Florapass

Privacy Policy

Effective from 1.11.2026.

1. Data controller

The data controller is Matkala Studios (Business ID 3628345-2), Finland. The service appears under the name Kasvipassi or Florapass; this policy applies to both. In school use, the school is the controller and we are its processor (see section 8). Privacy questions: legal@florapass.app

2. What data we process and why

  • Google account data: name, email address and Google identifier. We use them to create your account and sign you in. Basis: contract (providing the Service).
  • Apple account data (Sign in with Apple): name (if you provide it), email address or Apple's private relay address, and Apple identifier. We also store, encrypted, the sign-in token (refresh token) we receive from Apple so that we can revoke it when the account is deleted; Apple requires this. Basis: contract and Apple's terms.
  • Profile: nickname, region (country) and language. We use them for settings and to tailor species lists. Your nickname is visible to others only if you turn on the public page (it is part of the page's address). Basis: contract.
  • Age: if the app store (App Store or Google Play) provides your age group and you allow it, the app uses it; otherwise we ask for your year of birth once. The year is not stored; only the age group (under 13, or 13 and over) is stored on your device, and it is not sent to us or stored on our server. You can change the age group in the account settings. If you are under 13, the app does not use the device location, the public page or crash reports (see Children), and a public page turned on earlier is turned off. If the age group is not known (for example on a new device), you are treated as under 13 until you answer.
  • Finds: species, date, note and optionally a location point and a place name derived from it (e.g. spot, district and municipality). The place name is looked up on our own server from OpenStreetMap data; the location is not sent to any third party. We store finds for your own plant pass, statistics and achievements. Basis: contract.
  • Find photos: you can attach a photo to a find (one per find in the free version, two with a Plus subscription). The server re-compresses the photo and removes all metadata, such as location and device details, before storing it. The photos are stored in a private Cloudflare R2 storage service in the EU and have no public address: only you see them, signed in to your own app (in school use, your school's teachers too; see section 8). They are not shown on your public page or to other users. A photo may show more than the plant, for example people; do not photograph other people without their permission. The camera and photo library are used only when you add a photo yourself, and you can revoke their permissions in the device settings. Basis: contract.
  • Plant quiz: when you play the quiz, we store for each species you were asked about whether you recognised it (mastery level, number of right and wrong answers and when it was last asked) and how many of your region's species have been unlocked in the quiz. The data is used only to choose questions for you; it is not visible to others. Basis: contract.
  • Public page (optional): if you turn on the "Show on the website" setting on the Account page, your finds (species, date and note, no photos) are visible publicly through a link to anyone, without signing in; you can also separately allow the finds' location to be shown as a place name (e.g. spot, district and municipality). The exact location point, the find photos and the time a find was recorded are not shown publicly. While the public page is on, your latest finds may also be shown anonymously on the website's home page: species and date and, if you have allowed the location to be shown, the municipality and country, without your nickname. Both settings are off by default and you can turn them off at any time on the Account page. Basis: consent.
  • Device location: the app reads the device location only when you ask for it (for example when you add a find at your current location or look for yourself on the map). The location is not stored on the server unless you save a find with a location point. Basis: consent, which you can withdraw in the device settings.
  • Photo identification: when you take a photo or choose one from the photo library for identification, the app sends the photo (or the part you cropped) to our own server. The photo is re-compressed on the device, so its metadata (such as location) is not sent. The photo is processed only in memory and is neither stored nor sent to any third party. If you add a find after the identification, the original (uncropped) photo is suggested as its find photo; you can remove it before saving. It is sent to the server only when you save the find and is handled like other find photos (see Find photos); otherwise it is not stored. For the free version's monthly quota we store only the time and method of each identification; they are deleted after 60 days. Basis: contract.
  • Identification bot: the identification bot, which goes one question at a time, does not store your answers or anything else about you.
  • Sessions: to keep you signed in, we store a hash of the session token, when it was created and used, and the device identifier (User-Agent) the app sends. Basis: contract and legitimate interest (security).
  • Subscription: the status and end date of your Florapass Plus subscription, the store and the product identifier. We do not receive your payment card details. Basis: contract.
  • Server logs: the server logs error situations (time, error code and request identifier). We do not permanently store the IP addresses of requests. Basis: legitimate interest (security and troubleshooting).
  • Crash reports (Android): when the app crashes, Firebase Crashlytics (Google) receives the technical details of the error: the error message and stack trace, device model, Android version, app version and a per-installation identifier. We do not attach your name, email address, finds or photos to the reports. Reporting is off by default; you can turn it on on the app's Account page. Basis: consent.
  • Website: the website (florapass.app) has no cookies, analytics or advertising, and visits are not logged. Fonts and pages come from our own server, species images from Cloudflare (see Species images). The website's language choice is stored only in your browser.
  • Map: map images are fetched from our own server (maps.birdpass.app), not from a third party. Map requests are not logged.
  • Species images: the species images are stored in the Cloudflare R2 storage service and fetched directly from there; your device's IP address is passed to Cloudflare. Some species do not have an image yet.

Providing data is voluntary, but an account (name or email and a sign-in identifier) is necessary to use the Service; location, photos and notes are always optional. We do not make automated decisions or do profiling. We use no analytics and no advertising. We do not sell your data.

3. Who we share data with

  • Google: sign-in and crash reports (Firebase Crashlytics).
  • Apple and Google Play: purchase and billing of subscriptions.
  • RevenueCat: managing and checking the status of subscriptions and subscription statistics (e.g. number of subscriptions and revenue; we do not see individual users' other data there). RevenueCat receives your user identifier and subscription data. RevenueCat receives no data about school pupils.
  • Cloudflare: storage of find photos (private storage in the EU), storage of species images (see Species images) and keeping the database backups. The backups are kept in the EU.
  • Server hosting: the database and the server are located on a server in the EU.
  • The school: in school use, a pupil's data to the school, which is its controller (see section 8).
  • Authorities: only where the law requires it.

4. Transfers outside the EU

Google, Apple and RevenueCat may process data outside the EU, for example in the United States. The same applies to Cloudflare for the species images; the find photos and the database backups, however, are kept in the EU. Transfers to Google, Apple, RevenueCat and Cloudflare are based on the Commission's adequacy decision or on the EU's standard contractual clauses.

5. Retention periods

  • Account, find and quiz data and find photos: until you delete them or your account. When you delete a photo or a find, its photos are deleted from the storage service immediately.
  • Age: the age group is only on your device, not on our server.
  • Photo identification: photos sent for identification are not stored; the times and methods of identifications are deleted after 60 days, at the latest when the account is deleted.
  • Account deletion: immediately deletes the profile, sign-in data, sessions, finds, find photos, quiz data and subscription status from our server. Find photos are not backed up. Other data disappears from the backups as they rotate, within 30 days at the latest.
  • Sessions: expire automatically; expired and revoked sessions are deleted from the server within 30 days and at the latest when the account is deleted.
  • School use: see section 8.
  • Crash reports: Crashlytics keeps them for 90 days.
  • Server logs: rotate automatically, and we do not deliberately keep them longer than investigating errors and security incidents requires.
  • The stores' and RevenueCat's data: purchase data is kept under their own policies and accounting law. Deleting the account from our server does not delete it.

6. Your rights

You have the right to access your data, have it corrected, have it deleted, restrict its processing, object to processing based on legitimate interest and move your data to another service. You can also withdraw a consent you have given (for example the use of location, in the device settings) at any time, which does not affect the lawfulness of earlier processing. You can delete the account and data yourself on the app's Account page, and you can export your data on the same page (finds, account and quiz as tables; we provide the find photos on request). For other requests, contact legal@florapass.app; we reply within a month. In school use, requests are handled by the school (see section 8). You also have the right to lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman, tietosuoja.fi.

7. Children

Children under 13 may also use the Service. We use the age group provided by the app store or ask for your year of birth once; the year is not stored, only the age group (under 13, or 13 and over) is stored on your device and not sent to us, and the age group can be changed in the account settings. For users under 13, the app does not use the device location, the public page or crash reports. If the age group is not known, you are treated as under 13. We do not request or process parental consent. For school pupils, see section 8.

8. School use

A school can acquire a Florapass licence for its pupils. The school (the education provider) is then the controller of the pupils' data and the basis for the processing is its statutory teaching duty; we process the data on the school's behalf under a data processing agreement with the school. The school's own privacy notice describes its processing in more detail.

  • A pupil signs in with the school code and pupil code given by the school or with the QR code on the school's card. The pupil's account holds the pupil code (stored encrypted and as a hash), the group, a nickname given by the teacher (the pupil cannot change it), and the pupil's own finds, find photos and quiz data. The pupil is not asked for their age, name or email. No location is stored for a pupil's finds: the app does not read the pupil's device location, and the pupil has no map. A pupil's account cannot be public and is not shown on the website. A pupil's data does not go to RevenueCat, and no crash reports are sent. A pupil's Florapass Plus comes from the school's licence; the pupil buys nothing.
  • A teacher uses the teacher portal with their own email address and password. We store the teacher's email address, a hash of the password (the password itself is not stored) and the portal's sessions. The school's teachers see, in the portal, the nicknames, finds and find photos of all the school's pupils (so that a find can be confirmed) and can export the finds to the school as a table.
  • Activity log: for changes made in the portal (e.g. a group or card created or deleted) we store the action, the time and who made it (the teacher's email address). Log entries are deleted after 365 days.
  • Retention: a pupil's data is kept until the teacher deletes the pupil (their card) or all of the school's data or the school's licence ends. After the licence has ended, the data is deleted after 90 days: the school, its teachers, pupils, finds and find photos. The data disappears from the backups as they rotate, within 30 days at the latest.
  • Rights: a pupil or their guardian exercises their data protection rights through the school. We refer requests that reach us to the school.

9. Security

We protect data with technical and organisational measures. Session tokens and passwords are not stored in plain text, find photos are in private storage, and access to the server is restricted.

10. Changes

We update this policy when needed. Significant changes are announced in the app. The policy has been drawn up in Finnish. If the translation and the Finnish version differ, the Finnish version prevails.

11. Contact

legal@florapass.app