FlowerID Privacy Policy
Last updated: 12 October 2026
FlowerID (also named FlowerIdenty: Plant Scanner) is operated by Shehan De Silva. Contact: rapstashehan@gmail.com.
This policy describes processing that depends on your app version, permissions, account and subscription. Explorer League services include existing registered accounts. RevenueCat subscription reporting is included in version 1.51; earlier versions may use Apple's purchase services without RevenueCat.
1. Accounts and Sign-In
Apple or Google sign-in supplies Firebase Authentication with an account identifier and available profile information, such as your name, email and Google profile-image reference. Apple may supply a private relay email. We do not receive your Apple or Google password or request your contacts, friends list or inbox.
Sign-in providers also process data to operate and secure their services. The bundled Google Sign-In privacy disclosure includes account contact information (which may include a phone number held by Google), user and device identifiers, approximate location, usage information and other technical data. FlowerID does not ask you to enter a phone number or use phone-number sign-in.
2. Photos and AI Identification
When you request identification, the selected or captured photo is sent through Firebase AI Logic to Google's Gemini service with a flower-identification prompt and your selected response language. This happens online, not solely on your device. We do not deliberately add your profile name, email, field notes or discovery coordinates to the prompt.
Only submit photos you are entitled to use, avoiding people, private documents and sensitive information. Google may retain requests and responses for security and abuse prevention under the applicable Gemini terms. Provider processing and retention are separate from deleting a discovery in FlowerID. See https://ai.google.dev/gemini-api/terms and https://policies.google.com/privacy.
3. Your Garden and Cloud Backup
Discoveries are stored on your device. With an eligible Pro account, cloud synchronization also stores photos and records in Firebase Firestore and private Cloud Storage under your account. Records include flower details, discovery identifiers, capture/update times, rarity, favourites, notes and any saved location. They are not part of the public leaderboard. Normal app access is restricted to the account owner; authorised service processes also access records for syncing and progress.
Syncing can run during app use and after changes, not only when you press Sync Now. Free accounts can still send limited progress records without full photo backup.
4. Location and Maps
With your permission, the app can attach a precise or approximate location to a discovery, depending on your device settings. Coordinates and place names can be included in Pro backups. Apple provides map and place-name services under its own terms. FlowerID does not request continuous background location access. Changing location permission in iOS Settings does not erase previously saved locations.
5. Explorer League and Game Progress
Registered accounts join the Explorer League automatically, including accounts created before the league update. The initial username uses your profile name and may reveal your real name. Other signed-in explorers can see your username, emblem, level and weekly or lifetime XP. The leaderboard does not include email addresses, photos, notes or discovery locations.
In Explorer Identity, choose a custom username or turn off Show on leaderboard. Offline changes take effect after syncing. If your installed version lacks these controls, update the app or email us to request that your entry be hidden.
The progress service stores account-linked discovery events, timestamps, one-way photo fingerprints, XP, levels, quests and streak records. A fingerprint helps prevent duplicate rewards but is not anonymous because it is linked to your account. Earlier eligible discoveries may receive lifetime XP credit. The service can read cloud-backed records and private photos to calculate fingerprints. For phone-only discoveries, the device calculates the fingerprint; the progress event does not upload the photo, notes or location.
If you enable Game Center, achievement progress and discovery scores can also be sent to Apple. Game Center identity, visibility and retained records are managed separately through Apple.
6. Purchases and RevenueCat
Apple processes payments; we do not receive full payment-card or bank-account details. Versions using RevenueCat send a Firebase-linked account identifier (or an anonymous identifier before sign-in), available purchase history, transaction details and subscription status to that service. RevenueCat also processes technical information needed to operate its service. This supports purchase reporting, subscription support, fraud prevention and subscription analytics. Available past purchases can sync when you use the updated app.
We do not send your name, email, flower photos, notes or discovery locations to RevenueCat as customer attributes. Automatic advertising-device-identifier collection is disabled in our RevenueCat configuration. Subscription records are not shown on the leaderboard. See https://www.revenuecat.com/privacy.
7. Technical Information and Sharing
Firebase and Google sign-in components process technical information such as SDK, app and operating-system versions, network information, identifiers and service usage for authentication, reliability, security and service analytics. Discovery interactions support game progress. This version does not integrate an advertising network, cross-app advertising tracking, Firebase Analytics or Crashlytics. SDK technical collection is separate from those products.
We use data to provide requested features, maintain accounts, sync discoveries, calculate progress, manage subscriptions, prevent abuse and respond to support requests. Providers include Google/Firebase, Google Gemini, RevenueCat and Apple. We may disclose information where legally required or necessary to protect users and the service. We do not sell personal information or share it with advertising data brokers.
Providers may process information outside your country. European hosting of some Firebase resources does not mean all authentication, AI or subscription data stays in Europe. Information received through Google APIs is used subject to the Google API Services User Data Policy, including Limited Use requirements.
8. Retention and Deletion
We retain account and discovery data while needed to provide the service. Deleting a discovery hides it from your garden; successful cloud sync removes its backed-up photo. A cloud deletion record can retain metadata and notes to synchronize deletion across devices. Previously earned XP and duplicate-prevention records remain until account deletion.
Use You > Delete Account to delete your Firebase account, cloud discoveries, backed-up photos and that account's local discoveries on the device. You may need to sign in again first. Server cleanup removes the public explorer profile and private progress records. A minimal account-identifier/deletion-time marker remains to prevent delayed events recreating progress. Deletion needs connectivity and successful completion; contact us if it fails. Copies on other offline devices and provider backup or security records may remain until separately removed or aged out.
In-app deletion does not currently automatically erase RevenueCat subscription records, Apple purchase history or Game Center records. Email us to request deletion of associated RevenueCat records and other retained information, subject to applicable retention requirements. Account deletion or uninstalling does not cancel an Apple subscription. Manage or cancel it in Apple Account subscription settings.
9. Choices and Privacy Rights
Control camera and location permissions in iOS Settings, choose which photos to submit, edit notes, change or hide your league username, or delete your account. Email rapstashehan@gmail.com for access, correction, a copy of your information or deletion assistance. We may verify account ownership; never send passwords or payment-card details.
Depending on your location and applicable law, you may also have rights to restrict or object to processing, withdraw consent, request portability or complain to a privacy regulator. We do not discriminate for exercising applicable privacy rights. Withdrawing consent does not affect earlier lawful processing. We process data to provide requested services, protect and administer the service, comply with obligations, and with consent where required.
10. Security and Children's Information
We use access controls and protected network connections, but no service guarantees complete security. Avoid sensitive information in flower photos or notes. If you believe a child has provided information that should be removed, contact us so we can investigate and act appropriately. An App Store content age rating is not a statement that every third-party AI service permits use by that age group.
11. Changes and Contact
We update this page when practices change and show the revision date above. Material changes may also be communicated through the app or another appropriate channel.
Privacy contact: Shehan De Silva, rapstashehan@gmail.com.