Last updated: October 2026
This privacy policy covers the "Eat 30 Plants" app for iOS and for Android. Where the two versions differ, the section says so.
Controller
MvG Mehr vom Guten OG
Max-Winter-Platz 9/17
1020 Vienna, Austria
Email: support@eat30plants.app
2. Overview of Data Processing
The "Eat 30 Plants" app helps you track your plant intake. You can use the app without an account and without signing in. This privacy policy informs you about which data we collect, how we use it, and what rights you have.
What Data We Collect
3.1 Device identifier
When you use the app for the first time, a random device identifier (UUID) is generated and stored on your device. This identifier contains no personal information. It is used to assign your entries on our server to your installation of the app, and also as the identifier for in-app purchases (3.4) and – in hashed form only – for usage analysis (3.6).
You can find the identifier in the app under More → Technical Information. Please quote it when you request access to or deletion of your data – it is the only way we can match your request to the data on our server. On Android, the identifier is part of the Google device backup and continues to be used after a restore to a new device.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) – for providing the app functionality.
3.2 Plant entries
When you enter plants in the app, the following data is collected:
- Date of entry
- Selected plants
- A random identifier for each entry
Our server also stores when it received an entry and when the entry was last changed. Entries are stored locally on your device and transferred to our server; on Android they are also synchronized with the server so that they can be restored. We also use your entries to tailor reminders (e.g. “You’ve already logged 7 plants today”).
Your plant combos (plant lists you put together yourself) are stored only on your device and are not transferred to our server. They are part of your operating system’s device backup (iCloud or Google), if you have it enabled.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) – for the provision of the service.
3.3 Push notifications
So that we can send you reminders, the app transmits to our server:
- Your push token – provided by the Apple Push Notification service on iOS, and by Firebase Cloud Messaging (Google Ireland Limited / Google LLC) on Android
- The time zone of your device
- The language of the app
We use this data only to send you reminders at the right time and in your language. They are delivered through Apple’s or Google’s push service.
The app transmits this data as soon as your device provides a push token – including before you have made a choice about notifications in the app. Whether reminders are shown is up to you in your device’s system settings; on iOS, they are delivered quietly to the Notification Centre until you decide. The text of a reminder may include the number of plants you have logged today and is delivered through Apple’s or Google’s push service. The push token is also passed to RevenueCat (3.4). We log which reminder was sent when and in which language.
You can object to this processing at any time (Art. 21 GDPR). To do so, write to us and quote your device identifier; we will then delete your push token, time zone and language and stop sending you reminders.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) – delivering reminders; they are only shown if you allow them in your system settings.
Firebase privacy notice: https://firebase.google.com/support/privacy
3.4 In-app purchases and subscriptions
To process in-app purchases, we use the RevenueCat service (RevenueCat Inc., USA). The following are processed:
- Your device identifier
- Purchase history and subscription status
- Transaction data (processed via Apple’s App Store on iOS, via Google Play on Android)
- Your push token
- The hashed analytics identifier from 3.6, so that purchases can be included in the usage analysis
- On iOS, additionally: the identifier for vendors (IDFV), the device version and your IP address
Your payment data is processed exclusively by Apple or Google and is not accessible to us.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
RevenueCat privacy notice: https://www.revenuecat.com/privacy
3.5 Error reports and stability
To improve app stability, we use Sentry (Functional Software Inc.). For troubleshooting and to measure stability, the following data is transmitted:
- Error messages and stack traces
- Device information (model, operating system version), app version
- A random installation identifier generated by Sentry
- Session data (start, end, whether a crash occurred) for every session
- Technical events before an error (e.g. which screen was open, requests to our server including the address called, which may contain your device identifier)
- Performance data (loading times) for a sample of 10% of operations; on iOS, also profiling data for 10% of sessions
The data is processed on servers in the EU (Germany).
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) – for troubleshooting and quality assurance.
Sentry privacy notice: https://sentry.io/privacy/
3.6 Usage analysis
To analyse how the app is used, we use TelemetryDeck (TelemetryDeck GmbH, Germany), a privacy-friendly analytics service.
The following is collected:
- Usage events (e.g. which step of the introduction was viewed, which article was opened, or whether the subscription screen was shown)
- Technical details attached to every event automatically: app version, device model, operating system version, language and region, screen size, time zone, and usage counters (e.g. date of first use, number of days the app was used)
- Time of day and weekday; for purchases, the product ID, the price and, where applicable, an error message; the reading time of articles
- Your device’s accessibility settings (e.g. font size, bold text, reduced motion, increased contrast)
- A pseudonymous identifier: your device identifier (3.1) is salted and hashed on your device before it is transmitted. The unmodified device identifier and your IP address are not stored.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) – for product improvement.
TelemetryDeck privacy notice: https://telemetrydeck.com/privacy/
3.7 Sharing to Instagram
When you share an image to Instagram Stories, the app passes this image together with our Meta app ID to the Instagram app (Meta Platforms Ireland Ltd.). Beyond that, the app sends no data to Meta.
Older versions of the iOS app still contain Meta’s software development kit. As long as you use such a version, an app activation event with an anonymous identifier is sent to Meta when the app is opened; this identifier is also passed to RevenueCat (3.4) but no longer forwarded to Meta. Your iPhone’s advertising identifier (IDFA) is not transmitted. Updating to the current version ends this transmission.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
Meta privacy notice: https://www.facebook.com/privacy/policy/
3.8 Content from our content delivery network
The app loads articles, images and app settings via bunny.net (BunnyWay d.o.o., Slovenia). For technical reasons, this involves processing your IP address.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) – delivering the app’s content.
bunny.net privacy notice: https://bunny.net/privacy
3.9 Server and logs
Our server (Fly.io, data centre in Frankfurt) and our database (Neon, Amazon Web Services Frankfurt) process your IP address with every request. We use it briefly to limit the number of requests (protection against abuse) and, on Android, during the first synchronization to detect automated test devices from Google networks; only the result is stored, not the address. Server logs contain the address called (including your device identifier) but no IP addresses, and are deleted after 7 days.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
4. Disclosure of Data to Third Parties
We only share your data with the service providers named in this policy:
Service provider: Fly.io (Fly.io, Inc., USA)
Purpose: Hosting, data synchronization, push notifications
Location: EU (Germany)*
Service provider: Neon (Neon, Inc., USA)
Purpose: Database
Location: EU (Germany)*
Service provider: bunny.net (BunnyWay d.o.o.)
Purpose: Content delivery
Location: EU (Slovenia)
Service provider: Sentry
Purpose: Error reports
Location: EU (Germany)
Service provider: TelemetryDeck
Purpose: Usage analysis
Location: EU (Germany)
Service provider: RevenueCat
Purpose: In-app purchases
Location: USA*
Service provider: Apple (iOS)
Purpose: Push services, App Store
Location: USA*
Service provider: Google (Android)
Purpose: Push services (Firebase Cloud Messaging), Google Play
Location: EU / USA*
Service provider: Meta (iOS only)
Purpose: Advertising campaign measurement (older versions of the iOS app only)
Location: EU / USA*
*For data transfers to the United States, and for providers based in the United States even where the data is stored in the EU, we rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5. Storage Duration
- Plant entries: Until you request deletion (including after you uninstall the app)
- Plant combos: Only on your device, until you delete them or uninstall the app
- Device identifier: On your device until the app is uninstalled (on Android also in the Google device backup); on our server until deleted on request
- Push token: Until Apple or Google report it as invalid (e.g. after the app is uninstalled) or until deleted on request
- Time zone, language and log of sent reminders: Until deleted on request
- Server logs: 7 days
- Error reports: 90 days
- Analytics data: Pseudonymised, kept according to TelemetryDeck's retention periods
6. Your Rights
Under the GDPR, you have the following rights:
- Access (Art. 15 GDPR): You may request information about the data stored about you.
- Rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
- Erasure (Art. 17 GDPR): You may request the deletion of your data.
- Restriction (Art. 18 GDPR): You may request the restriction of processing.
- Data portability (Art. 20 GDPR): You may receive your data in a machine-readable format.
- Objection (Art. 21 GDPR): You may object to processing.
- Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent you have given at any time.
To exercise your rights, contact us at: support@eat30plants.app. As the app has no accounts, please quote your device identifier (see 3.1).
7. Right to Lodge a Complaint
You have the right to complain to a data protection supervisory authority. The authority responsible for us is:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at
8. Data We Do NOT Collect
For clarity: the app does not collect:
- Names, email addresses or contact details
- Location data
- Camera access or read access to your photos (on iOS, the app can save an image for sharing to your photo library at your request)
- Data from Apple Health or Health Connect
- Contacts or calendar entries
- Advertising identifiers (IDFA on iOS, advertising ID on Android)
9. Data Security
We use technical and organizational measures to protect your data:
- Encrypted transmission (HTTPS/TLS)
- Secure storage on your device
- Regular security updates
10. Changes to this Privacy Policy
We reserve the right to amend this privacy policy to reflect changes in the legal situation or changes to the app. You can always find the current version at the link provided in the app.
11. Contact
If you have any questions about data protection, you can reach us at:
MvG Mehr vom Guten OG
Email: support@eat30plants.app