Privacy Policy.

01Controller

We have not appointed a data protection officer, as we are not legally required to do so.

02Our websites

When you visit this website or the Thirsty landing page, our hosting provider processes the technical data your browser sends with every request: IP address, date and time, requested page, referrer, browser and operating system. This is necessary to deliver the website and to keep it stable and secure (Art. 6(1)(f) GDPR). Server logs are deleted after a short period unless an incident requires longer retention to investigate it.

Our websites set no cookies and uses no analytics, tracking or third-party embeds. Fonts and images are served from our own hosting. The plant chat on the landing page is a scripted demonstration; nothing you click there is sent to us or stored.

03Data on your device

Thirsty stores the information you enter (such as your first name, your plants, their locations and care history, your chats with your plants, photos and settings) locally on your iPhone. We do not receive this data unless a feature described below transmits it.

The following features run on the device and do not send data to us: notifications (scheduled locally, no push server), the light check (only the measured value is kept, not an image), the compass and LiDAR room data, and removing a plant's background from its photo.

Weather: if you allow location access, the app requests your approximate location from iOS and retrieves a forecast from Apple Weather. Your location is not sent to us or to our AI providers. Legal basis: your consent via the iOS permission prompt (Art. 6(1)(a) GDPR), which you can withdraw in iOS Settings.

Deleting the app removes the data stored on your device. We cannot restore it.

04AI features

Thirsty uses AI models to identify plants, assess their condition from photos, read care tags, analyse room photos, generate plant portraits and room images, and write your plants' messages and reminders. These features are optional and require your prior consent in the app.

What is sent

Only the content required for the request you trigger or that the app prepares while open, depending on the feature:

• photos you take or select in the app (plants, close-ups, care tags, rooms), reduced in size and with metadata such as location removed;
• your messages to a plant and recent messages from the same chat, your first name, and other household members as a generic label without their names;
• the care data of the plants concerned (such as species, name, room, watering history, chosen voice);
• context such as date, time, weekday, temperatures and compass direction (degrees, not a location).

Before upload, the app attempts to detect and blur faces and people, and replaces addresses, phone numbers and email addresses typed into chats. These safeguards are automated and may not catch everything. Do not photograph other people or enter third-party personal data.

Purpose and legal basis

Providing the AI features you requested, based on your consent (Art. 6(1)(a) GDPR). Reading the device identifier needed for these requests is technically required for the service you requested (§ 25(2) no. 2 TDDDG).

Providers

• Anthropic (Anthropic Ireland, Limited, Dublin, Ireland, and Anthropic, PBC, USA): text, analysis and image recognition.
• Google (Google Cloud EMEA Limited, Dublin, Ireland, and Google LLC, USA): image generation for plant portraits and room images.

Requests pass through our own service hosted on Cloudflare (Cloudflare, Inc., USA). We do not store the content of requests or responses. We use the providers' commercial, paid services, under which they may not use the content to train their models. The providers retain content for a limited period under their terms, generally to detect misuse and meet legal obligations (see section 8).

Withdrawal

You can withdraw consent at any time in the app under You → AI. From then on, no further content is sent. Withdrawal does not affect the lawfulness of processing before it. Without consent, the app works with built-in texts and without photo analysis.

AI output can be inaccurate. See our Terms of Use.

05Service operation and security

To operate our AI service, prevent abuse and keep costs under control, we process with each request: your IP address, a random identifier of your app installation, a verification token from Apple's App Attest service and your subscription receipt (product, period, transaction ID; no payment data). We use them to confirm that requests come from a genuine copy of the app with an active subscription and to enforce usage limits.

Usage limits are counted using hashed values that are deleted after a short period. Technical logs contain no message content or photos and are kept for a few days. For App Attest we keep the installation's public key until you choose "Delete all my data" in the app.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in the security, integrity and economic operation of the service (Art. 6(1)(f) GDPR).

06Apple services and purchases

Downloads, subscriptions and payments are handled by Apple through the App Store under Apple's own privacy policy. We do not receive your name, email address or payment details. Apple may provide us with aggregated statistics and, if you have opted in, crash reports. These do not allow us to identify you.

07Recipients and international transfers

Cloudflare, Anthropic and Google act as our processors under data processing agreements (Art. 28 GDPR). We may engage further processors for hosting and operation of the service where necessary, under the same conditions.

Processing may take place in the United States. Transfers are based on the EU Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 45, 46 GDPR).

We disclose data to authorities only where we are legally obliged to do so.

08Retention

• Content you create in the app: on your device until you delete it or the app.
• AI request content: not stored by us. Our AI providers retain it under their commercial terms, currently generally up to 30 days; content flagged for policy violations, or subject to legal obligations, may be retained longer.
• Technical logs and usage counters: a few days.
• Website server logs: a short period, see section 2.

Where statutory retention periods apply, we retain data for those periods.

09Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to withdraw consent (Art. 7(3)) and to object to processing based on legitimate interests (Art. 21). Contact us at kontakt@schongebaut.de.

Because we do not run user accounts and do not store app content, we generally hold no data we can attribute to you. In that case we are not required to collect additional information solely to identify you (Art. 11 GDPR). Data on your device is under your control.

You may lodge a complaint with a supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

10Age

Thirsty is not directed at children. AI features may only be activated by users aged 16 or older, or with the consent of a parent or guardian.

11Other information

Providing data is neither a legal nor a contractual requirement. Without AI consent, AI features are unavailable. We do not use automated decision-making within the meaning of Art. 22 GDPR.

We may update this policy when our services or the law change. The version published on this page applies. We will inform you in the app of changes that require your consent.