Privacy Policy

1. Who we are

This Privacy Policy explains how Knoodlepot Studio (sole trader) collects, uses, and protects your personal data when you use Floriography.

Data controller: Knoodlepot Studio (sole trader)
Email: knoodlepot@knoodlepotstudio.com
ICO registration: ZC143302 — verify here

2. Your rights under UK GDPR

You have the following rights regarding your personal data. Email us at knoodlepot@knoodlepotstudio.com to exercise any of them. We will respond within one calendar month.

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to stop processing your data in certain circumstances.
• Portability — ask for your data in a portable format.
• Objection — object to processing based on legitimate interests.
• Complaint to the ICO — if you are not satisfied with our response: ico.org.uk/make-a-complaint or 0303 123 1113.

3. The plain-English summary

To use Floriography you create an account, which stores your email with Firebase. Flower photos you take are uploaded to Firebase Storage, and your Garden Journal entries are saved to Firebase Firestore. When you identify a flower, your photo is sent to our server-side function (a Firebase Cloud Function), which calls the Anthropic Claude AI to generate the identification and story — your personal details are never sent to Anthropic, only the image. Subscriptions are managed by RevenueCat.

4. What information we collect directly

We collect:

• Email address — used to create and manage your account via Firebase Authentication.
• Flower photographs — photos you take or select are uploaded to Firebase Storage for identification and for display in your Garden Journal.
• Journal entries — the flower name, Latin name, AI-generated story, and any notes you add are saved in Firebase Firestore under your account.
• Approximate location (optional) — if you grant location permission, GPS coordinates are converted to a human-readable place name by OpenStreetMap Nominatim (see section 9) and saved with that journal entry. Raw GPS coordinates are not stored.
• Support correspondence — if you email us, we keep the message so we can respond and follow up.

We do not collect your real name, phone number, postal address, or contacts.

5. Hosting — Vercel

This privacy policy page is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you visit it, Vercel records your IP address, browser type, page requested, and a timestamp in standard server logs (retained approximately 30 days). Legal basis: legitimate interests (Article 6(1)(f) UK GDPR). Vercel Privacy Policy

6. Account and data storage — Firebase (Google)

We use Firebase, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), as our data processor for:

• Firebase Authentication — manages sign-in. Firebase receives your email address, a hashed password (we never see the plain-text version), and your IP address and sign-in timestamp for security purposes.
• Firebase Firestore — stores your Garden Journal entries (flower identifications, stories, notes). Encrypted in transit and at rest.
• Firebase Storage — stores the flower photographs you upload. Photos are encrypted in transit and at rest and are only accessible to your account.

Legal basis: performance of a contract (Article 6(1)(b) UK GDPR). We have selected EU regions where available. International transfers are covered by Standard Contractual Clauses and the UK International Data Transfer Addendum. Firebase Privacy & Security

7. Server-side functions — Firebase Cloud Functions

We use Firebase Cloud Functions, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for two server-side operations:

• Flower identification — when you request an identification, the app sends your photograph to our Cloud Function, which forwards it to Anthropic Claude (see section 8) and returns the result to your device. The image is not stored beyond the duration of the function call.
• Account deletion — when you request account deletion, our Cloud Function removes your data from Firebase. Your IP address and account ID are received by the function for this purpose only.

Legal basis: performance of a contract (Article 6(1)(b)). Firebase Privacy & Security

8. AI features — Anthropic (Claude)

When you identify a flower, your photograph is forwarded from our Firebase Cloud Function to Anthropic, PBC (548 Market Street, PMB 90375, San Francisco, CA 94104, USA) for processing by the Claude AI model. Anthropic acts as our data processor.

Anthropic receives the image and model parameters only. Your IP address, email, account identifier, and all other personal information are not sent to Anthropic. The API call originates from our server, not from your device.

Under Anthropic's Commercial Terms, API inputs and outputs are retained for a maximum of 7 days for trust and safety purposes, then automatically deleted. Anthropic does not use API content to train their models.

Legal basis: performance of a contract (Article 6(1)(b)). Anthropic Privacy Policy

9. Location features — OpenStreetMap Nominatim

If you grant location permission, your device's GPS coordinates are sent to the OpenStreetMap Nominatim reverse-geocoding service (OpenStreetMap Foundation) to convert them to a human-readable place name (for example, "Epping Forest, Essex"). That place name is then saved with your journal entry. Raw GPS coordinates are not stored by us or by Nominatim beyond the moment of conversion. Legal basis: legitimate interests (Article 6(1)(f)). OSM Foundation Privacy Policy

10. Subscriptions and payments — RevenueCat

We use RevenueCat, Inc. (1032 E Brandon Blvd #3003, Brandon, FL 33511, USA) to manage subscriptions and verify purchases. RevenueCat receives an anonymous App User ID (not linked to your email or name), your subscription and purchase history, your locale and currency code, and standard HTTP metadata. Legal basis: performance of a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) for fraud prevention. RevenueCat Privacy Policy

11. Distribution — Google Play

This app is distributed through Google Play (Google LLC). When you download, install, or purchase the app, Google processes information about that transaction under its own privacy policy. Google Privacy Policy

12. Data we never collect or use

We do not sell, rent, or trade your personal data. We do not use your data for behavioural advertising. We do not use any advertising SDKs. We do not track you across other apps or websites.

13. International transfers

Several services above process data in the United States or Singapore. For each transfer we rely on Standard Contractual Clauses and/or the UK-US Data Privacy Framework where applicable. You can request details by emailing knoodlepot@knoodlepotstudio.com.

14. How long we keep your data

• Account data and journal entries — until you delete your account; backups purged within 30 days.
• Flower photographs — until you delete them or your account.
• Purchase records (RevenueCat) — lifetime of account plus 6 years for legal and tax purposes.
• AI processing (Anthropic) — up to 7 days.
• Server logs (Vercel, Firebase Cloud Functions) — approximately 30 days.
• Support correspondence — 2 years from last contact.

To delete your account and all associated data, use the delete-account option in the app's settings, or email knoodlepot@knoodlepotstudio.com. We will action it within 30 days.

15. Security

We use industry-standard measures including encryption in transit (TLS) and at rest, access controls, and regular review of our processors' security certifications. In the unlikely event of a personal data breach affecting your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

16. Children

This app is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, please email knoodlepot@knoodlepotstudio.com and we will delete it.

17. Changes to this policy

We may update this policy from time to time. If a change materially expands what data leaves your device or who it is shared with, we will notify you in the app before it takes effect. The "Last updated" date at the top shows when it last changed.

18. Contact and complaints

For any privacy question or request:

Knoodlepot Studio
knoodlepot@knoodlepotstudio.com

If you are not satisfied with our response, you may complain to the ICO:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk/make-a-complaint · 0303 123 1113

ICO registration: ZC143302