing is handled by the provider.
We do not store payment data.
6. Data Sharing
We do not sell data and pass nothing on for advertising. No tracking by ad networks, no resale, no profiling for third parties.
Running the app does, however, require third-party services. Data is transmitted to them:
| Service | Purpose | What arrives there |
|---|---|---|
| Supabase | account, garden data, files | everything you store in the app |
| Map and geodata services | maps, aerial imagery, cadastral maps | IP address and the map section you are currently viewing (see next section) |
| OneSignal | push notifications | device identifier |
| PlantNet, iNaturalist | plant identification from photos | the photo and, where present, where it was taken |
| OpenAI, Anthropic | AI features (plant search, questions, strategy plan) | your text or image and the garden details needed for it |
| Stripe | payments in the web shop | payment and invoicing data |
| Brevo, Resend | system emails | email address |
| Apple, Google | app delivery, in-app purchases | whatever the respective store collects |
Each of these services receives only what its task requires.
7. Data Retention
Your data is stored as long as your account is active.
Upon deletion, all personal data is permanently erased, unless required by law.
8. Your Rights
You may request at any time:
- Access to your data
- Correction of incorrect data
- Deletion ("Right to be Forgotten")
- Restriction of processing
- Objection to specific data usage
- Data portability
Contact: privacy@permaplans.com
9. Changes
This privacy policy may be updated due to functional or legal reasons.
You will be informed of major changes.
Map services and geodata
We do not serve maps, aerial imagery and cadastral maps ourselves — your device loads them directly from each provider. In doing so it transmits your IP address and the requested map section to their servers. Because that section is your garden's location, this is information about you, even though no account and no name is sent along.
The providers involved:
- OpenStreetMap Foundation (standard map, address search via Nominatim, Overpass)
- Mapbox, Esri, Thunderforest, OpenTopoMap (satellite imagery, terrain, outdoor map)
- National and state surveying authorities in Germany, Austria, Switzerland, France, the Netherlands, Luxembourg and Poland (aerial imagery, cadastral maps, parcel data)
The full list with source attributions is in the app under "Licences".
Legal basis: Art. 6(1)(b) GDPR — without these requests there would be no map. If you wish to avoid them, do not use the map views; all other features remain available.
The permaplans.com website
This section applies to the permaplans.com website and all its pages (plant encyclopedia, plant finder, free map, harvest calendar, support and the remaining pages).
No cookies, no ad networks. The pages set no cookies and store nothing on your device — no cookies, no local storage, nothing comparable. No advertising networks and no social media components are embedded. That is why you will not find a consent prompt ("cookie banner") on permaplans.com: consent would be required under § 25 TDDDG if we placed anything on your device or read anything from it. That is exactly what we do not do.
Visit counting without recognition. So that we know which pages are being read, we count page views ourselves — with our own code on our own database server, without Google Analytics and without any other analytics service. We record: the page opened, the time, your browser language, a coarse device class (mobile, tablet, desktop), the host of the page you came from (so "www.google.com", not your search query), and whether you clicked a link to the app.
To join two views of the same visit without recognising you, we derive an identifier from your IP address and your browser identification: both go, together with a randomly generated value that changes daily, into a one-way calculation. Your IP address is not stored — it is only used in that calculation and discarded immediately. The random value is deleted after two days; after that the identifier cannot be reproduced even with knowledge of your IP address. In practice: the next day you are a new, unknown visitor to us. No cross-site profile is created, and the data is not combined with your account.
If your browser sends "Do Not Track" or "Global Privacy Control", we do not count at all. The figures are deleted after 400 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in learning which content is needed). You may object to the counting at any time — an email to support@permaplans.com is enough.
Opening a page contacts no outside advertising or analytics network. We serve fonts, program libraries and the app-store badges from our own server instead of fetching them from Google, Apple or a content delivery network. Your IP address therefore reaches only our hosting provider, which delivers the page, and our database provider Supabase, which serves content and handles the visit counting — both acting as processors for us, both named in the "service providers" section below. It does not go to Google, Meta or any advertising provider.
Server log files. On every request our hosting provider records in log files: IP address, date and time, the requested address, the status code, the amount of data transferred, the referring page and the browser identification. This is technically necessary to deliver the page and serves security and troubleshooting. It is not combined with other data and not used to analyse browsing behaviour. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Your browser's local storage. Individual pages remember settings in your browser's local storage: the chosen language, how the pricing overview is displayed and — on the free map — your own drawings. These stay on your device, are never transmitted to us and can be deleted at any time in your browser settings. They are required for the respective function, so no consent is needed.
Maps on the website. The free map and the plant finder show map tiles that your browser requests directly from the providers named under "Map services and geodata". That section also describes what is transmitted. All other pages load no maps.
Content from our database. Plant images, garden data and release notes are fetched from our database provider Supabase, which acts as a processor on our behalf.