Privacy policy (draft)

Last updated: 30 October 2026 (draft). Effective from: the date is added on publication.

1. Who processes your data

The controller is OÜ Kullaveeline (registry code 16266154), the developer and provider of the HERNES app and the website hernes.app. For data protection questions, email privacy@hernes.app.

2. What this policy covers

This policy applies to the HERNES mobile app (iOS and Android), its web version and the website hernes.app, including the beta sign-up form.

3. What data we collect and why

Data	Purpose	Legal basis
Account: email address and password. The sign-in service stores the password in hashed form; we never see your password.	Creating your account and signing in	Contract (GDPR Art. 6(1)(b))
Profile: username (required); bio, phone number and profile photo (optional); app settings (e.g. language, theme, default task priority); plan level.	Showing your profile and setting up the app	Contract
Notifications (if you allow them on your phone): your phone's push token, the phone platform (iOS or Android) and when it was last used; your notification settings (which notifications are on and at what time); a note of the day a notification was sent, so the same one isn't repeated.	Sending weather alerts, today's task summary, shared garden events and plan messages to your phone	Contract
Garden data: garden name, description, size and type; areas; plants, poultry, beehives, compost worms and animals; tasks, logs, notes and wishlist.	Core features of the app	Contract
Garden location (optional): coordinates to about 2 km, from your phone's location or a place search; the place name (e.g. village or town), country and time zone; for gardens in Estonia also the county. The exact location is never stored.	Weather forecast and weather alerts for the garden; for gardens in Estonia also the Estonian Environment Agency's official warnings	Contract
Garden contact details: name, email and phone, if you add them to a garden.	Showing a contact to the garden's members. If you make the garden public, you decide whether the contact is also shown in the public view (see section 7)	Contract
Photos and captions uploaded to the cloud: your profile photo, garden cover photo and garden gallery always; photos of plants, animals and areas when photo backup is on. Also the photos' technical data (dimensions, file size).	Showing photos on other devices, the gallery and following how the garden changes	Contract
Plan and subscription: plan level, subscription status and expiry, trials used and the store's purchase identifier. We never see or store payment details (such as card numbers): payment happens in the App Store or Google Play.	Unlocking a paid plan, managing trials and the end of a subscription	Contract
Scanned barcode (EAN), sent to our server to look it up in the seed catalogue.	Finding seed packet details	Contract
Seed packet photos (front, and the back if you take it), sent through our server to an AI service to read the packet text; and a monthly count of readings on your profile. The photos are not stored on our server. The back photo is not stored anywhere. The front photo becomes the plant's picture and is saved like other plant photos (on your phone, or in the cloud when photo backup is on); you can remove it before saving.	Filling in the plant's details from the packet; the monthly reading limit of your plan	Contract
Technical data: IP address, request time and address in server logs.	Security, troubleshooting, preventing abuse (e.g. limiting sign-up attempts) and cookie-free aggregate statistics of website visits	Legitimate interest (GDPR Art. 6(1)(f))
Account deletion record: email address, user ID, IP address, time and number of deleted items.	Proving the deletion and preventing abuse	Legitimate interest
Beta list (website form): email address, phone platform, language, time of consent and consent text version.	Sending the beta testing invitation	Consent (GDPR Art. 6(1)(a))
Correspondence, if you email us.	Answering your question	Legitimate interest or contract

Camera, location and notifications on your phone

The camera is only used when you scan a barcode, photograph a seed packet or take a photo. The camera image is not stored or sent anywhere, except photos you choose to add and seed packet photos you send for reading.
We send notifications only if you have allowed them on your phone. The app asks only when a notification is useful (e.g. when you add a location to a garden), and you can switch each kind (weather alerts, today's tasks, shared garden, plan) off separately in Settings. Urgent weather alerts (a storm, frost or heavy rain within hours) may also come at night.
The app reads your location only when you tap “Use my current location” while adding or editing a garden, and only once. The app rounds the location to about 2 km on your phone already and does not track your location. Instead you can search for the place by name: the search words and the places found are processed by your phone's map service (Apple on iPhone, Google on Android) under its own terms.

What the app keeps on your phone

The app stores your sign-in session, settings, chosen language and a cache of your gardens on your phone, so the app works quickly and you do not have to sign in every time. Photos of plants, animals and areas stay only on your phone by default. If you turn on photo backup in Settings, they are uploaded to the cloud (up to 25 photos on the Explorer plan; on paid plans backup is on by default).

4. What we do not do

We do not sell or rent out your data.
We do not show ads or use advertising networks.
We do not use analytics or tracking tools in the app. [TODO: if a crash reporting service (e.g. Sentry) is added to the app, describe here that a crash sends a technical error report without your garden content, and add the type of service to section 5.]
The website hernes.app uses no cookies and no tracking. Only the password reset page uses the sign-in service, which stores a technical date (no personal data) in your browser’s IndexedDB.
We do not make automated decisions or profile you.

5. Who we share data with

We use processors who handle data on our instructions and under a contract:

Sign-in and database service: user accounts, sign-in and the database. Database location: Finland. The sign-in service is global (see section 6).
Cloud storage: storing photos uploaded to the cloud, and the seed catalogue. Data location: Ireland.
Server hosting: the server that runs the HERNES API and website. Data location: Finland.
[TODO: once payments are set up] Purchase checking service: checking store purchases and subscriptions. Receives your HERNES user ID and the store purchase data, not your name or email. [TODO: data location.]
Notification delivery service (USA): delivering notifications to your phone. Receives your phone's push token and the notification text. The text may contain a garden name, a task title and a garden member's username (e.g. “New task: Water the tomatoes / Assigned by Mari”), but not your email or the garden's location.
AI service (USA): reading seed packet photos. Receives only the packet photos and the app language, not your name, email or user ID. The provider does not use the photos to train its models.

You can ask for the list of our service providers at privacy@hernes.app.

Notification delivery. The notification delivery service passes the notification on to your phone maker's push service (Apple's on iPhone, Google's on Android). They deliver it to your phone under their own terms.

Weather data. To get the forecast, we send the weather provider the approximate location of your garden (coordinates accurate to about 2 km), but not your name, email or any other data. The current provider is MET Norway (Norwegian Meteorological Institute) (met.no). Official warnings for gardens in Estonia come from the Estonian Environment Agency; we don't send them your location. The weather provider may change in the future; we will then update this policy.

Apple and Google. You buy a subscription in the App Store (Apple Distribution International Ltd.) or Google Play (Google Commerce Ltd.). They process payment and billing data under their own privacy terms as independent controllers; they only tell us about the purchase and the subscription status.

We may also disclose data where the law requires it (e.g. a request from a competent authority).

6. Transfers outside the European Economic Area

The database, photos, seed catalogue and server are located in the European Economic Area (Finland and Ireland). The sign-in service is global and may process account data (email address, sign-in data) outside the EEA, mainly in the USA. Notifications pass through a US notification delivery service and Apple's or Google's push service. Seed packet photos you send for reading are processed by an AI service in the USA. The database and cloud storage providers belong to US groups, so data may also be accessed from outside the EEA when the services are maintained. In those cases, transfers rely on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

7. Shared and public gardens, and photos

Every garden is private by default: only you and the people you share it with can see its data. Only you can make a garden public. This is meant mainly for community and demonstration gardens, and may be available only on some plans. The public garden view is in development; until it is ready, a garden's data is visible only to its members.

Shared gardens. With the Gardener and Farmer plans, the owner of a garden can invite editors with an invite link. Anyone who has the link can join until the plan's places are full (Gardener 2, Farmer 10 editors), so do not share the link publicly. “New link” stops the old link from working. The members of a garden (the owner and editors) see all of its data and photos, including who added what, and each other's usernames. The owner decides who is in the garden and can remove members; an editor can leave at any time. Entries and photos a member added stay in the garden when they leave or delete their account; “Former member” is then shown instead of their name. If the owner's plan no longer includes sharing, members stay in the garden but can only view it; nothing is deleted.

If you make a garden public, other HERNES users may see:

the garden's name, description, type and size;
its areas and their types;
the names and varieties of its plants and animals;
only the photos you have marked as public yourself;
your username (not your email address);
the garden's place name (e.g. village or town);
the garden's contact details, only if you choose to show them.

The garden's location coordinates, tasks, logs, notes, wishlist, weather notifications and the data of its members never become public. Before publishing, the app shows you what others will see. You can make the garden private again at any time; it then disappears from the public view immediately.

Photos in the cloud. Photos uploaded to the cloud are stored in cloud storage in Ireland. Currently, uploaded photos can be viewed by anyone who knows the photo's exact web address. We do not publish photo addresses, but do not add photos you would never want to share. Together with public gardens, we will make photos private by default: only the garden's members can see them, and the public view shows only the photos you have marked as public.

8. How long we keep data

Account, profile and garden data: until you delete your account. See how to delete your account.
Weather notifications in the app: 48 hours.
Phone push token: until you sign out on that phone, remove the app (the notification delivery service tells us) or delete your account. An account has up to 10 phones; the one unused for longest is removed first. Delivery receipts are kept for up to 24 hours.
Notification settings and sent notes: until you delete your account.
Garden invite links: valid until the owner creates a new link, turns the link off or the garden is deleted; the link is then deleted within a day.
Account deletion record: 12 months after the deletion.
Server logs: 30 days.
Seed packet photos: not kept on our server; they are deleted once the packet has been read. The AI service deletes them within [TODO: confirm the period in Anthropic's data processing terms, by default 30 days]. The front photo saved as the plant's picture is kept like other plant photos. The monthly reading count is replaced at the start of each month.
Beta list: until the app is available in the stores or you withdraw consent. In our first email we ask you to confirm; if you do not reply within 30 days, we delete your address.
Correspondence: 2 years after the last message.
Plan and subscription: until you delete your account. Apple and Google keep store purchase data under their own terms.
Backups: [TODO: the database is backed up; add the retention period once Firestore backups are set up (launch plan, week 1). Deleted data disappears from backups within that period.]

If you delete your account, entries and photos you added to other people’s gardens stay in those gardens. If your garden has editors, you can choose to hand it over to one of them or delete it when you delete your account.

9. Your rights

You have the right to:

know what data we process about you and get a copy of it;
have incorrect data corrected (you can change most of it yourself in the app);
have your data deleted;
restrict processing or object to it where it is based on legitimate interest;
receive your data in a machine-readable format (data portability);
withdraw consent at any time (e.g. leave the beta list). This does not make earlier processing unlawful.

To use your rights, email privacy@hernes.app. We reply within one month. We may ask you to confirm that you own the account.

If you believe we are violating your rights, you can contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), the supervisory authority in your own country, or a court.

10. Children

HERNES is meant for users aged 13 and over. Younger children may use the app only through a parent's or guardian's account and under their supervision. If we learn that a child under 13 has created an account without a parent's consent, we delete the account. If you think this has happened, email privacy@hernes.app.

11. How we protect data

All data exchange between the app, server and website is encrypted (HTTPS).
Sign-in is handled by a separate sign-in service; passwords are not stored on our server.
Access to data is restricted and administrative actions are logged.
Sign-up attempts are limited to prevent automated attacks.

12. Changes

If the policy changes significantly, we will announce it in the app or on this page before the change takes effect. The current version is always on this page.

13. Contact

OÜ Kullaveeline, registry code 16266154. Email: privacy@hernes.app.