Your data. Your choices.

Privacy Policy

Effective date: 24 October 2026

This Privacy Policy explains how PlantLeap handles personal data when you use the PlantLeap app and related services. PlantLeap is designed to make plant-based eating easier while collecting only the information needed to provide, secure and improve the service.

1. Who is responsible for your data

PlantLeap is independently operated in France. The identity and contact details of the individual responsible for personal-data processing are available in the Legal Notices. For privacy questions and requests to exercise your rights, email privacy@plantleap.app. Publisher and hosting details are available in our Legal Notices. An individual residential address is not published in this privacy policy; any separate statutory trader or business-address disclosures must be completed where legally required.

2. Account and profile data

When you create or use a PlantLeap account, we may process your email address, internal user identifier, authentication information and the profile information you choose to provide. This can include onboarding answers, food preferences, plant-based goals, dietary preferences, support needs and progress through PlantLeap features.

2A. Website beta signups

If you apply for early access through plantleap.app, we collect your email address, device platform, country, preferred website language, consent and signup timestamp to manage beta invitations and related launch communications. Signup is optional and based on consent; you may withdraw at any time by emailing privacy@plantleap.app or using our data request page. These details are kept only as long as needed for beta and launch communications, unless a limited retention obligation applies.

If you select Other because PlantLeap is not yet offered in your country, you can instead send a separate country-interest request. We collect your email, requested country, site language, consent and submission time to assess where to expand and to contact you about availability. Such requests do not place you on the beta list and never trigger beta invitations. We keep these details only as long as reasonably needed to review expansion interest, unless law requires longer. You can withdraw your consent or request deletion using the contact options above.

2B. Website contact requests

If you contact PlantLeap using our website form, we collect your name, email address, message, enquiry category, preferred language and submission time to respond and manage follow-up. We also retain a pseudonymous fingerprint for abuse prevention and rate limiting. This information is not used for marketing. Access is restricted to authorised administrators and email delivery providers. Contact requests are kept only as long as reasonably needed to resolve and document the enquiry, unless legal obligations require otherwise. You may request access or deletion using the contact details above.

3. Activity and content you create

PlantLeap stores activity needed for features you use, including saved products, favourites, grocery lists, scans, swaps, recipes, Path and habit progress, challenges, saved places, recently selected stores and restaurants, and account actions. If you submit product details, store sightings, corrections, photos, recipes, restaurant information or other contributions, we process the content, its attribution and moderation status. Your device may also keep local preferences and short-lived caches.

3A. Community Circles, profile visibility and safety

If you join Community Circles, your chosen username and PlantLeap avatar may be visible alongside posts, comments and other interactions. We process posted text, its language, associated content links, reactions and relevant membership, reports, muting and moderation records. Contributions that you publish may be read by other eligible Circle members. Avoid posting private or sensitive information about yourself or others. You can report content, mute members where available, and remove your own contributions through applicable controls; moderation may also restrict or remove content.

3B. Optional Circle translations

Circle translation is user-initiated: only when you request it may the original text of a post or comment be sent to DeepL to return a translation. Original posts are not replaced. DeepL has its own privacy terms.

4. Camera and photos

PlantLeap may request camera access for barcode scanning and related product features. If you choose to upload a photo, the selected image is processed only as needed to provide the feature you requested. We do not require unrestricted photo-library access where a system picker or other privacy-preserving method is sufficient.

5. Location

When you request a nearby feature and permit location access, PlantLeap may use foreground latitude and longitude to find nearby stores, restaurants or relevant places. Coordinates pass through PlantLeap's Supabase services and may be submitted to Google Places for requested results. The nearby-store cache on your device is designed to expire after approximately seven days. Separately, places you deliberately select may be saved to your account as a recent-places list. PlantLeap does not build a continuous GPS movement history or use precise location for third-party behavioural advertising.

6. Notifications

If you enable push notifications, PlantLeap may associate an Expo push token, device platform and notification preferences with your account to send requested product, community or other personalised alerts. Some progress or habit-maintenance reminders are scheduled locally on your device; their on-device settings may be stored in local app storage. You can disable alerts in available app settings or through your device's system notification settings.

7. First-party analytics

PlantLeap uses privacy-minimised, first-party audience measurement to improve the app. It stores only daily aggregate counts for general screen categories and interaction types, grouped by the selected country market and platform (iOS, Android or web as applicable). Analytics records do not contain account IDs, email addresses, names, device IDs, session identifiers, precise visit times, free-text searches, item identifiers or location coordinates. No individual visitor timeline or unique-user count is available from this data. These aggregate counters are deleted after 90 days. App functions such as scans, saved items and community contributions may separately process account data as explained elsewhere in this policy.

8. Subscriptions

Where PlantLeap+ subscriptions are available, Apple App Store or Google Play handles payment and billing. PlantLeap integrates RevenueCat for subscription status, entitlements, purchase restoration and related purchase events. RevenueCat may process your PlantLeap account identifier and purchase/entitlement details to provide those services. PlantLeap does not collect full payment-card numbers from app-store purchases. Deleting your PlantLeap account does not itself cancel a subscription with Apple or Google.

9. Why we use personal data

We use account and profile details, saved activity and contributions to provide PlantLeap and fulfil our terms with you; optional location, camera and notification permissions support features you choose to use. We use relevant preferences and requested consent for beta messages, optional communications and other consent-based processing. We use proportionate security logs, fraud prevention, moderation, service diagnostics and limited first-party usage analytics for our legitimate interests in securing and improving the service, subject to your rights. We process transaction and other records when required to meet legal obligations. You may withdraw consent for consent-based processing without affecting its previous lawfulness.

10. Service providers and sharing

PlantLeap uses service providers only for relevant features and operational purposes. These may include Supabase (accounts, database, storage and functions), Vercel (website hosting), Google (sign-in and Places), Apple (sign-in, app distribution and purchases), Google Play (distribution and purchases), Expo and associated push infrastructure (notifications), RevenueCat (subscriptions), and DeepL (requested Circle translations). When you actively request a translation, the selected post or comment text is sent to DeepL through PlantLeap's backend; this is not performed automatically. We do not sell personal data or currently use third-party behavioural advertising. Providers may receive only the data relevant to the service used.

11. Retention and deletion

Account information, saved items and progress are generally kept while your account is active or while needed for the requested feature. Recently selected places may remain in your account until removed under relevant deletion rules; nearby-store device caches are designed to expire after about seven days. If you delete your account, linked personal data and identifiable contributions are removed or anonymised unless limited legal, security, fraud or dispute-related retention applies. Shared catalogue content may be retained only when no longer attributable to you and permitted by law. Separate app-store subscription records remain subject to Apple/Google retention rules. For individual data deletion, see Delete personal data; to delete your account, see Delete account.

12. Your choices and rights

You control optional camera, location and notification permissions through device settings. You can initiate account deletion in PlantLeap via Account > Security, use our account-deletion page if you cannot sign in, or request deletion of selected data using our data-request page. Where applicable, you may request access, rectification, erasure, portability, restriction or objection, and withdraw consent by writing to privacy@plantleap.app. We may verify account ownership. You may complain to your supervisory authority, including the CNIL in France.

13. International transfers and security

Some service providers may process information outside your country or outside the European Economic Area. Where required, PlantLeap will rely on a legally recognised transfer mechanism. We use technical and organisational measures intended to protect personal data, but no online service can guarantee absolute security.

14. Children

PlantLeap is a general plant-based lifestyle service and is not designed to knowingly collect personal data from children where parental authorisation or another legal basis is required and has not been obtained. If we learn that personal data was collected contrary to applicable child-privacy requirements, we will take appropriate steps to address or delete it.

15. Changes and contact

We may update this policy when PlantLeap features, providers, legal requirements or data practices change. We will communicate material changes where required. Questions and data-rights requests: privacy@plantleap.app. You can also read our Terms of Service and Legal Notices.

The app-store privacy disclosures and this policy should always describe the same real data practices. If PlantLeap adds a new data use, this policy and the relevant store disclosures must be reviewed before release.