Privacy Policy

This policy explains what Ploomily collects, why, and the control you have over it. It covers ploomily.com, app.ploomily.com, the legacy offers at go.ploomily.com, and the separate campaign and checkout site at to.ploomily.com.

What we collect

• Account: your email address — used to sign in, to send care reminders and billing notices, and, unless you opt out, occasional product and offer emails. Every one of those carries an unsubscribe link.
• Your plants: nicknames, species, rooms, notes, schedules, care history, and any photos you upload.
• Location (optional): the city you choose — used to derive season and local climate for schedules. We do not request browser GPS.
• Time zone: read from your device’s own clock settings when you sign up, so reminders and schedules land on your local day rather than ours. It is a region name like Europe/Lisbon, not a position, and it needs no permission prompt because your browser already reports it to every site. The city you pick takes precedence over it.
• Usage events: in-house product analytics (e.g. plant added, reminder sent) to improve the Service — including, on the offer pages at go.ploomily.com, a cookieless record that the page was viewed, that the symptom checklist was run and which button was tapped, kept with any campaign or click identifiers the ad platform put in the link (utm_source, utm_medium, utm_campaign, utm_content, fbclid, gclid, ttclid, msclkid). Those records carry no account and no address; they are how we learn which ad reached people who were actually stuck. If you go on to create an account from that link, the click identifier and campaign tags travel with it and are kept on your account, once, and nothing else from the ad is. For this legacy account-attribution integration, when ad-network reporting is switched on, a purchase made from such a link is reported back to the network that showed the ad, using that click identifier, a hashed form of your email address, the amount and the date — never your plants, your city, your photos or anything you typed. With that integration off, it sends no ad-network reports. The separate campaign site has the additional consent-based measurement described below.
• IP address: used to rate-limit sign-in requests, free tools, campaign checkout and the campaign email form. Hosting providers also handle IP addresses to deliver and secure the sites. Cloudflare Turnstile receives it when it runs the bot check on that form, and we do not store it with the record the form creates. On the campaign site, the tag manager described below — and any advertising tag it loads — is fetched by your browser from its own service, which sees your IP address in the process.
• Push subscriptions (optional): if you turn on notifications, we store the address your browser issues for your device plus the keys used to encrypt messages to it. Only created after you grant permission, and removed when you delete your account.
• Diagnostics: when something breaks, an error report (message, stack trace, the page you were on, and your internal account id) so we can fix it. See Sentry below for what we strip before it is sent.
• App screen usage: basic screen analytics are enabled by default for accounts without a saved opt-out. You can turn them off in Settings. We store app screen categories, your internal account id, broad browser/operating-system and screen-size categories, and online/installed state. We do not include full URLs, search terms, plant names, photos, chat text, or recordings. Do Not Track and Global Privacy Control suppress these observations. Turn this off in Settings to stop collection and delete your earlier screen-usage records. This choice does not remove the care, billing, AI allowance, or error records used to operate the service.
• Feedback you send: your message, category, account id, submission date, and handling status. You choose whether to include the basic diagnostics listed on the form, including the app release, and whether we may reply to your account email about that report. Feedback is stored in Supabase and reviewed in a restricted owner dashboard. It is not automatically sent to an AI provider or an external issue tracker.
• Free-tool signups: if you join our plant list from the pet-safety checker, we store that email address, which plants you checked, and the plant name you searched for if we did not have it. We only store an address when you tick the consent box. Joining the list is what happens: once our short introductory series is switched on, up to five emails follow over five days — where your card lives, then the story behind Ploomily — and after that only occasional plant emails. Joining this list is separate from requesting a copy of your card. The printable card is always available on the page itself. This is kept separately from accounts: you do not need one to use the checker, and the safety answers are free and ungated. Every email we send carries an unsubscribe link that deletes nothing but stops the mail.
• Requested free-tool results: when you ask for a pet-safety card or watering estimate by email, we store your email, its normalized form for unsubscribe and abuse prevention, and the selected species identifiers in a separate lead record. This request does not enroll you in marketing. We process your pet and room choices or approximate location, pot, light and drainage to generate that email; those choices are included in the email and its return link, not stored in the lead record. Resend processes the email for delivery. Schedule links store the setup in a URL fragment, which is not sent with page requests; the location is sent when you calculate or request an email. Anyone you share a setup or card link with can read its choices. Each email has an unsubscribe link; an existing unsubscribe blocks these requests too. Hashed address/IP request counters limit sends and prevent duplicate attempts. Results stay available without an email address. If you continue from a watering result into the app, its species, pot, drainage and light choices travel in the app URL and requested sign-in link so you can review them before saving. This handoff carries no location or account preferences; city selection remains explicit in the app.
• Rescue read by email: if you ask us to email the read from the symptom checklist on go.ploomily.com, we store the address you typed, the symptoms you ticked, and any campaign or click identifiers the ad platform put in the link (the same eight fields as above) — so we can send the read and see which ads reach people who are actually stuck. We store this whether or not you tick the optional “email me again” box; that box only decides whether we may write to you a second time, and nothing is scheduled today. The read itself carries an unsubscribe link. It is kept separately from accounts, is never sent back to an ad network, and you can ask us to delete it at any time.
• Campaign email capture: on to.ploomily.com we ask for an email address in two places — before the Paddle payment form opens, and when you ask for your Free Plant Check checklist by email. The three questions and the answer on screen need no address; only the emailed copy does. The form is protected by Cloudflare Turnstile, a bot check that receives your connection and your IP address. What we keep, in the campaign’s own Cloudflare database rather than on your app account: a keyed hash of your address; your address itself — and, for a Plant Check, your three answers and your check-in choice — encrypted; which page and which version of it you came from; allowlisted campaign and click tags from the link (the utm_ tags, fbclid, gclid, ttclid, msclkid and VK’s); the country your connection came from, used only to decide which consent rule below applies to you; your follow-up choice with the basis for it and the version of the notice you were shown; and a hashed browser session that links a checkout to the address saved for it. The IP address itself is not stored on that record. The campaign publishes its own short notice at to.ploomily.com/email-privacy.

How we use it

To generate and send your reminders, run the care engine and rescue protocols, provide your collection and history, process your subscription, keep the Service secure, and improve the product. We also use your email address to tell you about Ploomily itself — for example an offer after a trial ends. That is our own mail about our own product, and it always carries an unsubscribe link. That unsubscribe page lets you choose: stop only the product and offer emails and keep your care reminders, or stop both. Your billing and account notices go out either way, and push notifications on your devices are never affected. A mail app’s own one-click Unsubscribe button has no way to ask which you meant, so it stops both — you can switch reminder emails back on in Settings at any time.

Campaign measurement helps us understand which Ploomily ads lead to visits, checkout and purchases. Plant details, photos, city choices, assistant messages and feedback are not sent to advertising services for that purpose. Advertising permission, app screen-usage settings, and email preferences are separate choices.

Processors we share with

• Supabase — database, authentication, and private photo storage.
• Vercel & Cloudflare — hosting and DNS. Cloudflare also runs the campaign site and holds its records, and protects the campaign email form with Turnstile, its bot check: your browser loads Turnstile from challenges.cloudflare.com and we ask Cloudflare to verify the result, passing your IP address for that check and nothing else about you.
• Paddle — our Merchant of Record for payments (they process your payment details; we never see full card numbers).
• Resend — sending transactional and product email (requested tool results, reminders, billing notices, magic links), and every campaign email too: the Plant Check checklist you asked for and the campaign follow-ups, all from hello@ploomily.com. Resend uses its own sub-processors and regions, listed in its published sub-processor documentation.
• Anthropic — powers “Ask Ploomily”. When you use the assistant we send your message, up to a dozen recent turns of that conversation, and context about your collection: plant nicknames, rooms, species (including custom names you typed), each plant’s status, and your actual schedules with their real next-due dates. Photos are never sent to it, and none of this is sent unless you open the assistant and write to it.
• Kindwise (plant.id) — when you use photo Plant ID or the health check, that photo is sent to Kindwise for analysis. Photos are only sent when you actively press identify or diagnose; ordinary photos you attach to a plant stay in our photo storage and are not sent to a vision provider for analysis.
• Pl@ntNet — a fallback species identifier, used only if Kindwise is unavailable. It receives the same photo and nothing else, and it does identification only — no health check.
• Sentry — error and performance monitoring, so we find crashes without waiting for you to report them. It receives error messages, stack traces, the page address, and your internal account id. Before anything is sent we drop cookies and request bodies, redact authorisation headers and your IP, replace email addresses in error text, and strip sign-in and sharing tokens out of addresses. Session recording is switched off, and if that cleaning ever fails the report is discarded rather than sent uncleaned.
• Your browser’s push service — if you enable notifications, reminders are delivered through the push service your browser uses (Google’s FCM on Android and Chrome). The message body is encrypted so the service cannot read your plant names; it does see that a message was delivered to your device.
• Open-Meteo — climate/geocoding by city (no personal identifiers sent).
• Meta (Facebook) — advertising measurement through its Conversions API. The legacy account-attribution integration is described above. On the campaign site we no longer load Meta’s browser Pixel and we no longer send Meta purchase reports from our own server: that direct integration was retired on 15 September 2026. Meta now receives campaign events only if we configure a Meta tag inside the container below, and what this entry and the campaign section say about Meta apply to such a tag.
• Google (Tag Manager) and Stape — the campaign pages load a Google Tag Manager container (GTM-MS9J4D9Q), served by Stape from our own subdomain kxg.ploomily.com. The container is part of the page and loads whichever advertising choice you make, so Google and Stape see your browser’s connection to that address, including your IP address and user agent. What happens next depends on the tags we configure inside it; the events we hand it, and how your choice controls them, are described below.
• VK Metrics (VK Digital) — campaign visit, checkout, purchase and refund measurement after advertising consent. This is the service at pixel.vkdigital.com.br.
• Brevo — campaign customer records, email preferences and optional follow-up emails. After a fulfilled campaign purchase, we synchronize your email, transaction, plan/access status, start and expiry dates, offer variant, purchase value, campaign source and email preference. A customer record is synchronized even if you decline optional emails; that does not subscribe you to them. Plant details, photos and assistant messages are not included. Refund, expiry, upgrade and unsubscribe status help stop messages that no longer apply. Brevo is also where we check, before every campaign marketing email, whether that address has opted out anywhere else — an unsubscribe, bounce or spam report held there stops the campaign emails too. And if a Free Plant Check address consented to tips and offers, we add it to a Brevo list at the end of its follow-up series, described below; a checkout address is never added that way.

This list is meant to be complete. If you find a service handling your data that is not named here, tell us and we will either remove it or add it.

Campaign advertising measurement

On to.ploomily.com, the advertising events we send — to the tag manager and to VK Metrics — start only after you choose Accept all in Cookie settings. You can choose Reject optional and still browse and buy. Global Privacy Control (GPC) overrides a stored advertising opt-in. Enabling a reporting integration internally does not replace this visitor permission. The tag manager container itself is part of the page and loads either way; what your choice controls is whether we hand it anything to work with.

• Tag manager events: after permission, we push four events into the container’s data layer — an offer-page view, checkout opening, a captured email lead and a server-verified purchase. Each carries an event id for deduplication and which version of the page you saw; the view, checkout and purchase events add the offer/product identifier, and checkout and purchase add the amount and currency. The lead event is pushed once the server has accepted the address, before the payment form opens, and adds only which of the two forms it came from. None of these events carries your email address or a hashed form of it — the lead event’s id is a random reference to the saved record, not your address — and we check your stored advertising choice and GPC before every push.
• Meta, when a Meta tag is configured: the tags inside the container decide which advertising platforms receive those events, and Meta is one we may configure. A Meta tag running in your browser can include the page address, browser information, offer/product identifiers, value, currency and transaction/event identifiers. Meta receives your IP address when your browser connects to it and may use its cookies to recognize a browser. If we configure a tag to send matching data such as a SHA-256 hash of your normalized email, that is a matching identifier, not anonymous data. We send Meta nothing from our own server for this campaign.
• VK Metrics: after consent, a qualified offer-page view after three visible seconds and checkout-opening events can include random visitor/session/tracking identifiers, the offer URL with allowlisted campaign tags, referring site origin, browser user agent and event time. Its endpoint also receives your connection IP. Verified server purchase and refund updates include your normalized buyer email (not hashed), transaction id, product/offer details, dates, payment value, currency, status, campaign tags and the available visitor identifiers.

When you start campaign checkout, we also keep the offer variant, allowlisted campaign/click tags, session reference and transaction status in Cloudflare storage, and pass campaign attribution to Paddle with the checkout. This checkout record is created even if optional advertising is rejected; rejection prevents the tag manager events and the VK Metrics reports. We do not automatically capture form contents for advertising.

Cookies and your choices

• Essential: app sign-in cookies keep your session authenticated. The campaign checkout uses a secure, HttpOnly session cookie (__Host-ploomily-checkout), lasting up to seven days, to connect checkout, payment confirmation and your access link. It is also set when the campaign email form opens, and it is what lets us link a saved address to the checkout it belongs to; the form will not submit without it. Paddle also processes checkout information under its own privacy notice.
• Remembering your choice: the campaign stores your advertising choice in this browser for up to 180 days. Clearing browser storage removes that saved choice.
• Optional advertising: after permission, a tag loaded by the container may set its own cookies — Meta’s _fbp and _fbc among them, if a Meta tag is configured. VK Metrics uses the vk_user_uid visitor cookie for up to 180 days and browser session storage for session/tracking identifiers. These are separate from the essential sign-in and checkout cookies.

To withdraw campaign advertising consent, reopen Cookie settings in the to.ploomily.com footer and select Reject optional. This stops future browser events, including everything we push to the tag manager, and clears the advertising cookies and VK session identifiers managed by our scripts. The browser also sends the changed preference for its linked checkout to our server, where pending reports are checked against consent before sending. An offline or failed request can delay that server update; reconnect and retry, or contact us. Changing browsers or clearing the checkout cookie can prevent us from connecting the choice to an earlier purchase. Withdrawal cannot recall reports already delivered; contact us about those records.

Optional tips and offers start off when a campaign purchase grants Rescue access. Choose them in the app’s Settings after signing in, or unsubscribe from an email. Buying, accepting advertising cookies, or having a Brevo customer record does not subscribe you. The app sends lifecycle emails; Brevo mirrors customer records and preferences without a separate onboarding sequence. Account/access and payment messages needed to fulfill your purchase are separate. App screen-usage sharing is controlled in the app’s Settings.

Two campaign follow-up series run on an address given to the campaign forms, and which consent rule applies depends on where you are. In the United States the form states what will be sent and lets you opt out before you continue; everywhere else nothing follows unless you tick the box, which starts unchecked. If you leave a campaign checkout unfinished we send up to three emails over about two days — roughly an hour, twenty hours and forty-four hours in — and completing the purchase stops them. If you asked for the Free Plant Check by email, the checklist and calendar file go out straight away, because that delivery is the thing you asked for and does not depend on the marketing choice; three more emails then follow over nine days. After a further two weeks a Plant Check address that consented may be included in occasional tips and offers, which is the point at which it joins our Brevo list. Every one of these is sent by Resend from hello@ploomily.com. Every one carries the one-click unsubscribe control mail apps show (we send the RFC 8058 List-Unsubscribe header) and an unsubscribe link, which stops the follow-ups for that address however it was given to us and lands on to.ploomily.com/email-preferences.

If you leave checkout unfinished, you can also request one email reminder in about an hour, using the email you entered in Paddle. We check that checkout is still unpaid before sending. This request does not subscribe you to marketing. You can cancel a pending reminder in the same browser. Reminder delivery records and a protected address fingerprint used to limit repeat requests are kept for up to 30 days; the reminder resumes your existing checkout.

Sharing with people you invite

If you create a sitter link while you are away, anyone holding that link can see — without signing in — your name, your city, and your plants’ nicknames, rooms, species notes and photos, along with what needs doing. They can only mark a task as done; they cannot write anything, upload anything, or see your email address. The link expires, and you can revoke it at any time from the app. Only share it with someone you trust with that view.

Your rights

You can export your data and delete your account at any time from Settings — self-service, no email required. This supports your rights under GDPR and LGPD. You may also email us to exercise any data right.

The export is a JSON file containing your profile, plants, schedules, care history, rescues, tasks, feedback reports, vacation windows, sitter links (without the private link address), the devices you turned reminders on for (the push service only), your subscription’s status and dates, your screen-usage preference, and time-limited links to your photos. It does not include internal records such as analytics events, email delivery logs, or billing payloads; ask us and we will send those too.

Full instructions for deletion, including how to request it if you can no longer sign in, are on the delete your account page.

Retention

Screen-usage events are scheduled for deletion after 180 days, and feedback after 365 days, by our hourly cleanup. Cleanup may catch up after an outage. Turning off screen sharing deletes your screen-usage events immediately; deleting your account also removes feedback and its preference record.

We keep your data while your account is active. When you delete your account, your profile, plants, schedules, care history, tasks, rescues, sitter links, push subscriptions and analytics events are removed outright, and your photos are purged from storage.

Some records outlive the account. Billing and payment-event records are retained to meet financial and tax obligations, with the link to your user account severed. Security rate-limit records, keyed by IP address and not linked to your account, persist briefly to keep the sign-in and free tools resistant to abuse. A free-tool or rescue-read address, if you gave one, is kept separately from accounts and is not touched by account deletion — it is where your unsubscribe choice lives, and deleting it would destroy the record that keeps us from mailing you. And backups age out on a rolling basis, so a deleted account can remain in a backup image for a short period before it is overwritten.

Campaign records are kept separately from your app account. The Meta matching context and the encrypted pending report payloads we used to hold for the direct Meta integration went with it on 15 September 2026: the campaign server now sends Meta nothing and stores nothing for it. VK browser-matching context is scheduled for clearing after 35 days; purchase/refund status can be rechecked during that window. Cleanup and retries can catch up after an outage.

A campaign lead record holds its encrypted parts — your address, and a Plant Check’s answers and check-in choice — for 180 days. After that the cleanup erases them, and what remains cannot be read back to an address: the keyed hash, the consent we recorded with its basis and notice version, and, if you unsubscribed, the suppression that stops us mailing you again. That suppression record is deliberately kept rather than deleted, because erasing it is how we would start mailing you again. Unsubscribing does not delete the record; it is what makes the record work.

Campaign checkout, attribution and delivery receipts, the hashed campaign consent and suppression records, and Brevo customer/preference records currently have no automatic age-based deletion. They support access delivery, payment/refund reconciliation and honoring email preferences. Deleting your app account does not delete these separate records, and a campaign lead is not an app account. Email hello@ploomily.com to request access or deletion, including removal at our campaign providers where applicable; tell us the address you gave so we can locate them. Financial obligations and the need to preserve an unsubscribe choice can limit deletion. The cookie and cleanup periods above describe storage we control, not a promise that Meta, Google, Stape, VK Metrics, Paddle or Brevo erase their own records on the same schedule.

Who is responsible for your data

Ploomily is operated by Vincia Serviços Digitais LTDA, Av. Paulista 1106, Sala 01, Andar 16, Bela Vista, São Paulo - SP, 01310-914, Brazil. We are the controller for the personal data described above, and we process it under Brazil’s LGPD (Lei nº 13.709/2018) as well as the GDPR where it applies to you.

Contact

Privacy questions or requests: hello@ploomily.com.
Vincia Serviços Digitais LTDA · Av. Paulista 1106, Sala 01, Andar 16, Bela Vista, São Paulo - SP, 01310-914, Brazil

This policy describes how the Service actually works today. It has not been reviewed by counsel; please have it reviewed before relying on it for a regulated market.