Leafra← Back to site

Privacy Policy

Last updated: 9 June 2026

Leafra (operated by Oney Finansal Danışmanlık Turizm ve Dış Ticaret A.Ş., “Leafra”, “we”, “us”) respects your privacy. Leafra is local-first: your garden, journal, favorites and reminders live on your device, not on our servers. This policy explains exactly what data we handle, why, and the rights you have under the GDPR (EU) and KVKK (Türkiye).

1. Data stored on your device only

The following never leaves your phone unless you explicitly export or share it. It is held in encrypted on-device storage, scoped to your account:

  • Your garden: the plants you add, nicknames, locations, watering history.
  • Journal & notes: observations, diagnoses you save, photos you attach.
  • Favorites, areas, achievements, care streaks.
  • Watering schedules and the local reminders derived from them.
  • Preferences: language, theme, notification and haptics settings.

2. Account data

  • Sign in with Apple: Apple returns a stable identifier unique to Leafra (and, on first sign-in only, your name and a relay email). We use the identifier to key your on-device data. We do not receive your real Apple ID.
  • Sign in with Google: when used, we receive your Google account ID, email and name to key your on-device data. We do not store your Google password or tokens beyond the session.
  • Email: the email you enter becomes a local identity on your device. We do not send it to a server.

3. Photos & AI processing

When you use Plant Identify, Plant Doctor, Weed ID or Room Designer, the photo you take is sent over HTTPS to our processing endpoint and forwarded to AI providers (Anthropic, Google and fal.ai). Processing happens in stateless functions and the photo is discarded immediately after inference. We do not retain your photos, and the AI providers do not use them to train their models. Photos you choose to keep in your journal or garden stay on your device.

4. Location

If you grant location access, we use a coarse, city-level position to tailor weather-aware care reminders (via Open-Meteo). Only the city name is kept, on your device. You can use the app fully without granting location — just type your city.

5. Purchases

Subscriptions and one-time purchases are processed by Apple. Apple shares purchase records (transaction and product identifiers, status) with us so we can unlock premium features. We never see your card details. See Apple’s privacy policy at apple.com/legal/privacy.

6. Diagnostics & analytics

Crash reports and product analytics are off by default and, when enabled, are anonymised and aggregated. We use no third-party advertising or cross-app tracking SDKs, and we show no ATT tracking prompt. We never sell your data.

7. Legal basis (GDPR Art. 6)

  • Contract (Art. 6(1)(b)) — to deliver the features you requested.
  • Consent (Art. 6(1)(a)) — for optional analytics and notifications, withdrawable any time.
  • Legitimate interests (Art. 6(1)(f)) — for service integrity and abuse prevention.

8. Data sharing

Because Leafra is local-first, there is very little to share. We use a small number of processors strictly to run the AI features (Anthropic, Google, fal.ai) and to host our processing endpoint (Vercel). Each is bound by a data processing agreement. We never sell your data.

9. International transfers

Photos submitted for AI processing may be processed on servers in the EU and the USA. For transfers outside the EEA we rely on Standard Contractual Clauses. Because your garden and journal stay on your device, they are not transferred internationally.

10. Retention & deletion

Your on-device data is kept until you delete it. You can remove everything from Settings → Reset in the app, or by deleting the app. Photos sent for AI inference are not retained by us at all. Anonymised diagnostics, if enabled, are retained for up to 90 days.

11. Your rights

You have the right to access, rectify, port, restrict, object to, and delete your data, and to withdraw consent. Because most data lives on your device, you can exercise most of these directly in the app. For anything else, contact support@oneyworld.com. The same rights apply to Turkish residents under KVKK.

12. Children

Leafra is rated 4+ but is not directed to children under 13, and we do not knowingly collect personal data from them.

13. Contact

Operator: Oney Finansal Danışmanlık Turizm ve Dış Ticaret A.Ş., İstanbul, Türkiye.
Email: support@oneyworld.com

You may also lodge a complaint with your supervisory authority (in Türkiye: KVKK; in the EU: your national data protection authority).