Privacy Policy — Polypodium

Last updated: October 10, 2026 · Versão em português

Summary: the Polypodium developer does not collect, store, or have access to any of your data. Polypodium is an offline-first plant collection management app. All data stays on your device and, optionally, on a server that you choose and operate. The app contains no ads, no analytics, and no trackers of any kind.

1. Data stored on your device

Everything you record in the app — plants, species, soils, locations, journal entries, photos, and watering reminders — is saved to a local database on your own device. None of it is transmitted to the developer.

2. Location

The app requests location permission only when you add or edit a plant location and choose to use the device's current position to fill in the coordinates. Location is never accessed in the background and is not used for tracking; the coordinates are stored only on your device (and on your own server, if you set up the optional sync described below).

3. Photos and camera

You can attach photos to plant and soil records by picking images from your gallery or taking pictures with the camera. Images are stored on the device (and on your own server, if sync is configured). The app does not access any photos other than the ones you select.

The camera is also used to scan the plants' QR code labels. The scanned image is processed on the device and is never saved or sent anywhere.

4. Optional sync with your own (self-hosted) server

Polypodium can optionally synchronize your data with a Polypodium server installed and operated by you (or by someone you trust). In that case:

• Your data and photos are sent exclusively to the server you configured — never to the developer, who operates no servers and has no access to your data.
• Account credentials (e-mail and password) are used solely to authenticate against that server. Passwords are stored on the server in protected form (bcrypt hash), never in plain text.
• Whoever operates the server is responsible for the data stored on it, including backups and account deletion.
• If the admin turns on the weather forecast, the server queries Open-Meteo sending only approximate coordinates: the center of a region a few kilometers wide, never a plant's exact location. The server also checks GitHub to tell the admin about new versions.

If you never configure a server, none of your data leaves your device.

5. Connections that send none of your data

Even without a server, the app may go online in these cases. None of them sends any of your data; as with any internet access, the service contacted sees the device's IP address.

• Updates: builds downloaded from GitHub (APK and AppImage) query GitHub's public API to find out whether a new version is available. On Google Play, the check is done by Google Play itself. On the Microsoft Store, the store handles updates and the app makes no request.
• Species database: when you tap to download the latest Flora Brasil database, the app downloads the species list from the Rio de Janeiro Botanical Garden (JBRJ).

6. Notifications

Watering reminders use local notifications scheduled on the device itself. No external notification service is used.

7. Data deletion

To remove your local data, delete it inside the app or uninstall the app. Data synchronized to a self-hosted server can be removed by that server's administrator.

8. Children

The app is not directed at children and, as described above, does not collect personal data from any user.

9. Changes to this policy

This policy may be updated to reflect changes in the app. The current version will always be available on this page, with the update date shown at the top.

10. Contact

Questions about this policy can be sent to bruno1pb13@gmail.com.