Privacy Policy

Yellow Door Studios LLC, doing business as Canopy Plant Care (“Canopy,” “we,” “us,” or “our”), provides the Canopy Plant Care iOS application, the Canopy Plant Care website at canopyplantcare.com, the Canopy Pal smart tags and related products, and the back-end services that support all of them (together, the “Service”). This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. Please read it alongside our Terms of Service.

If you have questions or want to exercise any of your rights, contact us at hello@canopyplantcare.com or by mail at Yellow Door Studios LLC, 522 W Riverside Ave Ste N, Spokane, WA 99201-0581.

1. Information we collect

We collect only the information we need to operate the Service. We collect it in three ways: information you provide directly, information collected automatically as you use the Service, and information we receive from third parties.

A. Information you provide

• Account information. Your email address, an internal account identifier, and, optionally, a display name. You provide these when you create an account, either directly or through Sign in with Apple. If you create an account with email authentication, your authentication credentials are handled by our authentication provider and are not stored by us in readable form.
• Plant content. Information about your plants, including nicknames, descriptions, and attributes such as pot type, soil type, and light level.
• Photos. Plant photos and avatars you capture or import. Photos are resized and re-encoded on your device before upload, which removes most embedded metadata (such as location coordinates and capture timestamps) before the file reaches our servers.
• Diary entries, care events, and custom events. Free-form text you enter, optional photos, and the dates you record.
• Chat messages. The text and any image references in your conversations with the in-app AI-powered care assistant.
• Orders and shipping information. When you buy a Canopy Pal or other product from us — online or in person — we collect the information needed to fulfill the order, such as your name, shipping address, and contact details.
• Communications and waitlist. If you contact us, sign up for our waitlist, or opt in to product updates, we collect your email address and the contents of your message.

B. Information collected automatically

• Time zone. The app does not collect device location. Instead, it sends your device’s current IANA time zone on authenticated requests so we can schedule timely push notifications and time-aware care guidance, such as care dates. We do not use this to determine your precise location.
• Device and app identifiers. A per-vendor device identifier used by our subscription and diagnostics providers, and — if you grant notification permission — a push notification token used to send plant care reminders. These identifiers are not used to build advertising profiles.
• Diagnostic information. Crash reports and performance data from our error-monitoring provider, along with technical “breadcrumbs” describing app events such as tag scan attempts and network errors. These help us reproduce and fix problems. They are configured to exclude personal details and are not used to profile your behavior.
• Server activity logs. Our servers record operational information such as a user identifier, a request identifier, and the name of the function being run, so we can monitor and troubleshoot the Service. These logs are designed to exclude credentials, message contents, contact information, and payment details.
• Limited network information. When you claim a Canopy Pal smart tag, we record claim-attempt details, including the request’s IP address when available, solely to limit abuse of the claim process and protect the Service. We also use IP-based signals for security and fraud prevention. We do not use IP addresses for analytics or to infer your location.
• Cookies and similar technologies (website). Our website uses cookies and similar technologies that are necessary to operate the site and to process checkout securely, including those set by our payment processor for fraud prevention. We do not use cookies to track you across other companies’ websites or apps for advertising. See Section 6.

C. Information we receive from third parties

• Sign in with Apple. If you sign in with Apple, we receive an authentication identifier and the email and name you choose to share.
• Subscription state. From Apple’s In-App Purchase system, by way of our subscription-management provider, we receive your current subscription tier, its expiration date, the product purchased, and subscription lifecycle events (such as purchase, renewal, and cancellation) so we can apply the right entitlements.
• Payment confirmation. When you make a purchase, our payment processor confirms that payment succeeded and returns limited transaction details. We do not receive or store full payment card numbers. Apple and our payment processor handle payment information directly.

2. How we use your information

We use the information described above to:

• Create and maintain your account and keep you signed in across sessions.
• Provide the core Service: store and display your plants, photos, diary entries, care events, and chat history; surface your home dashboard; and send care reminders.
• Generate AI assistant responses and AI plant identifications (see Section 3).
• Schedule timely care reminders and time-aware care guidance using your device time zone.
• Determine which features and credit balances are available to you based on your subscription.
• Process purchases, fulfill and ship product orders, and handle returns and support.
• Send push notifications for care reminders when you have granted permission, and send product updates or waitlist emails you have opted into (you can opt out at any time).
• Operate, secure, and improve the Service, including diagnosing and fixing crashes, errors, and performance issues, and preventing abuse and fraud.
• Comply with legal obligations and enforce our Terms of Service.

We do notuse your personal information for advertising, for cross-context behavioral profiling, or to train AI models — ours or anyone else’s.

3. AI processing

Canopy Plant Care uses third-party AI providers to power the care assistant and plant identification. Both are optional features that you must turn on: the app asks for your consent before either is used, and until you grant it we send nodata to these providers. You can withdraw consent at any time in the app under Settings → “AI & Privacy,” where the AI care assistant and AI plant identification can each be turned off independently. When a feature is off, no related data is sent to its provider. Because how AI is used matters to our customers, we describe it explicitly.

• When you have enabled the care assistant, we send the text of your chat messages, summarized plant context, plant and species metadata, and time-limited links to user-provided plant photos to Anthropic, which generates the assistant’s responses and helps enrich care content.
• When you have enabled plant identification, we send the photos you submit for identification to Google’s Gemini API, which returns candidate species matches.

Under our agreements with these providers, your inputs and the AI outputs are not used to train their models. Chat transcripts are retained only in our own database, and any links we share with AI providers are time-limited and expire automatically.

4. How we share your information

We share personal information only with the service providers below, each acting on our behalf to operate the Service. The AI providers (Anthropic and Google) receive data only when you have enabled the corresponding AI feature; with a feature off, nothing is shared with its provider. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We may also disclose information when required by law (for example, in response to a valid legal request), to protect the rights, property, or safety of Canopy Plant Care, our users, or others, or in connection with a merger, acquisition, or sale of assets in which Canopy Plant Care or substantially all of its assets are transferred (subject to this Policy).

5. How long we keep your information

We keep your account information and content for as long as your account is active.

When you delete your account from within the app, we permanently delete your authentication record, your profile, every plant you have created, and the records associated with those plants — including care events, diary entries, custom events, gallery photos, chat sessions and messages, and derived plant-context summaries. Photo files are purged shortly after. There is no recovery window.You can delete your account at any time from the app’s settings.

A few specifics to be aware of:

• Canopy Pal smart tags are reset to an unclaimed state rather than deleted, because the physical hardware is reusable.
• Diary photos that also appear in a plant’s gallery remain in the gallery if you delete only the diary entry; they are removed when you delete the parent plant or your account.
• Plant identification records are de-linked from a plant when you delete that single plant — the record stays associated with your account (it is not anonymized) so we can evaluate and improve identification quality — and are fully deleted when you delete your account.
• Order records are retained as needed to fulfill orders and to meet tax, accounting, and legal obligations, even after account deletion, and are then deleted or anonymized.
• Server activity logs are retained for a limited period under our infrastructure provider’s standard retention and contain only operational identifiers.
• Security and claim-attempt records are retained as needed to prevent abuse, investigate fraud or security issues, and protect reusable Canopy Pal smart tags.

6. Cookies and tracking technologies

Our website uses cookies and similar technologies that are strictly necessary to run the site, keep it secure, and process checkout. We do not use these technologies to track you across other companies’ sites or apps, and we do not allow third-party advertising networks to do so through our Service. Because we do not engage in cross-site tracking, we treat browser “Do Not Track” and Global Privacy Control signals consistently with this practice. You can control cookies through your browser settings, though disabling necessary cookies may prevent checkout from working.

The Canopy Plant Care iOS app does not include advertising SDKs and does not track you across other apps or websites.

7. Security

We take reasonable measures to protect your information, including:

• Encrypting data in transit and at rest.
• Enforcing access controls that isolate each account’s data from other accounts.
• Storing plant photos privately and serving them only through short-lived links that expire automatically.
• Storing Canopy Pal claim tokens only in hashed form — never in the clear — and rate-limiting claim attempts to prevent abuse.

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you and any regulators as required by applicable law.

8. Your privacy rights and choices

All users

Regardless of where you live, you can:

• Edit your profile and content directly in the app.
• Delete your account from the app’s settings. This is a permanent deletion; we cannot recover your data afterward.
• Turn AI features on or off, and withdraw consent, at any time in the app under Settings → “AI & Privacy” (AI care assistant — Anthropic; AI plant identification — Google Gemini).
• Adjust notification permissions in your device settings.
• Opt out of product and waitlist emails using the unsubscribe link in those emails.
• Email us at hello@canopyplantcare.com with any questions about this Policy.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we have collected, the sources, the purposes, and the categories of third parties we share it with.
• Access a copy of the specific pieces of personal information we have collected about you.
• Delete your personal information, subject to limited legal exceptions.
• Correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information. We do neither, so there is nothing to opt out of.
• Limit the use of sensitive personal information. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA.
• Non-discrimination. We will not deny you service, charge you a different price, or provide a different level of service for exercising these rights.

Residents of other U.S. states

Depending on your state of residence, you may have similar rights to access, correct, delete, or obtain a portable copy of your personal information, and to opt out of targeted advertising, the sale of personal information, or certain profiling. We do not sell personal information, do not use it for targeted advertising, and do not engage in profiling that produces legal or similarly significant effects, so several of these rights do not apply to anything we do. You may still exercise your access, correction, and deletion rights as described below.

How to exercise your rights

To exercise any of these rights, email hello@canopyplantcare.comfrom the email address associated with your Canopy Plant Care account, or use the account-deletion option in the app’s settings. We may need to verify your identity by confirming information we already have on file. You may designate an authorized agent to make a request on your behalf; we will require written authorization and may verify your identity directly. We respond to verifiable requests within the timelines required by applicable law (generally 45 days, with one 45-day extension when reasonably necessary). If we decline a request, you may appeal by replying to our response, where the law provides an appeal right.

9. Children

Canopy Plant Care is intended for users 13 years of age or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at hello@canopyplantcare.com and we will delete it.

10. International users

Canopy Plant Care is operated from the United States and is intended for users in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other jurisdictions where our service providers operate, which may have different data protection laws than your own.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Effective date” above and, where required by law or where the changes are material, give you notice in the app or by email before the changes take effect.

12. Contact us

Yellow Door Studios LLC (dba Canopy Plant Care)
522 W Riverside Ave Ste N
Spokane, WA 99201-0581
hello@canopyplantcare.com