Privacy Policy
For the Pot Pals Android app (package eu.rosom.fertilizertracker).
Last updated: 17 August 2026 · effective from version 1.0
The short version
- No account, no server, no tracking. There is no sign-up, no analytics, no crash reporting and no advertising.
- Your care data stays on your device. Plants, care history and photos live solely in your phone's private app storage.
- Two network requests, both for weather only. They send coordinates or a place name you typed — never your care data and no device identifier.
- The weather feature is optional. Without a location the app works fully, just without weather-dependent hints. Instead of GPS, a typed city or postcode is enough.
1. Data controller
The controller under the General Data Protection Regulation (GDPR) is:
Further provider details are set out under provider and contact. No data protection officer has been appointed; the legal conditions requiring one are not met.
2. Data that never leaves your device
The app stores everything you create locally, in a SQLite database file
(fertilizertracker.db3) and an image folder inside the app's private directory.
Android protects this area from access by other apps. This data is
never transmitted to us or to any third party — we operate no server that could
receive it.
Specifically, this covers:
- Your plants, including names, types and settings
- Care programmes, tasks, due dates and care history
- Photos you take or select in the app
- App settings and the most recently chosen location (coordinates and place name)
- A cached weather forecast for the chosen location
3. Data shared with third parties
The app contacts exactly two external services, both solely for the optional weather feature. It makes no other network connections.
| Service | When | Data transmitted |
|---|---|---|
MET Norwayapi.met.noNorwegian Meteorological Institute, Norway |
When fetching the forecast for the chosen location |
Geographic coordinates truncated to four decimal places (roughly 10 m precision); your
IP address; an app identifier including version and a contact address of the provider (not
yours) in the User-Agent, as the service's terms require
|
Nominatim (OpenStreetMap)nominatim.openstreetmap.orgOpenStreetMap Foundation, United Kingdom |
Only on an explicit tap: when searching for a place, or resolving a GPS position to a place name. There is deliberately no search-as-you-type. |
The search term you entered (city or postcode) or the GPS coordinates; your IP
address; the same app identifier in the User-Agent
|
In both cases no care data, no photos, no account or device identifiers and no advertising IDs are transmitted. These providers learn nothing about which plants you keep or how you use the app.
The forecast is cached locally and only re-requested once it expires, so the app makes far fewer connections than it refreshes its display.
Legal basis and recipient countries
The legal basis for these transfers is your consent under Art. 6(1)(a) GDPR, given by enabling the location or weather feature and withdrawable at any time by removing the location in settings or revoking the location permission. Without that feature, no data is transmitted at all.
Norway is part of the European Economic Area, and the United Kingdom is covered by a European Commission adequacy decision. No transfer to a country lacking an adequate level of data protection takes place.
Processing by these providers is governed by their own privacy notices: MET Norway and the OpenStreetMap Foundation.
4. Permissions and why they are needed
| Permission | Purpose | Optional? |
|---|---|---|
| Internet and network state | Fetching the weather forecast and place search | Unused without the weather feature |
| Location (coarse and fine) | Determining your current position for the forecast | Yes — type a city or postcode instead. The position is used only for the weather request and is not logged. |
| Camera | Taking a photo of a plant directly in the app | Yes — photos are an optional feature |
| Notifications | A single daily reminder about due care, generated on the device | Yes — the reminder is computed locally, with no push service |
| Run after device restart | Re-scheduling the daily reminder after a reboot, since Android discards pending alarms | Only relevant alongside notifications |
Notifications are produced entirely on your device. No push service such as Firebase Cloud Messaging is involved, and no data leaves your phone for this purpose.
5. Export and backup
Export by you
In settings you can create a backup. This produces a ZIP file containing your database and photos, which you then pass on through the Android share sheet to a destination of your choosing. Where it goes is entirely your decision; the app never uploads it anywhere on its own.
Android system backup
Android's backup feature is enabled for this app (allowBackup). If you use automatic
backup in your Android settings, the operating system may therefore back up the app's data to your
personal Google Drive account. That backup is performed by Android and Google, not by us, and it
resides in your own account. You can turn it off under “Backup” in your Android system settings.
Google's privacy policy
applies.
6. What the app does not do
- No user account, no sign-in, no synchronisation
- No analytics or statistics services, no crash reports to third parties
- No advertising, no ad tracking, no advertising ID
- No sharing or selling of data to third parties
- No cookies — the app is not a web application, and this website sets no cookies and embeds no external services either
7. Retention and deletion
Because everything is stored locally, you control retention yourself. Individual entries and photos can be deleted in the app at any time. Uninstalling the app makes Android remove the private app storage entirely, permanently deleting the database and photos. Remember any backup files you created yourself, and any Google system backup, which you remove in your Android settings.
At the external services, at most your IP address is briefly processed in their own server logs; we have neither influence over nor access to those.
8. Your rights
Under the GDPR you have the right to:
- Access the data processed (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent with future effect (Art. 7(3))
In practice you exercise these rights directly yourself: since we hold no personal data about you, we can neither provide information about, nor delete, content that exists only on your device. Access and erasure happen right in the app, and the export feature covers portability. For questions about this policy, reach us at potpals@rosom.eu.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence or place of work.
9. Children
The app is not directed at children and knowingly collects no data from children. As no data reaches us, use by a child likewise results in no processing on our side.
10. Data sources and licences
The app uses open data whose licences require attribution. The same credits appear in the app under Settings → Data sources.
- Weather: Weather forecast based on data from MET Norway, processed and aggregated into care hints. Licence: CC BY 4.0.
- Place search: Place search based on data from OpenStreetMap (Nominatim), © OpenStreetMap contributors. Licence: ODbL 1.0.
11. Changes to this policy
If the app changes in a way that changes how data is processed, we will update this policy and the date above. The current version is always available at potpals.rosom.eu/en/privacy.html.
12. Contact
We answer questions about privacy and the app at this address. See also the support page.