Legal

Privacy Policy

Last updated: October 6, 2026

The short version: we only collect what the app needs to care for your garden, we never sell your data, and you can delete everything at any time.

Nifty Norbot ("we", "us", or "our") operates the niftynorbot.com website and the Nifty Norbot mobile application (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this policy. Your use of the Service is also governed by our Terms of Use.

1. Information We Collect

Account Information

We use Clerk to handle authentication. When you create an account, Clerk stores your email address, name (if provided), and any social identity tokens you authorize (for example, Sign in with Apple or Google). Passwords are never stored by us directly.

Garden and Plant Data

To provide the Service, we store information you add about your garden, including but not limited to: plant names and species, watering schedules, notes you write, hardiness zone, watering preferences, and reminder configurations.

Photos

Photos you take of your plants — whether you are asking Norbot to identify one or showing it a problem in Chat — are never stored. A photo is sent to our AI service (see “Third-Party Services” below) for the single request it informs and is then discarded. We keep no copy on our servers, in our database, or in any storage of our own, whether you sent it for a plant identification or in Chat. Within the app, a photo stays on screen only while you are still working with it — until you dismiss it, or until the conversation you sent it in ends. Files your device's own camera or photo picker keeps are outside our control.

Conversations with Norbot

Most of what you say to Norbot is not stored at all. A conversation is a single sitting: it lives on your device while you are having it, and it is gone when you start a new conversation or close the app.

We do keep a conversation when Norbot does something lasting in it — when it creates a task for you, or saves a memory about your garden because you asked it to. We call that a stored conversation: it is held on our servers so that the task or memory it produced can show you where it came from, and so you can pick it back up on any of your devices. What we store is the messages you and Norbot exchanged; if an exchange included a photo, we record only that one was attached, never the image. A stored conversation is reachable only from the task or memory that produced it — there is no chat history list — and it is deleted as described under “Data Retention” below.

Device and Push Notification Tokens

When you enable push notifications, we store an anonymous Expo push token that lets us deliver watering reminders and gardening advice notifications to your device. We also collect basic device information (device type, OS version) required for push delivery.

Usage and Diagnostic Data

We may collect logs of API requests (such as timestamps, endpoints accessed, and error messages) to operate, secure, and debug the Service. This data is retained only as long as needed for these purposes.

Analytics

The app records how it is used so we can tell which parts of Nifty Norbot help and which do not: for example, that you opened the app, read your daily advice, added a plant or checked off a task. These product-interaction events are linked to your account, so we can see how one person’s use changes over time. They are sent to our analytics provider, PostHog (see “Third-Party Services” below). We do not use them for advertising and we do not share them with advertisers.

Analytics events never include what you write or what Norbot writes: not your chat messages, the advice Norbot gives you, the memories it keeps, or your notes. They never include the names you type for your plants, your photos, web addresses or links, your email address, or your location. For location we record only whether you have set one, never where it is. The app does not record your taps or the text on your screen.

Our analytics provider does not store your IP address, and we do not use it to determine your location. Analytics events carry no location information.

2. How We Use Your Information

• To provide, maintain, and improve the Service.
• To authenticate you and secure your account.
• To generate personalized gardening advice and identify plants.
• To show you where a task or memory came from, by keeping the conversation Norbot created it in.
• To send watering reminders and advice notifications you enable.
• To diagnose technical issues and prevent abuse.
• To communicate with you about important account or Service changes.

We do not sell your personal information, and we do not use your data for advertising.

3. Third-Party Services

We rely on the following trusted third-party processors to operate the Service. Each has its own privacy practices:

• Clerk — authentication and user identity management. Clerk Privacy Policy
• Microsoft Azure — cloud hosting for our backend services and database. Microsoft Privacy Statement
• Anthropic — AI provider (Claude) used to generate gardening advice and analyze plant photos. Plant data and images may be sent to Anthropic when you request AI features. Anthropic Privacy Policy
• Expo / Apple Push Notification Service / Firebase Cloud Messaging — delivery of push notifications to your device. Expo Privacy Policy
• PostHog — product analytics (see “Analytics” above), hosted in the United States. Receives product-interaction events linked to your account. PostHog Privacy Policy
• Sentry — crash and error reporting. When the app or our backend hits an error, Sentry receives a report of it, which can include your device type, OS version, app version and account identifier. Sentry Privacy Policy
• RevenueCat — subscription management. It receives your account identifier and your App Store or Google Play purchase and subscription history, so the app knows what you have access to. On iOS it also receives Apple’s attribution token, which tells us whether you installed the app from an Apple Search Ads campaign; this is not used to track you across other companies’ apps or websites. RevenueCat Privacy Policy

4. Data Retention

We retain your account information and garden data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law (for example, basic transaction logs for security and fraud prevention).

Stored conversations (see “Conversations with Norbot” above) are held on a narrower footing than the rest of your garden data. We never delete one because of how old the conversation is; instead, a stored conversation is deleted whenever any of the following happens:

• You delete it. Every stored conversation carries a delete control on the screen where you read it. The task or memory that came out of it survives — only the conversation goes.
• Nothing refers to it any more. A stored conversation is kept only for the sake of the tasks and memories that came out of it, and those are the only way back to it. When you delete the last one pointing at it, we delete the stored conversation too.
• The task it produced is done. A task you have checked off leaves your task list, and two days after you checked it off it no longer counts as a way back to its conversation. After that, if nothing else still leads back to the conversation — a task that is still open or was checked off in the last two days, or a memory — we delete it the next time you check off or delete a task, or add one from your daily brief. The task itself stays — only the conversation goes. If you stop using tasks, the conversation stays stored until you delete it or your account.
• You delete your account. Deleting your account purges your stored conversations immediately, rather than within the 30-day window described above.
• Usage analytics. When you delete your account, we immediately ask our analytics provider, PostHog, to delete your usage history and your analytics profile, and the app stops sending usage data. PostHog removes that data in the background; it does not commit to a completion time, so we cannot promise the 30-day window above for it.

5. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and associated data.
• Export a copy of your garden data.
• Withdraw consent for push notifications at any time via your device settings.

To exercise any of these rights, contact us using the details in Section 10. If you are located in the European Economic Area, the United Kingdom, or California, you may have additional rights under GDPR, UK GDPR, or the CCPA/CPRA respectively, including the right to lodge a complaint with a supervisory authority.

6. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

7. Security

We use industry-standard measures to protect your information, including encrypted connections (HTTPS/TLS), encrypted storage of sensitive tokens on your device via the operating system secure storage (Keychain on iOS, Keystore on Android), and access controls on our backend. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

8. International Data Transfers

Our servers and third-party processors are primarily located in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. or other countries. By using the Service, you consent to these transfers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you through the Service. Continued use of the Service after a change indicates acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Email: maxkpat@gmail.com
Website: niftynorbot.com