Privacy Policy

Last updated: 21 October 2026

Garden helps you track and sustain recovery from a habit you are trying to change. Because that is sensitive by nature, the app is built so that almost everything you record stays on your own device. This policy explains the exceptions plainly.

Garden has no accounts. You never create a login, and we never ask for your email address, phone number, or date of birth.

Garden is operated by LVR SERVICES LTDA (CNPJ 66.359.636/0001-32), Brazil, which is the controller of the limited personal data described below. You can reach us at support@sobergarden.app.

1. What stays on your device

Everything you record in Garden is stored locally, in the app's own storage on your phone. It is not uploaded to us, and we cannot read it:

• Your check-ins, streak, start date, and garden
• The habit you are working on and your reasons for stopping
• Your first name, as entered during onboarding
• Money-saved settings and daily-spend estimate
• Mood entries and milestones
• Your chat history with Hope
• Your answers to the onboarding questions: your first flower, what you tried before, your hardest times, hours a week, costs, your goal, how you heard about Garden and anything you write in your own words
• App preferences (theme, language, notification times) and, if you used the older in-app trial, when it started

Apart from Hope (section 2), the one exception is anonymous analytics events (section 4), which can note that a check-in happened, whether it was a lapse and the mood you picked. The records themselves stay on your device.

Deleting the app removes all of it. Settings → Erase data erases it without uninstalling. Neither action is reversible, because we hold no backup copy.

2. Talking to Hope sends data off your device

Hope, the in-app chat companion, is the one feature that sends what you write off your device. It cannot work otherwise — the reply has to be generated somewhere.

When you send a message, the following is sent to our server and then to OpenAI, which generates the response:

• The message you typed and recent messages in the conversation
• Your first name
• The habit you are working on
• Your sobriety day count and current streak
• The reasons for stopping that you entered
• Your most recent mood entry
• Your language, the region set on your device (our server uses it only to choose the crisis lines Hope can mention), and a random identifier (see below)

OpenAI processes this to produce a reply. We do not store your conversations on our servers; messages are used to produce the reply and are not kept by us afterwards. OpenAI may keep API requests, including your messages and its replies, for up to 30 days to monitor for abuse. Messages already sent cannot be recalled from OpenAI.

Your permission comes first. The first time you open Hope, before your first message, Garden asks once whether it may send the data above to OpenAI through our server. Nothing in this list is sent until you tap Allow. If you choose Not now, or later switch it off in Settings, Hope sends nothing. Every other feature in Garden works offline, apart from the anonymous analytics in section 4.

3. The random identifier

The first time you use the chat, Garden generates a random identifier (a UUID) and keeps it on your device. It is used only to enforce rate limits and prevent abuse, so one device cannot overload the service.

It is not your name, your email, your device's serial number, or your advertising ID. It is not linked to your identity, and we cannot use it to find out who you are. Erasing your data generates a new one.

Our server also sees the network address (IP address) of each chat request and logs it together with this identifier for abuse prevention. Message text is never logged.

4. Analytics

Garden uses PostHog to understand how the app is used in aggregate — for example, how many people finish onboarding, and where they get stuck.

We send product events (screens reached, features used) and technical properties such as app version, device model, operating system version, and language, tied to a random analytics identifier. PostHog also derives an approximate location (country and city) from the network address of the request; we do not store the address itself. The type of habit you chose is included as a category (for example "alcohol") so we can learn which habits people use Garden for.

Events can also include whether a check-in recorded a lapse and the mood you picked, whether you have Garden Plus or a free trial started through the App Store or Google Play, whether a free trial was offered to you and whether you started it, which plan and price you looked at or bought, how many messages you sent Hope in a day, and whether you allowed Hope to send data to OpenAI. They never include the text of your messages, your name, or your reasons for stopping.

During onboarding, events can also record which step of the intro story you reached or skipped and how long you spent on it, whether you signed the in-app deal and how (by holding the button or with an accessibility action), and a few of your answers as categories and counts: how often and how long ago you used, how many reasons you chose, and whether you added a savings amount. The words you type, the text of the deal, your name and your reasons are never sent.

Two of your onboarding answers are also kept as anonymous properties that travel with later events, so we can tell which choices lead people to stay: how you first heard about Garden (a choice from a short list, for example a friend, social media or a store search) and the milestone you picked as your goal (for example 30 days or one year). They are not your words and they never include your name. The rest of your onboarding answers stay on your device and are not sent to us, to PostHog or to Hope. Screens that show your answers are masked in session recordings.

Help button. When you use the help button, we record which type of help you tapped (for example a crisis line or the breathing exercise), never anything you type, and the screens are masked in recordings. We do not record how you answer "Are you safe right now?".

Session recordings. To see where the app is confusing, PostHog records how the screen is used during a session — which screens appear, where you tap, how you scroll. Recordings are masked on your device before anything is sent: everything you type, every image, and the entire Hope chat screen are replaced by solid boxes. We do not send your name, your check-ins, your chat messages, or your reasons for stopping as readable content, and no recording can be traced back to you.

5. Subscriptions

Garden Plus is handled by RevenueCat working with the App Store or Google Play. Purchases are processed entirely by Apple or Google — we never see your card details, billing address, or payment information.

RevenueCat receives an anonymous app user ID and your subscription status so the app knows whether your subscription is active. It also receives what the store reports about a purchase or a free trial: the plan and its price, the currency, whether a free trial is running or was used, when it ends and whether it will renew, and the language and region settings of your device. The free trial of Garden Plus is run by the App Store or Google Play, and RevenueCat passes its status to the app. If you started the older 7-day trial inside the app before version 1.0.3, that one is tracked on your device only.

6. Notifications

Reminders are scheduled and delivered locally by your device. Garden sends no push notifications, and registers no push token. Nothing about your reminders leaves your phone.

7. Who your data is shared with

Only the processors named in this policy, each for the single purpose described:

We do not sell your data. We do not share it with advertisers, data brokers, or insurers. There is no advertising in Garden and no ad tracking.

8. Your rights

Because your data lives on your device and we hold no account for you:

• Access and export: while you have access to Garden, everything it knows about you is visible inside the app. Without Garden Plus the app stays locked apart from the help button, but nothing is deleted: your data stays on your phone and opens again when you subscribe or restore. We hold only the anonymous analytics described in section 4. You can write to us to ask what that includes.
• Deletion: delete the app, or use Settings → Erase data while you have access. Both are immediate and complete on your phone. We hold no copy.
• Withdrawing consent for Hope: turn off Settings → Privacy → AI chat data sharing. Hope then sends nothing to OpenAI. Messages already sent cannot be recalled from OpenAI (see section 2). Erase data also resets this choice, so Garden asks again.

If you are in the EEA or UK, our legal basis is your consent for analytics, and performance of the service for chat and subscriptions. You may contact us to exercise any right under the GDPR.

9. Children

Garden is not directed at children and is rated for adults. We do not knowingly collect information from anyone under 16.

10. Changes

If this policy changes materially, we will update the date above and note the change in the app's release notes.

11. Contact

LVR SERVICES LTDA — CNPJ 66.359.636/0001-32

Questions, requests, or complaints: support@sobergarden.app