Privacy policy

Last updated 8 November 2026

Thallo helps you care for your plants and share them with other plant lovers. This page explains, in plain words, what we collect, why, who helps us run the app, and what you can do about it. We don't sell your data, we don't show ads and we don't track you across other sites.

Who we are

Thallo is run by an independent developer based in Morocco, who is responsible for your data (the "data controller"). Contact: support@thalloplants.com.

What we collect, and why

We only collect what a feature needs. There is no birthday, phone number, gender or contact list, and no tracking or advertising data.

• Your account: your email address, a password (or your Google sign-in) and the name you choose. Needed to sign you in. Passwords are handled by our sign-in provider and we never see them.
• Age and agreement: that you confirmed you're old enough and accepted these terms, and when. Needed to show you agreed.
• Your public profile: username, display name, bio, profile photo and banner, all optional except the username. Everyone can see these.
• What you share: posts, photos, comments, likes and saves. Posts and comments are public, and so is the number of likes your posts received.
• Follows: who you follow and who follows you. These lists are public, like on other social apps. You can unfollow anyone or remove a follower at any time.
• Alerts: when someone likes your post, comments on it, follows you or joins with your invite. Only you see them; they're deleted after 90 days.
• Invites: if you joined with a friend's invite link, which account invited you, so you both get your points.
• Your garden: your plants, their photos, care history, health scores, points and plant profiles. Only you can see these.
• Your city: the city you choose (its name and map coordinates), used to adapt watering to your local weather. We never ask for your exact location.
• Reminders (only if you turn them on): a technical address for your phone or browser and your time zone, so we can send one reminder in the morning.
• Reports and blocks: what you report and who you block, so moderators can keep the community safe.
• Error reports: technical details when something breaks, without your name or email. Reports from your device are sent only if you allow them.

Our legal reasons

• To provide the app you asked for (a contract with you): your account, garden, profile, posts and the AI features.
• Your consent: reminders and error reports. You can withdraw it at any time in Settings.
• Our legitimate interest in a safe community: reports, blocks and moderation.

Photos you analyse with the AI

When you use Scan, What's wrong or a progress photo, the photo and the care details you give are sent to our AI provider, Anthropic (Claude), to identify the plant or suggest a diagnosis. Anthropic processes them only to produce the answer, under its commercial terms, and doesn't use them to train its models. We don't keep these photos unless you add them to your garden.

Who helps us run Thallo

These providers process data for us and only for this purpose. Some of them store data outside Morocco (for example in the European Union or the United States) with contractual safeguards.

• Supabase: accounts, database and photo storage.
• Anthropic: AI plant identification, profiles and diagnosis.
• Open-Meteo: weather for your city. We send the city's coordinates, not who you are.
• iNaturalist: the plant search and its photos. We send what you type in the search box, from our server, not from your device.
• Your browser's push service (for example Google or Apple): delivers reminders if you turn them on.
• Sentry: error reports. When something breaks on our server, it sends the technical details, never who you are. Errors on your device are sent only if you allow them.
• Render (servers in Frankfurt, Germany): hosts the app and its server.
• Cloudflare: runs our domain, thalloplants.com, and forwards the emails you send to support@thalloplants.com to our inbox.
• Resend: sends account emails, such as confirming your email address or resetting your password. It receives your email address to do that.

On your device

Thallo doesn't use cookies. It keeps a copy of your garden and a few settings in your browser's storage so it opens instantly and works offline. The cookie policy lists every item. Signing out removes your garden from the device.

How long we keep it

We keep your data while you have an account. Removing a plant, post or comment deletes it. Settings → Reset garden data deletes your plants, points and history. Settings → Account → Delete account deletes your whole account straight away: your plants and their photos, points, history, posts, comments, likes, saves, profile and reminders. This can't be undone. Backups kept by our providers are erased on their normal schedule, at most 30 days later.

Your rights

You can see, correct, download or delete your data, object to how we use it, and withdraw your consent at any time. Most of this you can do yourself in the app (Settings → Your data → Download my data, and Settings → Account → Delete account); for anything else, email us and we'll answer within 30 days. If you live in Morocco, Law 09-08 protects your data and you can complain to the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel). If you live in the EU or UK, you can complain to your data protection authority.

Children

You must be at least 13 to use Thallo. If you're under 16 (or under the age of digital consent where you live), a parent or guardian must agree to you using it. We don't knowingly collect data from children under 13: if you think a child has an account, email us and we'll delete it.

Changes

If we change this policy in an important way, we'll tell you in the app before it applies.