Privacy
Policy.

01 Information we collect

Account and profile information

We collect information you provide when creating or managing an account, including:

• name and email address;
• authentication method and provider;
• optional profile photo;
• account, notification, and subscription preferences; and
• support, privacy, and account requests you send to us.

If you sign in using Apple or Google, that provider supplies the account information permitted by you and handles your sign-in under its own privacy policy.

Plant and pot information

We collect the information you add about your plants and pots, such as pot names, plant profiles, care settings, automation thresholds, and the date a plant profile was assigned to a pot.

Sensor, watering, and connected-device information

A connected Chlora pot may send:

• pot and device identifiers;
• soil-moisture readings;
• light measurements;
• tank level;
• temperature and humidity, where supported;
• watering events, duration, trigger type, and moisture before or after watering;
• last-seen and connectivity status;
• automation and manual-watering commands;
• hardware and firmware versions;
• firmware update target, check, download, installation, rollback, confirmation, and error status; and
• timestamps and technical event details needed to operate and troubleshoot the device.

The pot performs ordinary sensing and automated watering locally. Cloud synchronization enables remote status, notifications, insights, support, commands, and firmware management.

Wi-Fi and local-network information

During setup, Chlora may read the current Wi-Fi network name or scan nearby Wi-Fi networks. On iOS and Android, the operating system may classify this as location, nearby-device, Wi-Fi, or local-network access.

Chlora does not use this permission to create a precise-location history. The selected Wi-Fi network name may be saved with the pot. The Wi-Fi password is sent directly from the mobile device to the pot over the local setup connection and is not stored in the Chlora cloud. The pot retains network credentials until they are replaced or the pot is factory-reset.

Photos

If you choose a profile photo, Chlora uploads a resized copy to avatar storage. Profile avatars are served through a public image URL so they can be displayed in the app. Do not use a sensitive image as your avatar.

If you use plant identification, the selected camera or photo-library image is transmitted through Chlora’s cloud function to Anthropic for analysis. Chlora stores the resulting plant name, scientific name, confidence, and matched profile information. Chlora’s application database does not intentionally retain the submitted identification image.

AI, insights, and conversations

When you use Chlora AI, Talk to your plant, plant identification, or weekly insights, we may process and retain:

• your questions and recent conversation context;
• generated replies and insights;
• helpful/not-helpful feedback;
• pot and plant names;
• your first name, where available, to personalize a reply;
• relevant sensor values and reading timestamps;
• plant-care settings and knowledge references;
• model and error information; and
• the context and prompts used to generate an answer or insight.

Do not include sensitive personal information in AI prompts.

Notifications and service email

If notifications are enabled, we collect a Firebase Cloud Messaging token, device platform, timezone, and notification preferences. We also maintain in-app notification messages and delivery-related information.

If you enable an email digest or contact us, we process your email address, email content, and ordinary delivery metadata needed to send and respond to service messages.

Subscription and transaction information

Apple processes Chlora+ purchases through the App Store. Chlora does not receive or store full payment-card details. We receive product, transaction, subscription-status, and expiration information needed to verify purchases, restore access, prevent fraud, and maintain your membership tier.

Technical information

Our infrastructure and providers may automatically process IP address, request time, app and operating-system information, function or network errors, and similar logs needed for security, delivery, and troubleshooting. Chlora does not currently use this information for third-party advertising.

02 How we use information

We use information to:

• create, authenticate, and secure accounts;
• connect, provision, operate, and support smart pots;
• display sensor readings and plant status;
• automate and record watering;
• send device commands and notifications;
• provide signed over-the-air firmware updates and staged firmware rollouts;
• provide Chlora+, subscriptions, purchase restoration, and entitlement checks;
• provide plant identification, AI conversations, insights, and weekly digests;
• save preferences and synchronize the Services;
• answer support and privacy requests;
• diagnose failures, maintain safety, and improve reliability and feature quality;
• prevent abuse, fraud, and unauthorized device access; and
• comply with applicable law.

Where applicable, we rely on one or more of the following legal bases:

• Contract: processing needed to provide the Services you request.
• Consent: optional permissions, communications, or processing where consent is required.
• Legitimate interests: operating, securing, troubleshooting, and improving Chlora while respecting your rights.
• Legal obligation: complying with tax, accounting, consumer-protection, law-enforcement, or other legal requirements.

03 How we disclose information

We disclose information only as needed to operate Chlora:

• Supabase — authentication, databases, storage, realtime synchronization, and server functions.
• Google Firebase — push-notification token management and delivery.
• Apple and Google — sign-in, when you select the corresponding provider.
• Apple — App Store subscriptions, billing, transaction verification, and purchase restoration.
• OpenAI — AI conversations, embeddings, care responses, and insights.
• Anthropic — plant-image identification and plant-profile assistance.
• Resend — service and digest email delivery.

These providers process information under their own terms and privacy commitments. The specific data sent depends on the feature you use.

We may also disclose information:

• when required by law or valid legal process;
• to investigate fraud, abuse, safety, or security incidents;
• to protect users, Chlora, or others; or
• in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards and notice where required.

04 Firmware and device security

Chlora provisions each pot with a device identifier and credential used to authenticate cloud requests. The cloud stores a hash of the device credential rather than the plaintext credential. Firmware artifacts are kept in private storage and provided through short-lived signed links. Chlora records firmware version and update events to manage compatibility, staged rollouts, failures, and recovery.

Removing a pot from the app does not necessarily erase credentials already stored in the physical pot. When transferring, selling, returning, or disposing of a pot, use the factory-reset function while the pot is reachable or contact us for help.

05 Retention

We apply the following current retention practices:

• sensor readings older than 90 days are automatically deleted;
• in-app notifications older than 30 days are automatically deleted;
• account, profile, pot, watering, device, firmware, subscription, AI, identification, and insight records are generally retained while your account or connected pot remains active;
• support and transactional records may be retained as needed to resolve requests, prevent fraud, maintain security, or satisfy legal obligations; and
• infrastructure logs and encrypted backups may remain for limited operational or disaster-recovery periods.

After a verified account-deletion request, we delete or de-identify associated personal information within 30 days, subject to legal, security, fraud-prevention, and backup exceptions. Data already aggregated or de-identified so it can no longer reasonably identify you may be retained.

06 Your choices and rights

You can:

• edit your name and profile photo in the app;
• manage notification categories in Profile → Notifications;
• change app permissions in iOS or Android settings;
• choose whether to submit a photo for plant identification;
• avoid entering personal information into AI prompts;
• cancel or manage Chlora+ through your Apple account; and
• factory-reset a reachable pot before transfer or disposal.

Depending on where you live, you may have rights to request access, correction, portability, deletion, restriction, objection, or withdrawal of consent. You may also have the right to appeal our response or complain to your local data-protection authority.

Self-service export and account deletion are not yet available in the app. To request deletion, use our account deletion page or email info@chlora.io from the email address associated with your account. To request an export or another privacy right, email us from that account address. We may request information needed to verify your identity.

Chlora does not sell personal information or share it for cross-context behavioral advertising. We therefore do not offer a “sale” or targeted-advertising opt-out.

07 Security

We use measures designed to protect information, including encrypted cloud connections, access controls, row-level database security, hashed device credentials, private firmware storage, short-lived download links, and limited-access service credentials.

No method of storage or transmission is completely secure. Please use a strong, unique password, protect access to your email and sign-in provider, and contact us if you believe your account or pot has been compromised.

08 International processing

Chlora and its providers may process information in countries other than your own, including the European Union and the United States. Where required, we rely on contractual and other safeguards recognized by applicable data-protection law.

09 Children

Chlora is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us so we can investigate and delete it.

10 Third-party services and links

The Services may open or interact with third-party services such as Apple, Google, or email applications. Their handling of information is governed by their own privacy policies. Chlora is not responsible for unrelated third-party websites or services.

11 Changes to this policy

We may update this Privacy Policy as the Services, firmware, providers, or legal requirements change. We will update the date at the top and provide additional notice in the app when a change is material.

12 Contact

For privacy questions, rights requests, complaints, or account-deletion requests, contact: