Privacy policy

Niwa is a plant care app published by i4c studio. This page says what the app does with information, in plain words. Questions go to support@i4c.studio.

The short version

• No account, no sign-in, no ads, and no analytics or tracking tools in the app.
• Your plants, schedules and records are stored on your phone. If you never turn on household sync, none of it is sent to us.
• Household sync is optional. When it is on, the household's data is kept on Niwa's server so the phones can share it.
• Payments are handled by Polar on the web and by Google Play in the Android app. Niwa never sees your card.
• This website (not the app) counts visits with Vercel Web Analytics, without cookies.

What stays on your phone

Plants and what you note about each one (kind, where it lives, light, pot size, tags such as “Toxic to pets”), care schedules (watering, fertilizing, misting and the rest), check-offs, the things you log (watered, fertilized, misted or a note), records (photos, notes, repotting and issues you noticed), photos and your settings live in the app's database on the device (the browser's IndexedDB, or the same thing inside the Android app). Appearance choices are kept in the browser's local storage. Niwa does not need an account and does not ask for your name, email or location.

The home-screen widget (Android)

If you add Niwa's widget to your Android home screen, it shows the first lines of Today: plant names, task titles and times. Anyone who can see your home screen can read them. The widget gets them from a small file the app keeps on the phone, which Android's device backup leaves out. It holds no notes, records or photos.

Household sync (optional)

If you turn on sync, or join a household with a pairing code, Niwa sends the household's data to its server so your other phones can get it:

• the household name and the people in it (the names you chose),
• for each phone, a label made of your name and the phone's model (for example “Ana (Pixel 8)”, or “Browser” on the web) and when it last synced,
• plants (with their tags), schedules, check-offs, logs and records; when you delete one, the server keeps a deleted copy so the deletion reaches every phone,
• the photos attached to plants and records. When a photo is removed or replaced, or its plant or record is deleted, and nothing else in the household uses it, Niwa deletes it from the server too.

The shared copy stays until someone deletes the household data. Stopping sync on every phone does not delete it.

The server is hosted on Vercel and keeps its data in a Neon Postgres database. Each phone gets its own key when it turns on sync, joins or restores; the server keeps only a one-way fingerprint of it (a hash, which cannot be turned back into the key) and asks for the key on every request. The data itself is stored as readable records on the server. We do not read it, and we do not use it for anything except syncing your phones. We do not claim the stored data is hidden from the people who run the server.

Everyone in the household can see its list of phones in Settings: each phone's name, its label with the phone model, and when it last synced. Any member can remove another phone from the household. A removed phone stops syncing and keeps what is already on it.

For each phone the server also keeps how it joined (turned sync on, a pairing code, the license key, or the update to per-phone keys), when it joined and last synced, and, if it stopped syncing or was removed, when and which phone removed it. Every member's app can read these records: for phones still in the household, and for removed ones during the 30 days after the removal. The server itself keeps them, and the removed phone's name and colour, for as long as the household's shared copy exists. Deleting the household data removes them all.

A pairing code is eight digits, works once and expires after 10 minutes. It carries no key: claiming it makes a new key for the new phone. Expired codes are deleted the next time anyone uses pairing.

Hosting providers see ordinary connection details such as IP addresses in their logs. Niwa's server uses the address only to limit repeated requests.

Buying the unlock

• The unlock is a one-time purchase for the household (to share with your household). On the web it is handled by Polar, who acts as merchant of record. Polar takes the payment and holds the buyer's email address and receipt. Niwa never sees card details. In the Android app from Google Play it is bought through Google Play instead (below).
• You get a license key. When you enter it, the app checks it with Polar (through Niwa's server, or directly if the server is unreachable). Turning on sync sends the key to Niwa's server, which checks it with Polar again before it creates the household; the server never stores the key itself.
• Polar labels each activation with the platform (Android or web) and a short device code. On Android that code is a one-way fingerprint of the phone's Android ID (a salted hash), not the Android ID itself. On the web it is a random code made by the app.
• If sync is on, the server also stores a one-way fingerprint of the license key linked to the household, and which phone's key linked it. That link is the household unlock (one key unlocks one household at a time), and it is what lets the license key restore the household on a new phone. The server also keeps Polar's id for the key (not the key), when the key was last checked, and when it last moved from another household. It re-checks the key with Polar about once a day. If the key was refunded, the link is removed and the server records when: after a refund, within a day the household stops syncing. Every phone keeps its plants and records. Entering a license key on any phone in the household turns sharing back on. If the key stops being valid for another reason, the link is removed and the household keeps syncing without the unlock. Whoever holds the license key can claim it for a new household at most once a month; a household can pause recovery in Settings to stop that. If the phone that linked it is removed from the household, the link stays with the household. The member who removes it can also pause recovery; the server then records when and by which phone, and the key restores nothing until someone in the household enters it again. Deleting the household data removes the link and that record.

Buying in the Android app (Google Play)

• In the Android app from Google Play, the unlock is bought through Google Play. Google processes the payment under its own terms and privacy policy, takes the payment details and sends the receipt. Niwa never sees card details, your name or your email address.
• After a purchase, the app sends Google Play's purchase token to Niwa's server, which asks Google whether the purchase is real and paid before anything is unlocked. The token stays on your phone so the app can do this again; it is never shown and never included in support details.
• The server never stores the token itself. For a purchase linked to a household it keeps a one-way fingerprint of the token (a hash, like the license key's), Google's order number, when the purchase was made and whether it was a test purchase. That link is the household unlock, and it lets the same Google account restore the household on a new Android phone. It follows the same rules as a license key above (once a month at most to a new household, recovery can be paused), and deleting the household data removes it.
• To notice refunds, the server reads Google's list of refunded and canceled purchases of the app. For each one it keeps the token's fingerprint, the order number, when and why it was voided, so a refunded purchase cannot unlock a household again. These records are deleted after 400 days. After a refund the household stops syncing, as described above for a refunded license key, and every phone keeps its plants and records.

Android permissions

The Android app asks for permission to show notifications and to schedule exact alarms, so reminders arrive on time. It also uses the internet (for sync and license checks), vibration (a small tap when you check something off), and the system settings that let reminders come back after the phone restarts. It does not ask for your location, contacts, camera or microphone. Photos come from the system camera or file picker you choose in.

Files you export

Backups (JSON) and CSV exports are files you create yourself, and they are saved or shared wherever you choose. Niwa does not send them anywhere. Whoever you give a file to can read it.

Deleting your data

You can remove everything from your phone, and the shared copy from our server. See how to delete your data.

This website

The pages at niwa.i4c.studio outside the app (this page, the home page, support and delete-data) use Vercel Web Analytics to count visits. It records the page, the referring site, the browser, the operating system, the device type and the country, without cookies and without anything that follows you to other sites. Visits on the same day are told apart by a short-lived fingerprint of the request that Vercel discards after a day, so we only ever see totals. The web app at /app/ and the Android app do not use it.

Children

Niwa is not directed at children and we do not knowingly collect information from them.

Changes

If this page changes in a way that matters, the effective date above changes with it.

Contact

i4c studio, support@i4c.studio.