Monstera — Privacy Policy
Last updated: September 6, 2026
Controller and contact
Monstera is developed by Francesco Bianco, the controller for the processing described here. Contact f.bianco.dev@gmail.com for support or requests about your data.
Data and purposes
- Account. On first launch, an anonymous Supabase session with a random identifier is created to manage service access, credits and quotas. Sign in with Apple provides an account identifier and, when supplied by Apple, your name and email. You can use Apple’s private email relay. A recoverable account is required to associate purchases and access your credits on other devices.
- Plant photos and context. When you request identification or diagnosis, selected photos and relevant context—such as species, symptoms, notes, care history, light and local weather—are sent through our Supabase backend to PlantNet and, for AI features, model providers through OpenRouter. Your entire photo library is not uploaded. Avoid including people, documents or confidential information. You can use the manual catalog without sending photos to analysis services.
- Location. With your permission, Apple WeatherKit and Apple geocoding use your location for weather and care suggestions. Coordinates are not stored in Monstera’s backend. You can deny permission and choose a city manually. Weather context associated with a diagnosis request may be included in the analysis.
- Purchases. Apple processes payments; Monstera does not receive your card details. We store product and transaction identifiers, subscription status and expiry, credit balances and movements to deliver purchases, handle renewals and prevent duplicate grants.
- Analytics and diagnostics. When enabled, product analytics include feature interactions, app and OS versions, session ID and account user ID. These events do not contain plant names, notes, photos or coordinates. Disable analytics in Settings → Data and privacy → Usage statistics. The backend also processes technical logs, request outcomes, timings, errors and abuse-prevention information, including information derived from IP addresses.
- Support. We process your email address and information you choose to send when answering your request.
On-device data and iCloud
Your garden, journal photos and care history are stored on your device. iCloud synchronization, where available and enabled, is managed through Apple services and your Apple Account. Deleting your backend account does not replace management of local or iCloud data.
External services and transfers
Supabase hosts the backend in Frankfurt, Germany. PlantNet/CIRAD processes identification requests. OpenRouter routes AI requests to the model provider in use. Apple handles Apple authentication, purchases, weather and iCloud. External services may process data outside the European Economic Area under their terms and transfer arrangements. Contact us for information about the recipients of a particular request.
Photos are processed to provide the requested result; Monstera’s backend does not maintain them as a photo library. External providers’ own policies, including technical retention, apply to their processing. We do not promise that third parties retain no data.
Legal basis and choices
We process data necessary to provide requested features and purchases to perform the service; data required by law to meet applicable obligations; and technical data for our legitimate interest in security and abuse prevention. Optional features depend on your choices and, where required, consent. The app requests sharing consent before sending data to analysis services. You may decline or revoke it in settings. Location permission can also be revoked in iOS settings. Withdrawal does not undo processing already performed.
Monstera does not use advertising identifiers, sell personal data or track you across other companies’ apps and websites for advertising. AI suggestions concern plant care and do not make automated decisions with legal effects on individuals.
Retention and deletion
Account, purchase and credit records are retained as needed to provide the service. Identification logs have scheduled deletion after 90 days. Other technical and support information is retained for as long as needed for its purpose. Legal obligations or a dispute may require further retention.
Delete your account from Settings → Account → Delete account. This removes the Supabase account and linked application records; some technical data may be disassociated from the account. Manage your garden and synchronized data separately through the app’s data controls and iCloud. Account deletion does not cancel an Apple subscription: manage it separately in your Apple Account settings.
Your rights
Where applicable, you may request access, correction, erasure, restriction, portability, objection or withdrawal of consent using the email above. You may complain to the Italian Data Protection Authority or your local supervisory authority.
The service is not directed to children under 13. Contact us if you believe a child has supplied personal data so we can address its removal. This policy will be updated when the service or data processing changes.