1. Data Controller

The data controller within the meaning of the GDPR is:
Yorrick Dettlaff
Leostraße 13
45359 Essen
Germany
Email: yorrickdettlaff@googlemail.com

2. Data Collected and Purposes

2.1 Registration and Authentication

When you register, we collect your email address, a password (hashed, never stored in plain text) and an optional display name. This data is processed via Supabase Auth (Supabase Inc., 970 Trestle Glen Rd, Oakland, CA 94610, USA). Legal basis: Art. 6(1)(b) GDPR (contract performance).

2.2 Plant Data

Plants you create, watering logs and household data are stored in the Supabase database (region: eu-central-1, Frankfurt). Legal basis: Art. 6(1)(b) GDPR.

2.3 Profile Photo

If you upload a profile photo, it is stored in Supabase Storage (Frankfurt). Storage is voluntary. Legal basis: Art. 6(1)(a) GDPR (consent).

2.4 Push Notifications

If you enable push notifications, a device-specific push token is stored in our database. It is used exclusively for watering reminders and deleted immediately upon deactivation. Legal basis: Art. 6(1)(a) GDPR (consent).

2.5 Location Data (optional)

If you activate the location feature in the household section, your geographic coordinates (latitude and longitude) and a place name are stored in our database. This data is used exclusively to display weather-based watering tips in the weather widget (via Open-Meteo API, no API key, your coordinates are not shared with third parties). Processing only occurs with your explicit consent by activating the feature. You can remove the location at any time in the household section. Legal basis: Art. 6(1)(a) GDPR (consent).

2.6 AI-powered Care Tips & Health Check

Plant guides are generated using the Anthropic Claude API (Anthropic PBC, USA). Only the plant name and species are transmitted – no personal data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving app functionality).

2.7 Hosting and Server Logs

The app is hosted via Vercel Inc. (340 Pine Street, San Francisco, CA 94104, USA). Each page request logs technical data (IP address, browser type, timestamp). These are automatically deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR.

3. Cookies and Local Storage

Blossomly uses only technically necessary cookies and local storage entries:

Supabase Auth Session – for the login session (session cookie, expires on sign-out)
Cookie consent – stores your decision in localStorage (not a cookie)
Push service worker – technically required for web push functionality

No analytics or tracking cookies are used.

4. Data Sharing

Your data is not sold to third parties. Data is only shared with the following processors, with whom data processing agreements (Art. 28 GDPR) exist:

Supabase Inc. – database, authentication, storage
Vercel Inc. – hosting and CDN
Anthropic PBC – AI care tips (anonymised plant data only)

For data transfers to the USA we rely on Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR.

5. Your Rights

You have the following rights under the GDPR:

Access (Art. 15) – what data we hold about you
Rectification (Art. 16) – correction of inaccurate data
Erasure (Art. 17) – delete your account and all data at any time under Settings → Delete account
Restriction (Art. 18) – restriction of processing
Data portability (Art. 20) – export of your data on request
Objection (Art. 21) – objection to processing based on legitimate interests
Withdrawal (Art. 7(3)) – withdraw consent at any time

To exercise your rights, contact: yorrickdettlaff@googlemail.com

You also have the right to lodge a complaint with the competent supervisory authority.

6. Data Security

All connections are TLS-encrypted (HTTPS). Passwords are stored exclusively as hashes (bcrypt via Supabase Auth). Database access is secured by Row-Level Security (RLS) – you can only access your own data.

7. Retention

Your data is stored as long as your account is active. After account deletion, all personal data is deleted immediately and permanently. Server logs are automatically purged after 30 days.

8. Changes to this Policy

We reserve the right to update this Privacy Policy as needed. The current version is always available at /privacy. Material changes will be communicated by email.