Privacy policy

1. Who is responsible for your data

The data controller is [TO CONFIRM: name or entity, address and tax number]. For any privacy question, write to ajuda@bonsaiku.pt.

2. What data we keep

Account and session:

• When you sign in with Google we receive your name, your email, your Google account identifier and, if there is one, your profile picture. We never receive your password. Signing in with Apple will be possible later, on the same terms.
• Each session you start (phone or web) is recorded with the platform and when it was used. The session code is stored only as a cryptographic digest (hash), which cannot be reversed, and the session ends after 30 days without use.
• During development there is a test user, which only works on our own computers and never on the public service.

Your diary and what you create in the app:

• Trees (name, species, cultivar, style, stage, starting year, location, notes) and diary entries (watering, pruning, wiring, repotting, treatments, fertilisers, substrates, health…).
• Photos of trees and pots. Each photo is converted to WebP in three sizes; the original photo is kept only until it is processed and is deleted right after, and its metadata (EXIF, including GPS location) is removed.
• Pots, reminders and tasks, and QR labels with the visibility you choose.
• Work sessions and professional credits on your trees, and your public professional profile, if you request one.
• Requests for species not yet in the catalogue and your votes on those requests.
• Your feedback about the app, if you send it: the text you write, the app page you were on, the version, the language and the platform, and a screenshot only if you choose to attach one.

Location and preferences:

• Your country and, if you wish, your region and city (optional and private: only you can see it), and your phone’s time zone. They are used to work out the hemisphere and climate zone so that the guide and reminders match your season. We never store coordinates.
• If you allow it, the phone uses your approximate location once to suggest your country and region. If you use the location button, the approximate coordinates (the app rounds them to about 1 km) are sent once to our server to find the nearest city; we do not store them and our API does not log them. If that is not possible, the app may use the system location service: the approximate coordinates are then sent to Apple (on iPhone) or Google (on Android), which return the country and region.
• Your language and theme (light or dark).

Notifications:

• Reminders can be local notifications, created by the phone itself.
• If you allow notifications, we keep your phone’s notification code (push token) and time zone, to remind you of the day’s tasks. You can turn them off at any time in your phone or app settings.

Technical data:

• Server logs (requests, errors and your account identifier) to keep the service secure and fix problems. [TO CONFIRM: whether the IP address is kept in the logs.]
• When you change a label’s visibility or replace its code, we keep an audit record with the date and IP address, to prevent abuse.

On your phone, the app keeps a copy of your data so it works offline. That copy stays in the app’s storage and is deleted when you uninstall the app. [TO CONFIRM: also delete this copy on sign-out.]

3. What we use your data for

• To provide the service you asked for: storing and syncing your diary, showing the right care guide for your zone and sending reminders (performance of a contract, Article 6(1)(b) GDPR).
• To keep the service secure, prevent abuse and fix errors (legitimate interest, point (f)).
• To show your professional profile and credits publicly, only with your consent, which you can withdraw at any time (consent, point (a)).
• To meet legal obligations, where they exist (point (c)).

4. What we do not do

• We do not sell or rent your data.
• We do not show ads or use your data for marketing.
• We do not use advertising trackers or third-party analytics tools.
• We do not use your photos or your diary to train artificial intelligence models.

5. What others can see

Your trees are private by default. For each QR label you choose the visibility:

• Private: nobody but you sees the tree; whoever reads the label sees the same as for a code that does not exist.
• Unlisted: whoever has the code (for example, whoever reads the label) sees a read-only public page; that page does not appear in search engines.
• Public: the public page may appear in search engines.

The public page shows the tree’s name, species, cultivar, style, stage, starting year, cover photo and code. It never shows your full diary, your name or your location.

A professional profile is only public with your consent. The evidence you send for verification (photos of work, certificates) is only seen by the verification team. In species requests we do not show who asked or who voted.

6. Where your data is kept and who helps us

Data and photos are kept on a server in the European Union, rented from Contabo, in Germany. [TO CONFIRM: where backups are kept.]

We use these third-party services, only for what is needed:

• Contabo (Germany): server hosting.
• Google: so you can sign in with your Google account. Later, Apple, so you can sign in with your Apple account.
• Apple (on iPhone) and Google (on Android): if you allow location access, they receive the phone’s approximate coordinates, once, only when the app needs the system service, to return your country and region. These services may process the data outside the European Union (for example, in the USA).
• Expo (USA), Apple and Google: to deliver notifications to your phone. They receive the phone’s notification code and the notification text.

When one of these services processes data outside the European Union, the transfer relies on the safeguards provided for in the GDPR (for example, standard contractual clauses or adequacy decisions). [TO CONFIRM: safeguards for each service.]

7. How long we keep it

• Your data is kept for as long as you have an account.
• Sessions end after 30 days without use.
• Data exports are deleted 7 days after they are ready.
• Server logs kept in the daily log file are deleted after 14 days. The server console output (container) does not yet have a configured retention period. [TO CONFIRM: retention period for the container output.]
• The tag audit log (with the date and IP address) is kept while you have an account; when you delete it, the IP address is removed.
• When you delete your account, we delete all your data and end all your sessions. Only one line remains in the audit log saying that an account was deleted, with no personal data.
• Exception: work sessions you recorded on other people’s trees that had already been accepted pass to the tree’s owner, with their notes, so the tree’s history is not lost; your credit on them becomes anonymous. Those not yet accepted are withdrawn.
• Backups are replaced after [TO CONFIRM: number of days].

8. Your rights

You have the right to access your data, correct it, delete it, receive it in a format you can take elsewhere (portability), restrict or object to processing, and withdraw any consent you have given.

• Export your data: you can request a ZIP file with all your data (as JSON) and your photos. It is available for 7 days and can only be downloaded with your session. The button in the app (Profile › Advanced) is coming soon; until then, request the export by email.
• Delete your account: in the app, under Profile › Advanced › Delete account. We ask for a confirmation word and for you to sign in again, so that nobody does it by mistake or on your behalf. It cannot be undone.
• Correct your data: you can change almost everything directly in the app. The diary is an append-only record: to correct an entry, you add a new one.

To exercise any other right, write to ajuda@bonsaiku.pt. We reply within one month. If you think we have not handled your data properly, you can complain to the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, cnpd.pt) or to the data protection authority in your country.

9. Security

Connections are encrypted (HTTPS). Session codes are stored only as a cryptographic digest (hash), which cannot be reversed. Each person can only access their own trees and entries, and photos lose their metadata before they are stored. No system is infallible: if a breach puts your data at risk, we will tell you and the CNPD, as the law requires.

10. Children

Bonsaiku is not intended for children under [TO CONFIRM: minimum age, for example 13]. If you know a child has given us data without permission, write to us and we will delete it.

11. Changes to this policy

If we change this policy, we update the date at the top of the page and, if the change is significant, we let you know in the app before it takes effect.