Privacy Policy

In short

By default, Permagora asks for no account and collects no personal data on any server: everything you save (favourites, progress, preferences) stays on your device.

An account is OPTIONAL: if you choose to create one (via a simple email code, no password), it is only to keep your progress across your devices. You can log out and erase that data at any time.

Data stored on your device

To be useful, the app stores locally, in your browser/device storage (localStorage): your favourites (“My garden”), your progress in the games and spaced-repetition, and your preferences (language, climate zone, light/dark theme).

Without an account, this information never leaves your device: it is not sent to anyone. It only serves to restore your state from one visit to the next.

On Android, the phone's automatic backup (cloud backup and transfer to a new device) is disabled for Permagora: your local data is never included in it.

Account and sync (optional)

If, and only if, you create an account, two things are kept with our database host (Supabase, in the European Union): your email address (to log you in) and a copy of your progress (favourites, games, reviews, path, zone/entry preferences). No password is stored: sign-in uses a one-time code sent by email.

This data is isolated per account at the database level (each person can only read or change their own data). It is used solely to sync your progress between your devices, never to profile you, never for advertising, and it is neither sold nor shared.

You stay in control, from the “My account” page: “Log out” stops syncing (your data stays on the device); “Delete my synced data” erases the cloud-stored copy while keeping your account; “Delete my account” permanently and immediately erases your account and your email address. You can also request to delete your account, including after uninstalling, by email at the contact address below: we carry out the deletion within 30 days.

Data controller, legal basis and retention

The data controller is Victor Cardoso (Paris, France), publisher of Permagora, reachable at the contact address below. The legal basis for the optional account and sync is the performance of the service you request (Article 6(1)(b) GDPR). You create this account freely, with your consent, and you remain free not to create one, to stop using the service, and to erase your data at any time.

Retention: your synced data is kept for as long as your account exists; it is erased as soon as you delete your synced data or ask for your account to be deleted. Without an account, no personal data is kept on our servers.

Erasing your data

You can erase everything at any time from the “My garden” page (“Erase my data” button), or by clearing the app's data in your phone settings. Deletion is immediate and permanent.

Third-party services

Hosting: the web version of the site is served via Cloudflare, which may log technical connection data (IP address, device type) for security and operational purposes, under its own policy. In the Android app, the content (plant sheets, games, guides, recipes…) is bundled directly inside the app and never travels through any server: nothing is downloaded to display a page.

Account and sync (if you create one): email authentication and the storage of your progress are handled by Supabase, with the database hosted in Ireland, in the European Union, subject to its own privacy policy. The contract and the data processing agreement are with Supabase Pte. Ltd., a company established in Singapore: any transfer of data outside the European Economic Area is governed by the European Commission's Standard Contractual Clauses, which that agreement incorporates.

Sign-in emails (if you create an account): the one-time code is sent to you from contact@permagora.eu, through OVH's email service (OVH SAS, Roubaix, France). Your email address is passed to it for that purpose. This mailbox, which also receives messages written to the contact address, is hosted in OVH's data centres in France.

Anti-bot check (when you ask for a sign-in code): to stop bots from having codes sent to addresses that are not theirs, the request goes through Cloudflare Turnstile, which is only loaded when you ask for a code. Turnstile looks at technical signals from your browser (IP address, TLS fingerprint, User-Agent header, the site's address and our widget's key) to tell a person from a bot, not to profile you. Cloudflare acts as our processor for this check; it also processes these signals on its own behalf to improve its bot detection, as its dedicated Turnstile Privacy Addendum explains.

Videos: videos are embedded via YouTube in privacy-enhanced mode (youtube-nocookie.com). No YouTube cookie is set until you play a video; preview thumbnails are loaded from a Google server, which then receives your IP address like any remote image, only if you choose to show them on the videos page. On playback, YouTube (Google) applies its own privacy policy.

Support: the donation button links to an external service (Ko-fi), subject to its own privacy policy. No payment data passes through the app.

No ads, no tracking

The app shows no ads and includes no third-party advertising tracker or audience-measurement tool (no Google Analytics, no pixel, no profiling).

Children

The app is intended for a general audience and is not specifically designed for children. It does not knowingly collect any personal data from children.

Your rights

Without an account, the app holds no personal data about you on its servers: you keep full control of your local data, which you can view and erase directly on your device.

With an account, you can erase your synced data at any time from the “My account” page, or write to us to exercise your rights (access, rectification, deletion, portability) under the GDPR.

If you believe your rights are not being respected, you can lodge a complaint with the data-protection authority of your country of residence, in particular: France, CNIL (cnil.fr); Belgium, Data Protection Authority (autoriteprotectiondonnees.be); Netherlands, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); Ireland, Data Protection Commission (dataprotection.ie); Luxembourg, CNPD (cnpd.public.lu); Malta, IDPC (idpc.org.mt); United Kingdom, ICO (ico.org.uk); Switzerland, FDPIC (edoeb.admin.ch).

Health and medicinal content

The information about plants, infusions and recipes is educational and cultural in purpose. It is not medical advice and does not replace consulting a health professional (doctor, pharmacist), nor botanical advice for identification and foraging.

If in doubt, during pregnancy or breastfeeding, while on treatment, or for a child, always seek professional advice before any use.

Contact

For any question about this policy: contact@permagora.eu.

Changes

This policy may change if the app changes. The last-updated date above is authoritative. For any significant change, the information will be visible in the app.