Privacy Policy — Vireya

Your plants and their details are stored locally on your device and are also synced to your account in the cloud, so they follow you across devices and aren't lost if you change or reset your phone. This cloud data is stored with Google Firebase — Cloud Firestore for your plant data and Cloud Storage for your photos — hosted in the European Union (region europe-west1, Belgium) under your account identifier.

The data stored on your device and synced to your account includes:

• Plant photos, species, diagnoses, health status and scores, care logs, and dates
• Your chat history with the Dr. Vireya assistant, and generated plant info cards
• Custom plant names, pot details, watering records, and an optional location label

Only you can access this data. Access is tied to your account and enforced by Firebase Security Rules, so each user can read and write only their own plants, photos, and chat — never anyone else's.

By default your account is anonymous (see Section 3); your data syncs to that anonymous account from the start, and signing in makes it durably yours so it carries over to a new device.

Your app preferences — theme, language, notification settings, cached weather, onboarding answers, and your daily AI usage count — are kept on your device only and are not synced to the cloud.

If you delete the App, the local copy is removed; your synced data remains in your account until you delete your account (see Sections 3 and 8).

When you run a diagnosis, the App sends the following to our secure cloud function (hosted on Google Firebase in Europe, region europe-west1), which forwards it to our AI provider (OpenAI, United States) for processing:

• The plant photos for that diagnosis
• Your answers to the follow-up questions
• Your language preference

Likewise, when you chat with the Dr. Vireya assistant, the messages you send are forwarded through the same cloud function to the AI provider to generate a reply.

This data is sent only to generate your result or reply. Our cloud function does not write it to any database or retain it on our servers — it is processed in transit and then discarded, and our AI provider's API keys are stored securely on the server and are never held inside the App. (The diagnosis result and chat history that you save are stored in your account as described in Section 1 — that is separate from this transient processing.)

Important: Diagnoses and suggestions are for informational purposes only and do not replace professional gardening or horticultural advice.

• By default, the App creates an anonymous account automatically. This requires no personal data — it is only an anonymous identifier so your settings work.
• Signing in is optional. If you choose to sign in (with Apple or Google during onboarding, or with email in Settings), our authentication provider (Firebase Authentication) stores your provider ID and email address, and — the first time you use Sign in with Apple — the display name you choose to share. Signing in also makes your synced data durably yours, so it follows you to a new device.
• You can delete your account at any time from Settings → Delete Account. This permanently removes your authentication record, all of your cloud data (your plants, photos, care logs, and chat history stored under your account), and your local data.

We use Firebase Analytics (Google Analytics for Firebase) to understand how the App is used so we can improve it.

• The custom events we log (for example, onboarding progress and where you heard about us) contain no personal data.
• The analytics SDK also automatically collects standard, non-identifying usage and device information such as an app-instance identifier, device model, operating system, general region, app version, and session data.

We also use the Meta (Facebook) SDK to measure and attribute the performance of our ad campaigns. The following is shared with Meta: device identifiers — the advertising identifier (IDFA) only if you grant iOS's App Tracking Transparency permission, and if you decline, the IDFA is not shared; standard device and usage information such as device model, operating system, and app version; and specific app events: app launch, completing a diagnosis, viewing the subscription screen, and purchases (with amount and currency).

Your plant data, photos, chats, and email address are never shared with Meta. If you decline the tracking permission, the App works exactly the same; measurement continues only through Apple's privacy-preserving aggregated methods (SKAdNetwork).

If you grant location access (used only while you are using the App), your location provides local weather and seasonal care context via Apple WeatherKit and reverse geocoding.

• This location data is sent to Apple, not to Vireya's servers or any other third party.
• Weather results are cached locally on your device.
• You can turn location access off at any time in your device Settings.

We do not sell your data, and we do not show ads inside the App. Data is shared only with the service providers needed to run the App:

• Google / Firebase — anonymous and optional sign-in (Authentication), cloud sync and backup of your plant data and photos (Cloud Firestore and Cloud Storage, hosted in the EU), usage analytics (Analytics), and hosting our diagnosis and chat function (Cloud Functions).
• OpenAI — transient processing of diagnosis photos and answers, and Dr. Vireya chat messages (United States), as described in Section 2.
• Apple — weather and location context (WeatherKit), and subscription payment processing if and when subscriptions are offered (we never see your payment details).
• Meta (Facebook) — measurement and attribution of our ad campaigns (United States): device identifiers (subject to the tracking permission), standard device information, and specific app events including purchases, as described in Section 4.

• Camera — to photograph your plants for scanning and diagnosis.
• Location (while in use) — for local weather and seasonal care suggestions (optional; see Section 5).
• Notifications — to send the care reminders you choose to enable.

Each permission is optional and can be changed at any time in your device Settings.

• App Tracking (optional) — allows the advertising identifier to be used for ad measurement (see Section 4). Declining loses no functionality.
• Add to Photos (optional) — used if you choose to save the shareable plant card to Photos.

Your plant data lives on your device and in your account, under your control. You can:

• View and manage all your plant data directly in the App,
• Delete any plant, which removes its data from your device and your account,
• Delete your account from Settings → Delete Account, which permanently removes your authentication record and all of your cloud data (Firestore and Storage) from our servers,
• Delete the App, which removes the local copy (your cloud data stays in your account until you delete the account).

We retain your synced cloud data for as long as your account exists; when you delete your account, it is permanently removed from our servers.

Depending on your jurisdiction (including KVKK and GDPR), you may also have rights to access, correct, delete, or port personal data, and to object to or restrict processing. To exercise these rights, contact us at info@vireyaai.app.

Vireya is not directed to children under 13, and we do not knowingly collect data from this age group.

We may update this policy from time to time. We will note significant changes within the App or on this page, and the current version's date is shown above.

For questions: info@vireyaai.app

Data controller: Can Çağlar — İstanbul, Türkiye