Privacy Policy

At a glance

• You sign in with Sign in with Apple. We never see your password and we don't operate a separate account database.
• Your plant collection (names, schedules, journal notes) syncs across your iPhone, iPad, and Apple Watch through your own iCloud Key-Value Store. Apple holds it; we don't.
• Your plant photos stay on the device. They're not uploaded anywhere except — temporarily — when you choose to identify a plant or chat with Dr. Afrao.
• Plant identifier and Dr. Afrao requests pass through a Cloudflare Worker we operate, which forwards them to OpenAI. The Worker holds the API key and doesn't log message bodies.
• We do not sell your data, do not share it with data brokers, and do not run third-party analytics SDKs.
• You can delete your local data from the app at any time, and revoke Sign in with Apple from iOS Settings.

What we collect

Information from Sign in with Apple

• Apple user ID — an anonymous identifier Apple gives us so we can tell who's signed in. It doesn't reveal your real Apple ID email.
• Display name — the first name you let Apple share with us, used to personalize Dr. Afrao greetings.
• Email — only if you choose to share it. If you select Apple's Hide My Email, we receive a private relay address and can't see your real email.

All three values are stored in your device's UserDefaults. We do not transmit them to a server we operate.

Information you create in the app

• Plant collection — species name, nickname, location label ("Bedroom"), pot size, journal notes, watering and fertilizing schedules.
• Plant photos — kept in the device's local file system. Photos do not roundtrip to iCloud Key-Value Store (it has a 1MB cap), so they only exist on the iPhone you took them on.
• Care preferences — reminder times, units (metric / imperial), language.
• Dr. Afrao conversations — text messages and any photos you attach when chatting with the assistant. Stored locally for history; sent to the AI proxy when you press send.

Information collected automatically

• Approximate location — only if you grant the permission, and only at city resolution. Used to fetch local weather so watering reminders adjust to heatwaves and cold snaps.
• Light meter readings — when you point the camera at a plant to measure lux, we save the resulting number on the plant. The raw camera frames never leave the device.
• Crash reports — Apple sends us anonymized crash logs through App Store Connect if you've opted into Apple's diagnostic sharing in iOS Settings. We see no personal data.

Information we don't collect

• Your contacts, photo library beyond the plant photos you pick, microphone audio, calendar, health data, or precise GPS.
• Payment card numbers — Apple handles all subscription billing; we never see your card.
• Advertising identifiers (IDFA) — Tazart contains no advertising or third-party tracking SDK, so the App Tracking Transparency prompt doesn't apply.
• Behavioural analytics — we run no Mixpanel, Amplitude, Segment, Firebase Analytics, or similar.

How we use it

We use the data above to: identify plants you photograph, generate personalized care schedules, remind you to water and fertilize, sync your collection across your own Apple devices, answer your Dr. Afrao questions, handle Tazart Pro subscriptions, and respond to support requests.

We do not use your data for behavioural advertising, profile-building, or training third-party AI models. Plant photos are not added to any AI training set.

Website cookies, ads & affiliate links

This section covers the public website at tazart.app — separate from the iOS app, which contains no advertising or tracking SDKs.

Cookies & local storage

The website uses cookies and the browser's localStorage for three narrow purposes:

• Essential — remembering your cookie-consent choice and basic site preferences. Always on; the site can't function without these.
• Analytics — anonymous usage statistics so we can see which guides need improving. Off by default until you tap "Accept all" in the consent banner.
• Advertising — our ad partner Ezoic places cookies on blog post pages to show relevant ads. Off by default until consent is given. You can revoke consent any time by clearing your browser's site data for tazart.app.

Ads on blog posts

We display banner ads inside our blog posts (only on blog posts — never on the home page, About, Support, or any in-app surface). Ads are served by Ezoic, who acts as our ad partner and may use cookies, web beacons, and similar tools to personalize ads, measure performance, and prevent fraud. Ezoic partners with ad exchanges (including Google AdSense) that may also process limited data such as your approximate location, the page you're viewing, and the device you're using.

For EU/UK/Switzerland visitors, our consent banner gives you a genuine choice — "Accept all" enables personalized ads, "Reject non-essential" keeps ads contextual only (based on the page content, not on you). No personalised ads are served to anyone under 16.

You can read Ezoic's privacy policy at ezoic.com/privacy-policy and Google's at policies.google.com/privacy. To opt out of personalised ads industry-wide, visit youradchoices.com (US) or youronlinechoices.eu (EU).

Amazon Associates affiliate links

Some blog posts include links to products on Amazon — labelled as "Tools we actually use" with a clear affiliate disclosure above the cards. Tazart is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com. When you click a link and buy something on Amazon within 24 hours, we earn a small commission at no extra cost to you. This never influences which products we recommend.

Third parties & subprocessors

Tazart v1.0 relies on three providers. Each is bound by their published terms of service or, where available, a Data Processing Agreement.

We do not sell your personal information to third parties under any definition of "sale" — including the broader CCPA / CPRA definition.

Plant identifier & Dr. Afrao

When you tap the plant identifier or send a message to Dr. Afrao, Tazart routes that request through a Cloudflare Worker we operate at tazart-ai.tazart.workers.dev. The Worker holds the OpenAI API key so it can't leak from the app, validates a shared app token, attaches the API credential, and forwards the request. The Worker keeps anonymous request counters for rate limiting; it does not log message bodies or images.

OpenAI processes the photo or text long enough to return a response and then handles it under their enterprise API policy. OpenAI contractually agrees not to use API content to train models. Read the full policy: openai.com/policies/privacy-policy.

Subscriptions

Tazart Pro ($2.99/month) is billed by Apple through StoreKit. We never see your credit card or Apple ID password. Apple shares with us only an anonymous transaction receipt, validated locally on the device. Cancel any time in iPhone Settings → [your name] → Subscriptions.

Data retention

• Local app data — stays on the device until you delete the app or clear the app's data.
• iCloud Key-Value Store — kept by Apple under your iCloud account; removed if you delete the app from all your devices and clear it from Manage iCloud Storage.
• Plant photos — local only; deleting them in-app removes them immediately.
• AI proxy logs — anonymous request counts only, retained 30 days for abuse detection.
• Support emails — kept for 2 years, then deleted.

Your rights & controls

Wherever you live, you can:

• Export your data — Tazart Pro unlocks a full export to file from Profile → Export data.
• Delete plants and journal entries from inside the app at any time.
• Revoke Sign in with Apple in iPhone Settings → [your name] → Sign-In & Security → Apps Using Apple ID → Tazart → Stop using Apple ID.
• Withdraw consent for location, camera, and notifications from iOS Settings → Tazart.
• Erase iCloud-stored plant data from iPhone Settings → [your name] → iCloud → Manage Account Storage → Tazart.

EU/UK (GDPR): you have the right to access, rectify, erase, restrict, port, and object to processing of your data. The legal bases we rely on are contract (to deliver the service), consent (for optional permissions like location), and legitimate interest (for fraud prevention and security).

California (CCPA / CPRA): you have the right to know, delete, correct, and limit the use of your information; and to not be discriminated against for exercising those rights. You may designate an authorized agent to act on your behalf.

To exercise any of these rights, write to support@tazart.app. We respond within 30 days. You can also lodge a complaint with your local supervisory authority if you believe we've handled your data unfairly.

Children's privacy

Tazart is rated 4+ in the App Store but is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has signed up, write to support@tazart.app and we'll help you remove their data.

International transfers

The Cloudflare Worker that handles AI requests runs at the edge closest to you, but the upstream OpenAI endpoint is in the United States. If you're outside the US, your photo or message is transferred there for the duration of the AI call. Where applicable, this transfer relies on Standard Contractual Clauses and the EU–US Data Privacy Framework. By using the app you consent to these transfers.

Changes to this policy

We update this policy as the app evolves. Material changes are announced inside the app at least 14 days before they take effect. The "Last updated" date at the top always reflects the current version.

Contact us

Questions, requests, or just curious?

• Email: support@tazart.app
• Postal: Tazart, c/o privacy team — please email first and we'll share the postal address for formal requests.