Agrondo
Privacy Policy
1. Who I am
Agrondo is an iOS app for mapping fields and keeping farm records. It is written and published by one independent developer, and that is who this page means by "I". For the purposes of the GDPR, that same person is the data controller. Write to iosallapps@gmail.com.
This website is a set of static files served by GitHub Pages. It sets no cookies, loads nothing from a third party, and runs no analytics of any kind.
2. What leaves your phone, and when
The requests below, and nothing else. Each is listed with the service it reaches.
| What | Where it goes | When |
|---|---|---|
| The photo you picked, an identifier for your installation, your app language, and whether a subscription is active | A small relay I run at agrondo-plantnet.plantnet-proxy.workers.dev, hosted on Cloudflare
Workers. It passes the photo to PlantNet
(my-api.plantnet.org), run by a French research consortium |
Only when you tap to identify a plant |
| The centre point of your first field, worked out from the boundary you drew | Open-Meteo (api.open-meteo.com), a free weather service |
When the home screen loads or refreshes, if you have drawn at least one field |
| The area of the map you are looking at, so the imagery for it can be fetched | Apple, through Apple Maps, which supplies the satellite imagery the app draws your fields on | Whenever a map is shown, panned or zoomed |
| A request for the thumbnail images PlantNet returns with a match, so you can see what it thinks your plant is | PlantNet’s own image host, reached directly | Only after an identification returns results |
| The Latin name of an identified species, so a one-paragraph description can be shown. Nothing about you, and never your photo | Wikipedia (<language>.wikipedia.org), the edition for your app language,
falling back to English |
Only when you open a result’s details |
| Your App Store purchase history for Agrondo, so the app knows whether a subscription or a Lifetime purchase is active, and a random identifier that RevenueCat generates for the install. No name, no email, no account | RevenueCat (api.revenuecat.com), the service that validates the receipt with
Apple and tells the app what you are entitled to |
At launch, and whenever you buy something or tap Restore Purchases |
| Your answer to Google's consent form, with the information Google needs to work out whether its consent rules apply where you are | Google's User Messaging Platform, part of Google AdMob | At launch. The form itself appears only in the European Economic Area, the United Kingdom and Switzerland, and again whenever you open Ad Privacy Settings |
| An ad request: the app and the ad slot, device and system details, your approximate region from the IP address, and the advertising identifier only if you allowed tracking. Ad impressions and taps are reported back | Google AdMob (googleads.g.doubleclick.net and related Google ad
hosts) |
Free version only, after the tracking question has been answered: when the app opens, and after you finish an action such as saving a field |
| Usage statistics: which screens and features were used, for example that a field was saved or a report was exported, paywall views and purchases, with a random app instance ID that Firebase creates for your installation, device model, iOS version, app version and approximate region. Never a field name, a note, a place or a photo | Google Analytics for Firebase | While you use the app, if measurement is allowed: outside the EEA, the UK and Switzerland by default, inside them only with your consent |
| Crash reports: the technical record of a crash (the code that failed, device model, iOS and app version, free memory and disk) with a random installation ID | Firebase Crashlytics, part of Google Firebase | After the app crashes, the next time it opens |
| Whatever a web page you opened needs to load. Links open in a browser inside the app, so the page is fetched the way any browser fetches it | The site you tapped: this one for the policy and terms, or Wikimedia and Wikipedia for a photo credit or a plant description | Only when you tap a link |
If the relay ever moves to an address on agrondo.com, the host named in this
table changes with it, and so does the date at the top of the page.
3. Identifying a plant
Tap to identify and the photo goes to my relay first, then on to PlantNet. The reason is the key. PlantNet issues a key that authenticates the app to them, and anything shipped inside an iOS app can be read straight out of the download. Ship that key and one person can drain the quota and take identification down for everybody using the app. So the key sits on the relay, and the app never holds it.
The relay runs on Cloudflare Workers, which makes Cloudflare a processor: your photo passes through their network on its way to PlantNet. It is not kept there. The relay reads the request, forwards it upstream, and writes one number.
Three things travel with the image:
- Your app language, so the common names come back in the language you read.
- An identifier for your installation, which is how identifications are counted against the monthly limit.
- Whether a subscription is currently active, which decides which limit applies.
That identifier comes from iOS, not from me. It is not your name and not your Apple Account, and I have no way to turn it back into a person. It is the value iOS calls the vendor identifier, so it is shared by every app from this same developer on your device, and it resets once you remove the last app from this developer. Deleting Agrondo on its own will not reset it if you keep another of my apps installed. On the rare occasion iOS does not supply that value, the app generates a random one instead and keeps it on the device.
The count lives in Cloudflare KV, Cloudflare's key store: one number per installation per month, which expires by itself roughly forty days later. No photo is stored, no result is stored, and no history is built from either.
Once the relay hands your photo on, PlantNet handles it under their own terms. If you would rather send nothing at all, do not use plant identification. Every other part of the app works without it.
4. The map
Fields are drawn on satellite imagery, and that imagery is not stored in the app. It is streamed by Apple Maps as you pan and zoom, which means Apple sees which part of the world you are looking at, in the same way it does in Apple's own Maps app. That traffic goes from your phone to Apple directly and never passes through me. Apple handles it under their own privacy policy, not this one.
5. Weather
To show a forecast for your land, the app works out the centre point of your first field from the boundary you drew, and sends that latitude and longitude to Open-Meteo. This happens on its own when the home screen loads or refreshes, not only when you look at the forecast. Nothing goes with it: no identifier, no account, no subscription status. Open-Meteo has nothing to tie the request to you. Until you have drawn a field, no coordinates are sent at all.
6. Your farm records
The fields and parcels you draw, the areas, the crops sown, the treatments with their dose and date, the field operations, the harvests, the journal entries, the costs, the revenue and the photos you attach are stored on your device with Apple's SwiftData. They stay there. I hold no copy, run no database of your records, and cannot read them.
The app does not sync to iCloud at present. Your records live on the one device that made them, so use your normal iPhone backup if you want them kept. Deleting the app deletes them.
7. Location
Agrondo asks for your location while you are using the app so the map can find you and so a boundary is easier to trace. The locations you save stay with your fields on the device. Coordinates leave the phone in only two places, both described above: the map imagery request in section 4 and the weather request in section 5. Both describe land you drew yourself, not a record of where you have been, and neither reaches me. The app never passes your coordinates to its ad or analytics services. Like any service on the internet, Google can work out an approximate region, such as a country or city, from your IP address.
8. Camera and photo library
Camera access is for photographing a plant or documenting work in the field. Photo library access is for picking an image you already have. Those photos stay on the device unless you use plant identification, which section 3 covers line by line. Both permissions are optional, and you can revoke either one in iOS Settings.
9. Crash reports
When the app crashes, Firebase Crashlytics sends a crash report to Google the next time you open it: the code that failed, the device model, the iOS and app version, and a random identifier for the installation. It holds nothing you typed, drew or photographed. I use it to find and fix crashes, and Crashlytics keeps a report for 90 days.
Separately, iOS writes crash and hang reports through Apple's MetricKit and hands them back to the app. Agrondo keeps the most recent of those on your device, together with a short list of errors it recovered from. That history leaves your phone only if you choose to mail support from the app's Settings, and then it is attached to a message you can read and edit before you send it.
10. Subscriptions
Agrondo offers weekly and monthly subscriptions, a yearly subscription and a one-time Lifetime purchase. Apple takes every payment. It happens inside the App Store, and I never see your card, your address or your Apple Account. RevenueCat, listed in section 2, reads your purchase history for this app from Apple so the app learns one thing: whether a subscription or a Lifetime purchase is currently active. As section 3 explains, that yes or no is passed to the identification relay so it knows which monthly limit to apply. Where usage statistics are allowed (section 12), the app also gives RevenueCat the Firebase app instance ID, so that a trial, a renewal or a cancellation can be counted in the same statistics. A subscription or a Lifetime purchase also turns off every ad in the app.
Subscriptions are managed and cancelled in iOS Settings, under your Apple Account and then Subscriptions. Restore Purchases in the app's Settings asks Apple again for what this Apple Account has bought.
11. Ads in the free version
The free version of Agrondo shows full-screen ads from Google AdMob: one when the app opens, and one now and then after you finish an action such as saving a field or adding a journal entry. Subscribers, people on a free trial and Lifetime buyers see no ads at all.
The order of the questions on first launch is fixed. If you are in the European Economic Area, the United Kingdom or Switzerland, Google's consent form comes first, and you choose there whether your data may be used for personalised ads and for measurement. Then iOS asks whether Agrondo may track you across apps and websites. No ad is requested before you have answered that question.
- If you allow tracking, Google may use your device's advertising identifier (IDFA) to show ads that are more relevant to you and to measure them.
- If you do not, the advertising identifier stays unavailable to the app, and where Google's consent form applies and you said no, the ads are not personalised. Ads are still shown in the free version.
Google acts under its own privacy policy for advertising, at policies.google.com/technologies/partner-sites. You can change your consent at any time from Settings inside Agrondo, under Ad Privacy Settings (shown where Google's consent form applies), and you can change the tracking answer in iOS Settings, under Privacy & Security and then Tracking.
12. Usage statistics
Agrondo uses Google Analytics for Firebase to learn how the app is used: which features people reach, where they stop, and whether a change made things better. It records events such as a field saved, a journal entry added, a plant identified, a report exported, a paywall shown and a purchase made, each with a few fixed values such as the kind of entry or whether an identification was confident. It never records a field name, a note, a place, a photo or anything else you wrote.
The events carry a random app instance ID that Firebase creates for your installation, along with the device model, iOS version, app version, language and approximate region. In the European Economic Area, the United Kingdom and Switzerland, nothing is collected unless you agree in Google's consent form. Elsewhere it is on by default. Builds from TestFlight or development are never measured. Google keeps these statistics for the retention period set in the project, at most 14 months, and then deletes them.
13. What Agrondo does not do
| Your records | Never sent to the ad or analytics services. Fields, boundaries, notes, costs, yields and photos stay on the device. |
| Selling data | Never. Nothing is sold, rented or traded. |
| Accounts | None. There is nothing to sign up for and no database of users. |
| Ads for paying users | None. A subscription, a free trial or a Lifetime purchase removes every ad. |
| Tracking without asking | Never. The advertising identifier is used only if you allow tracking when iOS asks. |
14. Exports
Reports you export as PDF or CSV are built on your device and go wherever you send them. Once a file leaves the app, it is covered by whatever service you sent it through.
15. Children
Agrondo is a working tool for people who farm. It is not directed at children under 13, and I do not knowingly collect anything from them.
16. Your rights
Most of your control here is exercised without asking me for anything:
- Revoke camera, photo or location access at any time in iOS Settings.
- Stop identifying plants, and delete your fields, and every outbound transfer stops with it.
- Change your ad and measurement consent from Ad Privacy Settings in the app's Settings, where Google's consent form applies.
- Turn tracking off in iOS Settings, under Privacy & Security and then Tracking.
- Subscribe, start a free trial or buy Lifetime, and no ads are shown.
- Delete the app and your records go with it.
Under the GDPR my legal basis for the app's features is your consent, given through the iOS permission prompts and again each time you tap to identify a plant or open a forecast. For personalised ads, for storing and reading information on your device for ads, and for usage statistics, the legal basis is the consent you give in Google's form, and you can withdraw it at any point from Ad Privacy Settings. Crash reports are sent on the basis of my legitimate interest in keeping the app working. You have the right to access, correct, delete or object to the use of data about you, and to complain to your data protection authority.
I hold no account and no profile of you. The records on my side are the monthly counter tied to your installation, which expires on its own, and the usage statistics and crash reports kept by Google Firebase under a random identifier. Write to me and I will delete the counter. Usage statistics are tied to the app instance ID, which a reinstall replaces, so deleting the app ends the link between your phone and what was collected.
17. Changes
If this policy changes, the date at the top changes with it.
18. Contact
iosallapps@gmail.com. One person reads it.