Privacy Policy

1. Who we are

Mist & Soil is operated by ClickWebstudio Inc. (“we”, “us”). We make a mobile app that helps people identify, water, and care for houseplants.

Reach the privacy team by email.

2. What we collect

We collect only what we need to make the app work.

• Account basics. When you sign in with Apple or Google, we receive a stable user identifier, your name (if you choose to share it), and your email address. We use these to create your account and to attribute your community posts.
• Plant data. The plants you add, their nicknames, rooms, watering history, and any journal entries or photos you save. This stays on your device and (if you sign in) syncs to our server so you can restore it on a new phone.
• Photos you submit for analysis. When you ask the AI Plant Doctor to identify a plant or diagnose a problem, the photo is sent to our processing pipeline. We do not store these photos on our servers after the response is returned.
• Subscription receipts. Apple shares purchase receipts with us so we can grant the right entitlement. We do not see your payment method or card.
• Crash & performance logs. Anonymized diagnostics that help us fix bugs. No personal content.

We do not collect your location, your contacts, your photo library outside of photos you explicitly attach, or any data for advertising.

3. How we use it

• To run the app: identify plants, schedule reminders, sync your garden across devices, post to community.
• To honor your subscription and respond to support requests.
• To detect and prevent abuse of the AI Doctor (rate-limiting, spam protection).
• To improve the product through anonymized, aggregated usage statistics.

We do not sell your data. We do not share your data with advertisers or data brokers. Ever.

4. Who we share with

We share only the minimum required, only with the following processors:

• Apple and Google — for Sign in with Apple / Google authentication. We receive their user identifier; they do not receive your plant data.
• Google Generative AI (Gemini) — for plant identification and diagnosis. Photos you submit are sent to Gemini for analysis and discarded after the response.
• Our hosting provider (Hetzner, Germany) — where our server and database run.

Each processor handles data on our behalf under their own contractual and security commitments.

5. Where it lives, how long

Account, plant garden, and community posts are stored on servers in the European Union. We keep them for as long as your account is active, plus a 30-day grace period after deletion in case you change your mind.

Anonymized crash and usage logs are retained for 90 days.

6. Your rights

You can:

• See everything we have about you — email us and we will export it.
• Correct anything that’s wrong — rename plants, edit posts, or email us.
• Delete your account — from Profile → Account → Delete, or by emailing us. We will delete your data within 30 days.
• Object to processing, or restrict it — email us and tell us how.

Residents of the EU, UK, and California have additional rights under GDPR / UK GDPR / CCPA. To exercise any of these, email us.

7. Children

Mist & Soil is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has signed up, email us and we will delete the account.

8. Security

We use HTTPS everywhere, store passwords as one-way tokens (when applicable), keep our servers patched, and review our code for the OWASP Top 10. No system is bulletproof; if we discover a breach affecting your data, we will notify you within 72 hours of confirmation.

9. Changes to this policy

We will post material changes here and, for significant changes, notify you inside the app at least 14 days before they take effect.

10. Contact

Questions, concerns, or want to invoke a data right? Write to us. We answer within 5 business days.