Privacy policy

Who we are

Gróa is a plant doctor: you photograph a plant and she tells you what it is, what is wrong with it and what you can do. Gróa is run by Helgi Þór Jóhannsson, a sole trader, kennitala 040292-3229, Hraunbær 34, 810 Hveragerði, Iceland. He is the controller of your personal data under data protection law.

Write to support@vaki.chat about anything on this page.

Without an account

You can photograph a plant and get a diagnosis without signing in. The photo goes to Kindwise to be identified (see below), but Gróa does not keep it. What is kept is the result, filed under a fingerprint (a hash) of the photo rather than under you, so the same photo is not identified and paid for twice.

To keep costs in check, Gróa counts how many identifications are made each day from each network (IP) address. The address itself is not stored, only a hash of it mixed with the date, and the counts are deleted after three days.

What we keep when you have an account

All of this is in Gróa's database at Cloudflare (D1), except the photos themselves, which are in a photo store at Cloudflare (R2) in a folder for your account.

• Your account. Your email address, language, how much explanation you want, whether you allow photos to be used for training and when you were asked, whether you want reminder emails, when Gróa Pro runs until, your credit balance, and when the account was created and last used.
• Your plants. The names you give them, species and common name, where they stand, when they were watered and fed, and their history: identifications, diagnoses, notes, waterings and whatever else has happened.
• Treatments. The steps of a treatment course with their dates, whether each is done and whether a reminder was sent.
• Your conversations with Gróa. What you write and what she answers, which library entries the answer was based on, and for a photo sent in the chat, the species it was identified as and the identification service's report.
• Photos you save. The image itself, and a record of it: which plant, its size, the species, how that name was arrived at, how confident the identification was, and whether the photo may be used for training.
• Signing in. Sign-in links, which work once for 20 minutes and are stored with your email address, and sessions, which are a random identifier that lasts 90 days from when you last used the app.
• Subscription. If you buy Gróa Pro: Paddle's identifiers for the subscription and for you as a customer, its status, when the paid period ends and whether a cancellation is scheduled. Never your card number.
• Credits. Each credit you have earned, what for, and with which photo.
• Feedback. If you rate an answer or send us a message: the vote or the message, which answer it was about, your account if you are signed in or a random identifier for the browser tab if not, and an email address if you give one. Messages are also emailed to the owner.

We do not ask for your location and do not collect it. The database has room for a rough latitude, for the daylight calculations, but nothing in the app fills it in today, and Reykjavík is used for everyone.

Who else sees it

• Kindwise. The identification service that names the plant and assesses its health. Every photo you send to be identified, on the home screen or in the chat, goes to Kindwise, whether or not you are signed in and whether or not you have allowed training. Kindwise's terms give them a non-exclusive, unlimited and irrevocable licence to use photos from our users for machine learning, and allow them to publish those photos under a CC BY-SA licence. Their terms say faces are blurred. Gróa does not alter your photos before sending them, and sends neither your name nor your email address with them. This is the most important thing on this page: do not send a photo of anything you would not want published.
• Anthropic. Gróa's answers are written by Claude, an AI model run by Anthropic in the United States. When you ask Gróa something, your question, the conversation so far, your plant's name, species and history, and the identification service's report are sent to Anthropic to write the answer. The identification service's English text is also sent to Anthropic to be translated into Icelandic; that text is about the plant, not about you. Photos are not sent to Anthropic.
• Cloudflare. Hosts the app, the database and the photos, and sends our email, sign-in links and reminders, from groa@send.vaki.chat. Cloudflare runs data centres around the world, including in the United States, and the database and photo store have not been restricted to Europe.
• Google. If you sign in with Google, Google tells us your email address and that it is verified. In the Android app you pick the Google account in your phone's own account picker, and we receive the same information. We keep nothing else from Google.
• Paddle. Paddle.com Market Ltd sells Gróa Pro on our behalf and takes the payment. We send Paddle your email address and your account identifier when you start a checkout. You enter your card details with Paddle and they never pass through Gróa. Paddle's own privacy notice covers what Paddle keeps.

Anthropic, Cloudflare and Google are in the United States. Transfers there rely on the safeguards those companies provide under the GDPR, such as standard contractual clauses.

We do not sell your information and do not use it for advertising. There are no ads and no third-party analytics in the app.

Your photos and our own model

Gróa is building her own identification model. If you say yes, photos you save from then on may be used to train it. Photos you sent before you said yes are not used. Only photos whose species a person confirmed or chose are eligible, never ones labelled by a model alone. The photos are copied from the photo store to the owner's own computer, where the model is trained.

You can withdraw at any time in settings, and the permission is then removed from every photo you have ever sent. A photo already copied into the training set before you withdrew is not yet removed from it automatically: write to us and we will remove it. A model that has already been trained cannot forget a single photo, but a photo that has been removed is not used in the next round of training.

This is separate from Kindwise. Saying no here changes nothing about what Kindwise receives when you ask for an identification.

Email

We email you the sign-in links you ask for, and a reminder on the day a step of a treatment is due. Every reminder has a link to stop them, and a switch in settings does the same. The reminders stay on your plants screen either way. We send no marketing email.

Cookies and browser storage

Gróa sets up to three cookies, and all are needed for what you asked for:

• groa_session. Keeps you signed in. It holds a random identifier and nothing else, and lasts up to 400 days in your browser; the session behind it ends after 90 days without use.
• groa_oauth. Set for up to 10 minutes while you sign in with Google, to protect that sign-in against forgery.
• groa_app. Set only when the site is opened from the Gróa Android app, to remember that. It holds the word "play" and nothing else, and lasts up to a year.

In your browser's own storage, which is not sent to us, there are these keys:

• groa:theme. Remembers whether you chose light or dark.
• groa:returnTo and groa:carry:. Hold where you were going and the diagnosis you had when you left to sign in, so it is not lost. They are removed when you come back signed in.
• groa:result:, groa:photo: and groa:noask:. Hold your latest diagnosis and photo while the tab is open, so the screen survives a reload.
• groa:voter. A random identifier for the tab, so a vote on an answer can be changed without signing in.
• groa:reloaded-for-stale-build and groa:stats. Prevent a reload loop after an update, and hold the owner's key to a statistics page only he uses.

The keys tied to the tab are gone when it is closed. No advertising or tracking cookies. The checkout page loads Paddle's own script, which may store its own data under Paddle's privacy notice.

Why we are allowed to

• Contract, Article 6(1)(b) of the GDPR. Your account, your plants, identifications, answers, reminders for a treatment you started, and the subscription. The service you asked for cannot be provided without them.
• Consent, Article 6(1)(a). Using your photos to train Gróa's model. You can withdraw it at any time in settings.
• Legitimate interests, Article 6(1)(f). Security, preventing abuse and keeping costs in check with daily counts, and keeping identification results so they are not paid for twice. You can object to this and we will stop unless there are compelling grounds not to.

How long we keep it

• Account, plants, history, conversations and saved photos. Kept until you delete your account. Nothing is deleted for inactivity.
• When you delete your account. Everything above is deleted at once from the database and the photo store, and an active subscription is cancelled. Cloudflare's database keeps a recovery history for up to 30 days, so deleted rows can survive there that long before they are gone for good.
• Sign-in links and sessions. A link stops working after 20 minutes and is deleted a day later. A session is deleted the moment you sign out, and expired sessions are deleted by a daily clean-up.
• Identification results and reports kept against a diagnosis. Not linked to your account. Deleted after 30 days by a daily clean-up. Translations of general advice are kept, because they are not about anybody.
• Daily counters. The ones that hold back abuse (how many identifications one network address gets a day, without the address itself being kept) are deleted after three days. Anonymous totals (a day, a name and a number, nothing about anybody) are kept.
• Photos in the training set. See the section about our model above.
• Error logs. When something fails the app writes an error to a log at Cloudflare, and it can contain an email address, for example when a reminder could not be delivered. Cloudflare keeps these logs for a limited time and only the owner can see them.

Your rights

Under the GDPR you have the right to:

• Access and a copy. In settings, "Download my data" gives you everything Gróa keeps about you in one file, with a list of your photos and where to fetch each one.
• Have it deleted. In settings, "Delete account" deletes everything at once, as described above. Instructions, including if you cannot sign in: groa.vaki.chat/en/eyda-adgangi.
• Have it corrected. You can rename your plants in the app; for anything else, write to us.
• Object, restrict processing, and withdraw consent. Consent to training is withdrawn in settings; for anything else, write to us.
• Complain. If you are not satisfied with our answer you can complain to Persónuvernd, the Icelandic Data Protection Authority, personuvernd.is.

Write to support@vaki.chat. We answer within a month.

Automated decisions

Gróa identifies plants and answers questions. She makes no decisions about you that have legal effects.

Changes

If this changes we will update this page and the date at the top.