Privacy Policy

Last updated: May 6, 2026

The short version

StrainSpotter is built to be useful without being creepy. We collect the minimum information needed to provide AI scanning, Grow Doctor diagnostics, and your personal grow history. We do not sell your data, run third-party advertising, or share your photos beyond what is required to generate your scan results.

What we collect

Account information. Your email address (and a password hash you create on Stripe or Supabase, never visible to us). If you sign in with Apple or Google, only the email and a unique account identifier they return to us.

Subscription information. Stripe handles your payment information. We never see your card number. We store your Stripe customer ID and the membership tier ("Member" or "Pro") and renewal status.

Photos you upload for scanning. When you tap Scan or Diagnose, the photo is sent to our server and forwarded to OpenAI’s GPT-4o Vision API to generate a result. We do not retain the photo after the request completes unless you explicitly choose to save the scan to your history or favorites.

Locally-stored garden data. Your grow logs, plants, sessions, favorites, and journal entries are stored on your device’s localStorage. They stay on your device unless you sign in and opt in to cloud sync (currently in development).

Age verification. On first launch we ask you to enter a date of birth to confirm you are 18 or older. We store only a flag confirming verification and the timestamp, on your device. We do not store or transmit your date of birth.

Diagnostic / crash data. Vercel collects standard server logs (IP address, request path, response status). We may use this to debug issues. We do not run third-party analytics (no Google Analytics, no ad tech, no fingerprinting).

What we do NOT collect

We do not sell your data. Ever.
We do not run third-party advertising or behavioral tracking.
We do not collect your contacts, calendar, photos library beyond what you explicitly upload, location (unless you tap to use the Dispensaries finder), or microphone.
We do not share your scans with other users unless you opt in to community photo contribution.
We do not provide medical advice or claim that cannabis treats any condition. Nothing in this app constitutes medical advice.

How we use AI

StrainSpotter sends your photo to OpenAI’s GPT-4o Vision API to produce strain analysis or plant-problem diagnosis. Per OpenAI’s data-use policies for API customers, those requests are not used to train OpenAI’s models. We store no copy of the image on our servers beyond the request lifetime.

If you save a scan to your history or favorites, the saved scan includes the original image plus the AI result, stored against your account so you can return to it.

Data retention

Account and subscription data: kept while you have an active account. If you delete your account, we erase your records within 30 days, with the exception of any payment records we are legally required to retain for tax purposes.

Saved scans and grow data: kept until you delete them. You can delete an individual record from inside the app or wipe everything via Settings → Privacy & Age.

Server logs: kept for up to 90 days, then automatically purged.

Your rights

You can request a copy of your data, ask us to correct inaccurate data, or ask us to delete your account at any time by emailing the address below. If you are in California (CCPA), the EU/UK (GDPR), or another jurisdiction with applicable privacy law, you have the rights granted under those laws and we will honor them.

Children

StrainSpotter is for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

Changes to this policy

If we make material changes to how we handle your data, we will update this page and, where required, notify you in the app or by email.

Contact

For privacy questions or data requests, email privacy@strainspotter.app.