Privacy Policy

Second Leaf AI has no user-account database. Your plants, photos, diagnoses, and notes live on your phone. If you have iCloud Drive on, a daily snapshot is also saved to your iCloud Drive — which is governed by Apple's privacy policy, not ours.

We do operate a thin proxy server (a Cloudflare Worker) that sits between the app and the AI partners. It exists so the AI vendor API keys never live on your phone. The proxy validates the request came from a real install of our app (via Apple's App Attest) and keeps a daily cost counter to stop runaway spending. It does not log photos, notes, or anything that identifies you.

• Plant photos you take or pick from your library.
• Notes you type about your plants.
• Climate zone derived from your location (we use coordinates once, then forget them).
• Care reminders you set up.
• Your first name if you give it to us in onboarding — only used to greet you on the Today screen.

This data stays on your phone unless you explicitly back it up or have automatic iCloud backup on.

When you ask for an identification or diagnosis, we send one photo plus a sanitized text description through our Worker proxy to:

• Plant.id (plant.id) — for plant species and disease identification. Privacy: web.plant.id/privacy
• Anthropic (anthropic.com) — for diagnosis reasoning via Claude. Privacy: anthropic.com/privacy

We strip EXIF metadata (including location) from photos before sending. We sanitize your notes (cap length, remove control characters). Photos stay only in memory on your device until the AI call returns and you choose to save the result — we don't write the photo to disk until you decide to keep it.

Two more Apple services are involved, both of which are governed by Apple's privacy policy:

• Apple WeatherKit — fetches local weather for plant-care alerts. Apple sees your approximate location at the moment of the request.
• Apple Foundation Models (on-device, iOS 26+) — phrases your local care-reminder notifications into warmer language. This runs entirely on your device; nothing leaves your phone.

Our Worker is hosted on Cloudflare's edge network. Cloudflare may briefly process the request bytes as part of routing — see Cloudflare's privacy policy for their handling.

We never send: your name, your email, your full photo library, your contacts, your precise location, or anything else.

• No analytics SDKs.
• No advertising IDs.
• No third-party trackers.
• No marketing emails (we don't have your email).
• No referral bounties.

• Subscription purchases are handled by Apple. We see only whether you have an active Lite or Pro entitlement, never your card details.
• Crash reports (if you've opted into sharing with developers) come to us via MetricKit. They include device model and crash stack, but no plant data.

Because we don't store your data on our servers, the standard rights are mostly automatically respected. To be specific:

• Right of access: Your data lives on your phone. Settings → Back up now writes a single archive of everything to your iCloud Drive Second Leaf AI folder.
• Right of deletion: Settings → Erase all data wipes everything from your device. Deleting the app deletes the device copy. To remove the iCloud copy, delete the file in Files → iCloud Drive → Second Leaf AI.
• Right of rectification: Edit plants, diagnoses, and notes directly in the app.
• Right of portability: The backup archive is a documented JSON-based format.

Second Leaf AI is rated 4+ but it isn't directed at children. We don't knowingly collect personal information from anyone — including children — beyond what's described above.

We may update this Privacy Policy from time to time. You can find the latest version on this page. We advise you to review this Privacy Policy periodically for any changes.

We are happy to answer any questions regarding the Privacy Policy. Contact us at: timebrane@icloud.com