Privacy
Principle: everything that can run on your phone runs on your phone. Anything that leaves it is minimal, anonymous and, where possible, opt-in.
What stays on your device
- Camera frames: analysed live to recognise trees; never stored, never uploaded.
- Your precise location: used only to query the tree database bundled inside the app.
- Chat history: kept locally on your phone.
What leaves your device
| Data | Where | When | Contains |
|---|---|---|---|
| Weather request | Apple WeatherKit or Open-Meteo | automatic | approximate coordinates only, no identifiers |
| Tree chat | lnd.garden servers → AI provider | when you send a message | your messages, the tree's public dataset facts, a one-line weather summary, an anonymous device token |
| Purchase receipt | lnd.garden servers → Apple | after a purchase | Apple's signed transaction, anonymous device token |
| Match telemetry | lnd.garden servers | only if you opt in (off by default) | species guess, confidence, ~1 km grid cell, optional correction. Never photos, never precise location |
The device token
A random identifier created on first launch, kept in your Keychain. It lets free trials, purchased credits and rate limits work with no account, no email, no sign-in. It is not derived from any hardware identifier and links to nothing personal.
Our servers
- Chat content is not logged; quota counters store numbers only.
- Telemetry events are stored without device tokens and without IP addresses.
- Rate-limit counters expire automatically.