Privacy

On your iPhone

Your photos, cards, care records, plans and your chats with the companion are stored on your iPhone. If iCloud is on for this app, Apple keeps a copy in your private iCloud database, which we cannot read.

Naming a plant runs on the iPhone. The photo does not leave the phone for that.

There is no account. The app makes a random install token on first use. It identifies this install and nothing else, and goes with every request to our server.

To find your district, the app asks for your location when you start a walk or tap Find in Settings. Apple's map service turns it into a district name; the app keeps that name only, never the exact place. For paid care plans the app asks Apple's weather service for your district's forecast.

Know your street

The game asks for your location with reduced accuracy only, the first time you open it and only when you choose Use my area. The app rounds the position to a square of 0.1 degrees (about 10 km) before anything leaves the phone and keeps only that square, never the exact place.

To find the commonest plants there, the app sends that square to GBIF, the Global Biodiversity Information Facility (secretariat in Copenhagen, Denmark), which answers with species counts from public records. GBIF receives a rounded grid cell, not the exact position, and no install token. The answer stays in the app's cache for 30 days.

The photos come from iNaturalist, a US nonprofit: research-grade photos under CC0, CC BY or CC BY-SA, each shown with the photographer's name. The app asks iNaturalist by species only and sends no location. At most 3 photos per species stay in the cache. GBIF and iNaturalist see your IP address, as any website does.

Without your area, or offline, the game uses the plant list bundled for your region and sends nothing. Your answers stay on your iPhone and in your private iCloud.

Learning from confirmed names

When you keep a plant under a species name, or choose its name yourself, the app stores the photo's image fingerprint with that name: 768 numbers the on-device model computes from the photo. The photo cannot be rebuilt from them. They stay on your iPhone and in your private iCloud and help the app name that plant next time. Settings, Learning shows how many there are and clears them.

Help Tulpi learn is on unless you turn it off in Settings. Then, for a confirmed name only, the app sends the fingerprint, the scientific name and your country (for example DE) to our server, and once a day asks for the shared averages of your country. Never the photo, never your location or district. Nothing is sent before the app has shown you one line about it.

Why: when at least three different installs confirm the same name, the server averages their fingerprints into one per species and shares it with every install, so the app names plants better for everyone. This is our legitimate interest in improving recognition (GDPR Art. 6(1)(f)); you can object at any time by turning the switch off.

Retention: the server stores each fingerprint with the name, the country, the day and a one-way hash of the install token (for the daily limit), never the token itself. Fingerprints are deleted after 12 months; the averages made from them hold no install and are kept as long as the app runs. Turning the switch off stops all sending at once.

Sent only with your consent

AI explanations: when you have allowed them and ask why a plant is what it is, the app sends one photo, resized and without location or other metadata, the names the on-device model suggested, your region, the season and your language.

The companion (paid): when you have allowed it and send a question, the app sends up to the last 30 messages of the chat, your language and short facts about up to 20 of your garden plants: name, place, pot size, light, days since the last watering, the plan and an open problem. Never the whole care log. Questions about eating plants, poisoning or first aid are not sent at all.

Sick-plant questions: when you agree and start, the app sends your answers and the plant's name, place, pot size and light.

All three go through our server to Anthropic, a US company, for AI processing in the United States. Anthropic deletes them within 30 days and does not use them to train models.

Our server passes the request on. It keeps no photos and no messages. It counts requests per install token, for the daily limits and to see what each request costs.

You can switch both off in Settings at any time. Nothing is sent after that.

Second opinion

Only when you ask for a second opinion, the photo goes through our server to Pl@ntNet, a European plant identification service run by CIRAD and its partners in France. Pl@ntNet processes it temporarily to name the plant and decides on its own processing as an independent controller. Our server sends no install token and no location with it.

Purchases

You pay through Apple. RevenueCat, a US company, records your purchases and subscription status under a random user ID, so the app knows whether you have a subscription.

If you installed the app from an ad in the App Store (Apple Ads), RevenueCat receives Apple's attribution token, which tells which campaign led to the install. There is no tracking across other apps or websites, and the app never asks for tracking permission.

For the companion, sick-plant questions after the first one per plant, and second opinions beyond three a day, the app sends Apple's signed proof of your subscription to our server, so the server can check it.

Deleting

Settings, Delete everything removes your cards, photos, care records, chats and settings from this iPhone and from your iCloud, and the app makes a new install token. Your subscription stays with Apple; cancel it under Manage subscription.

Under the GDPR you have the right to access, correction, deletion, restriction, portability and objection, and the right to complain to a data protection authority.

This website

tulpi.app sets no cookies, uses no tracking or analytics and loads nothing from other servers; the font and images are served from the same server.

When you visit, the server keeps technically necessary log data (IP address, time, page requested, browser identifier) for at most 14 days to keep the service running and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR.

The plant quiz on the page runs entirely in your browser; your answers are not sent anywhere.