Privacy Policy

Effective date: 29 September 2026. Last updated: 29 September 2026.

This policy explains what personal information myEdenry handles, why, who helps us process it, how long it is kept and the choices you have. It covers the myEdenry Android app and this website.

1. Who we are

myEdenry is operated by Vishal Kundar, trading as Myrmidon Studio, a sole proprietorship based in Bengaluru, Karnataka, India. We decide how your information is used for the app and this website.

• Privacy questions, requests and complaints: privacy@myedenry.com
• General support: support@myedenry.com

Vishal Kundar is the person responsible for privacy requests and grievances, and can be reached at the privacy address above.

2. Who the service is for

myEdenry is a free Android app for adults aged 18 or older. It is currently made available only in selected countries, which are the countries where it is listed on Google Play. It is not currently offered in the European Economic Area, the United Kingdom or Switzerland. It has no advertising. We do not sell your personal information and we do not use it for behavioural advertising.

3. What we collect and why

• Account and profile. Your name, email address and account identifier, used to create and secure your account, sign you in and contact you about it. If you sign up with a password we store a hash of it, never the password itself. If you use Google sign-in we receive your Google account identifier, verified email and name; we never receive your Google password. When you create an account, we record which version of the Terms and this policy you were shown, and that you confirmed you are 18 or older.
• Location (optional). A place you choose, or your device location if you allow it, with its coordinates and timezone. It is used for local weather, planting windows and the timing of reminders. You can type a place instead of granting device location. The app does not track your location in the background.
• Gardens, plants and journal. The gardens, locations, containers, beds and plants you add, plus care events, notes, schedules, wishlist items and feedback. This is the record the app exists to keep, and it shapes the suggestions you see.
• Photos. Images you take or pick for plant records, identification and diagnosis. We re-encode uploads and remove embedded camera metadata such as GPS position before storing them. A photo can still show a person, a home or other private details, so please frame the plant only.
• Identification and diagnosis. The photos and description you submit, the results returned, any follow-up answers, and the outcome you record.
• Voice recordings and transcripts. If you use the voice journal, the recording is sent for transcription. We keep the transcript and the entries you confirm. We do not keep the recording (see section 7). We do not use your voice to identify you.
• Assistant questions and answers. What you ask the garden assistant and what it replies, kept with your account so you can see your history.
• Device push identifiers. If you allow notifications, a device token, platform and app version, used only to deliver the garden reminders and alerts you have switched on.
• Diagnostics, usage and security data. IP address, request and error details, timestamps, usage counters, feature events and sign-in events. These keep accounts safe, enforce fair usage limits on costly features, and help us find faults.
• Website analytics. Aggregate traffic and performance measurements for this website (see section 6).
• Support correspondence. The emails you send us and our replies, used to help you. A support email does not sign you up for marketing.

Account information and the garden records you enter are needed to provide the app. Photos, voice, device location and notifications are optional; the rest of the app works without them. Please do not put health records, financial details, identity documents or other people's private information into notes, photos or recordings.

4. Permissions and your choices

The app asks for camera, photo, microphone and location access only when you use a feature that needs it. It asks for notification permission after you sign in, so that garden reminders can reach you. You can refuse or withdraw any of them in your device settings, and the app keeps working. Withdrawing a permission stops new collection; it does not delete what is already saved. You can remove plants in the app, and for anything else write to privacy@myedenry.com.

5. Service providers and AI processing

We use the providers below to run myEdenry. Each receives only what its function needs, when that function is used. AI features run only when you ask for them. AI results are suggestions for you to review; they are never used to make decisions about your account.

• Supabase. Hosts the application database that holds your account and garden records. Our database is in the Mumbai, India region.
• Fly.io. Runs our application server, which handles every request the app makes. Our server runs in Singapore. Fly.io may handle server logs and metrics separately.
• Cloudflare. Serves this website and its cookieless traffic measurement, and stores uploaded plant photos and encrypted database backups in its R2 storage. Our storage is set to an Asia-Pacific location; we do not claim it is physically located in India.
• Upstash. Provides the Redis database we use for short-lived operational data such as rate limits, usage counters and caches. Its primary region is Mumbai, India. Upstash may keep its own persistence copies.
• Resend. Delivers account email such as the welcome message and password-reset links, so it processes your email address and the message. Our sending region is Tokyo, Japan.
• Google (Sign-In and Firebase Cloud Messaging). If you choose Google sign-in, Google confirms your identity to us. If you allow notifications, Firebase Cloud Messaging delivers them using a device push identifier.
• Sentry. Receives error reports so we can find and fix faults. Reports are limited to technical details; we do not attach your photos, journal text, transcripts, questions or email address. Our Sentry organisation is in its EU region.
• Pl@ntNet. Analyses the plant photos you submit for identification and for plant-health diagnosis. We send the photo only, without your name, email address or account identifier. Pl@ntNet tells us its servers are in France, that a photo is held in memory only while it is analysed and is not stored, and that it keeps a log of each request with no fixed time limit.
• OpenWeather. Receives a place search or coordinates to return place results and weather. We do not send your name or email for this.
• Together AI. Runs the language models behind the garden assistant, diagnosis explanations and voice-entry extraction. It receives the text needed for that request, such as your question, plant names, notes, care history and diagnosis details. Zero data retention is enabled for our production account.
• Sarvam AI. Converts voice-journal recordings to text (speech-to-text). It receives the audio you record. Sarvam has confirmed that this content is not used to train or improve its models, and that with our workspace’s no-retention setting, audio and transcripts are deleted within one month.

The regions above are where our own workloads are configured. We operate from India, and you may be using the app from another country. Your information is processed in India, Singapore and the other countries where these providers work, which include Japan, France, other European Union countries and the United States. That may be outside the country where you live, and privacy laws there can differ from yours. A provider may also keep its own operational records (such as logs, billing and abuse-prevention data) under its own terms. We do not claim that information stays in any one country. We do not use your garden content to train our own AI models.

We may also disclose information where the law requires it, to investigate abuse, or to protect someone's safety, limited to what that purpose needs. If the service is ever transferred to another operator, we will tell you before your information moves.

6. This website, cookies and analytics

This website uses Cloudflare Web Analytics, which measures traffic and page performance without traditional analytics cookies and without building a profile of you. We do not intentionally set analytics or advertising cookies, and the site has no advertising or cross-site tracking. Cloudflare, which serves the site, processes connection details such as your IP address to deliver pages and may use strictly necessary security measures to protect the site.

The contact form does not send anything to us by itself. It opens your own email app with a pre-filled message, and we receive it only if you press send.

7. How long we keep information

• Account and garden records are kept while your account is active, until you delete them or delete your account.
• Account deletion removes your account and the records linked to it from the live database. See section 8.
• Photos are deleted from storage by a separate background job after the record is removed. That job retries if storage is unavailable, so removal can take longer than the account deletion itself.
• Voice recordings are used only for the transcription attempt. Our server does not save the audio, and the current app deletes the temporary recording file from your device afterwards. The transcript is kept with your journal.
• Operational, audit and analytics records may be kept after deletion with the link to your account removed. They can still contain pseudonymous identifiers.
• Encrypted backups of our database are kept as up to 30 daily and 12 monthly copies, and the oldest expire on a rolling basis. Information from before a deletion can therefore remain in backups until they expire, which in the worst case is about 13 months. Backups are encrypted and are used only for disaster recovery, never for any other purpose. We keep a minimal deletion record so that restoring a backup does not bring a deleted account back.
• Push identifiers. When you delete your account the app removes its notification token from our server and asks Firebase to delete the device's installation identifier, retrying later if that fails. Google controls how long its own systems keep that identifier afterwards.
• Providers keep information under their own retention arrangements, which can differ from ours.

8. Deleting your account

You can delete your account in the app at Profile > Sign out > Delete account. If you cannot use the app, follow the steps on our Account Deletion page. Deletion takes effect straight away and cannot be undone. It removes your account and garden records from the live database and queues your photos for deletion. It does not instantly erase backups, provider-held copies, the residual operational records described above, or files you exported or shared yourself. Uninstalling the app does not delete your account.

Before deleting, you can save a copy of your records from Profile > Data and privacy > Export my data.

9. Your requests and complaints

You can ask us what information we hold about you, ask for a copy, ask us to correct or delete it, or withdraw a permission or consent, by writing to privacy@myedenry.com from the email address on your account. We may ask for enough detail to confirm the request is yours. Never send us your password or a one-time code. We respond as soon as we reasonably can, and we will not treat you worse for making a request.

We handle personal information under the Indian laws that apply to us. Rights and complaint routes under the Digital Personal Data Protection Act, 2023 apply as its provisions come into force. If you use myEdenry from another supported country, the privacy law of that country may also give you rights, such as access, correction and deletion, and the right to complain to the privacy regulator where you live. Nothing in this policy takes those rights away, and you use them the same way, by writing to us. If you are unhappy with how we handled a request, please tell us first so we can put it right; you keep any remedy the law gives you.

10. Security

We use encrypted connections between the app, this website and our servers, store password hashes rather than passwords, keep uploaded photos in private storage, encrypt backups, and limit who can access production systems. No system is perfectly secure. Please use a unique password and protect your device and email account. If a security incident affects your information, we will investigate, contain it and notify you and the authorities where the law requires.

11. Children

myEdenry is for adults aged 18 or older. We do not offer accounts for children. If you believe a child has given us personal information, write to privacy@myedenry.com and we will look into it and remove it as appropriate.

12. Changes to this policy

We will post any update here with a new effective date. If a change is significant we will tell you in the app or by email before it takes effect, and we will ask for fresh consent where a new use needs it.