About This Policy This Privacy Policy explains how easyDacha C-Corp (“easyDacha,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you use the easyDacha mobile application and related services (collectively, the “Service”). By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service. This Privacy Policy is incorporated into and should be read alongside our Terms and Conditions. |
Important: GPS Location is Sensitive Personal Information (California) Under the California Privacy Rights Act (CPRA), precise geolocation data is classified as Sensitive Personal Information. We use your GPS location only to fetch real-time weather data — nothing else. We do not sell or share your precise location for advertising. California residents have the right to limit our use of Sensitive Personal Information to the purposes described here. See Section 11.2 for how to exercise this right. |
We Do Not Collect Full payment card numbers, CVV, or bank account details Social Security numbers or government-issued ID numbers Health or medical information Content of messages in other apps or outside our Service Contact lists or address books Background location (GPS is accessed only while the app is in active use) Personal data from children under 13 (see Section 13) |
Purpose | Data Used | Legal Basis (GDPR) |
Providing the Service: account management, garden plans, care plans, plant database | Account data, garden content, location | Contract Performance |
Personalizing your experience: localized weather, seasonal schedules, care plan timing based on your ZIP code and frost dates | ZIP code, GPS location (if granted), plant selections | Contract Performance / Legitimate Interest |
AI-Assisted Content: generating plant descriptions, care tips, seasonal advice, and visual assets (sprites) displayed in the app. AI is used for content only — we do not use AI to profile individual users or make automated decisions about users. | Plant type, ZIP code / region, garden data (non-identifiable for AI processing) | Legitimate Interest |
Push notifications: task reminders, weather alerts, seasonal tips | Push token, usage data, location | Consent |
Email communications: transactional (receipts, password reset), onboarding, product updates | Email address, account data | Contract Performance / Legitimate Interest |
Marketing emails and campaigns: promotions, re-engagement | Email address, usage data | Consent |
Analytics & product improvement: understanding feature usage, fixing bugs | Usage data, device data, crash logs | Legitimate Interest |
UX research: Session Replay analysis to improve app flows (see Section 5) | Masked screen interaction data | Legitimate Interest |
Mobile attribution: attributing app installs to advertising campaigns (when ads are active) | Device ID (IDFA/GAID) | Consent (ATT on iOS) / Legitimate Interest |
Payment processing and subscription management | Transaction data, subscription status | Contract Performance / Legal Obligation |
Fraud prevention, security, and legal compliance | Account data, device data, IP address | Legal Obligation / Legitimate Interest |
Aggregated research: anonymized, non-identifiable insights about gardening patterns | Anonymized data | Legitimate Interest |
Service | Provider | Purpose | Data Received |
Firebase Analytics | Google LLC | App event analytics and funnel tracking | Device ID, events, session metadata |
Firebase Crashlytics | Google LLC | Crash and error reporting | Device info, OS version, crash stack traces |
Firebase Cloud Messaging (FCM) | Google LLC | Delivery of push notifications | Push notification token |
Firebase Remote Config | Google LLC | A/B testing and feature flags | Device ID, app version |
Firebase Authentication | Google LLC | User account authentication | Email address, auth tokens |
Google Analytics | Google LLC | Web analytics (website visitors) | IP address (anonymized), browser, behavior |
Amplitude Analytics | Amplitude Inc. | Behavioral analytics: events, funnels, retention | User ID, device ID, events, session data |
Amplitude Session Replay | Amplitude Inc. | UX research: masked screen recordings (see Section 5) | Masked interaction sequences, screen flow data |
AppsFlyer | AppsFlyer Ltd. | Mobile attribution: attributing installs to ad campaigns (when paid ads are active) | Device ID (IDFA/GAID), install event data |
Customer.io | Peaberry Software Inc. | Email & in-app messaging: transactional, onboarding, product, marketing, weather alerts | Email address, user ID, behavioral events |
OpenWeatherMap | OpenWeather Ltd. (UK) | Real-time weather data, forecasts, and frost/freeze alerts for your garden location | ZIP code (always); GPS coordinates (only when location permission is granted). No personal identifiers are transmitted. |
Stripe | Stripe Inc. | Payment processing (web / direct purchases) | Payment card data (handled entirely by Stripe; easyDacha does not receive card details) |
Apple In-App Purchase | Apple Inc. | Payment processing (iOS subscriptions) | Transaction data (handled by Apple) |
Google Play Billing | Google LLC | Payment processing (Android subscriptions) | Transaction data (handled by Google) |
How Session Replay Works Session Replay records the sequence of screens and interactions (taps, scrolls, navigation) a user takes during an app session. It does NOT capture: The actual text you type (all input fields are masked / replaced with ■■■) Your email address, username, passwords, or any credentials Content from other apps or outside our Service The following screens are excluded from Session Replay recording entirely: Payment and subscription screens Account settings and profile screens Any screen containing personal data fields What IS recorded: Which screens you visit and in what click Tap locations (shown as dots, no content captured) Scroll depth and navigation patterns |
Type | Examples | Consent Required? | How to Opt Out |
Transactional | Registration confirmation, password reset, subscription receipts | No — required for Service | Cannot opt out (required for account function) |
Product / Onboarding | Getting started tips, feature announcements, care plan reminders | No — Legitimate Interest | Unsubscribe link in email or contact support |
Weather Alerts | Frost warnings, extreme heat alerts affecting your plants | No — Legitimate Interest | Unsubscribe link in email or contact support |
Marketing | Promotions, discounts, seasonal campaigns, re-engagement | Yes — explicit consent required | Unsubscribe link in email or contact support |
In-App Messages | Feature tips, announcements, survey prompts within the app | No — Legitimate Interest | Contact support to disable in-app messaging |
We Do Not Sell Your Personal Data easyDacha does not sell your personal information to third parties for money. We do not sell data to data brokers, advertising exchanges, or lead generation companies. We do not share personal information with third parties for their own direct marketing purposes. (California residents: this is our disclosure under Cal. Civ. Code §1798.83 — the “Shine the Light” law.) When we run advertising campaigns, we may “share” limited device identifiers with AppsFlyer (see Section 4). California residents have the right to opt out of this sharing (see Section 11.2). Nevada residents: we do not sell your covered information. To submit a Nevada opt-out request (NRS 603A), contact [email protected] — Subject: “Nevada Privacy Request.” |
Technology | Used In | Purpose | Can You Opt Out? |
Session cookies | Website | Maintain your login session | Yes — browser settings |
Analytics cookies (Google Analytics) | Website | Understand visitor behavior on the website | Yes — browser settings / Google opt-out |
Device identifiers (IDFA, GAID, IDFV) | Mobile App | Analytics, attribution, personalization | Yes — device settings (see Section 4) |
Firebase Installation ID | Mobile App | App instance identification for analytics and FCM | Limited — tied to app installation |
Local storage | Mobile App | Store app preferences and cached data locally on device | No — cleared by uninstalling app |
Data Category | Retention Period | Reason |
Account & profile data | For the duration of your account; deleted within 30 days of account deletion request | Service provision |
Garden plans, plant data, care notes | For the duration of your account; deleted within 30 days of account deletion | Service provision |
User-Added Plant photos selected for Shared Library | Indefinitely (post-deletion, if selected — see Terms §5.2) | License rights granted by user |
Analytics events (Firebase, Amplitude) | 13 months from collection (Firebase default); 12 months (Amplitude) | Product improvement |
Session Replay recordings (Amplitude) | 90 days from recording date | UX research |
Crash & error logs (Crashlytics) | 90 days from collection | Bug resolution |
Email engagement data (Customer.io) | Duration of account; deleted within 60 days of account deletion | Communication management |
Payment & transaction records | 7 years from transaction (U.S. tax law requirements) | Legal obligation |
Communication records (support emails) | 3 years from last interaction | Legal compliance / dispute resolution |
Inactive account data | 24 months of inactivity, then deletion per our Terms §14 | Data minimization |
Response Timelines Acknowledgment of request: within 10 business days Substantive response: within 45 calendar days Extension (if needed): additional 45 days with prior notice to you |
Right to Appeal If we decline your privacy rights request, you may appeal our decision. To appeal: reply to our denial email with the subject “Privacy Request Appeal — [Your Name]” and explain why you believe your request should be granted. We will review your appeal and respond within 60 days. If your appeal is denied, you may contact your state’s Attorney General or applicable supervisory authority. This appeal right applies to residents of Virginia, Colorado, Connecticut, Texas, and other states whose privacy laws require it. |
easyDacha C-Corp — Privacy Contact General Privacy Questions: [email protected] California Privacy Requests (CCPA/CPRA): [email protected] Subject: “California Privacy Request — [Request Type]” Other State Privacy Requests: [email protected] Subject: “Privacy Request — [State] — [Request Type]” Privacy Request Appeals: [email protected] Subject: “Privacy Request Appeal — [Your Name]” Session Replay Opt-Out: [email protected] Subject: “Session Replay Opt-Out — [Your Name]” Do Not Share (CPRA / GPC): [email protected] Subject: “Do Not Share My Personal Information — [Your Name]” Nevada Privacy Request (NRS 603A): [email protected] Subject: “Nevada Privacy Request” DMCA Copyright Notices: [email protected] (DMCA-1065270) |
Brazil Privacy Request (LGPD) [email protected] "Brazil Privacy Request — [Request Type]" Canada Privacy Request (PIPEDA / Quebec) [email protected] "Canada Privacy Request — [Request Type]" Australia Privacy Request (Privacy Act) [email protected] "Australia Privacy Request — [Request Type]" Mailing Address: easyDacha C-Corp 23253 E Ida Pl, Aurora, CO 80015 United States |