Privacy Policy

1. General Information

This Privacy Policy describes how Dachamatics collects, stores, uses, discloses and deletes personal data and other information associated with users of the Dachamatics service (“Dachamatics”, “Service”, “we”, “us” or “our”).

Dachamatics is a digital service for planning and managing gardens and growing plots, visualizing beds and plantings, maintaining planting history, working with seeds and harvest records, using supported sensors, and generating forecasts, calculations and recommendations related to garden activities.

The personal data operator is:

• Operator: Карпов Егор Андреевич;
• Country: Russian Federation;
• Email: support@dachamatics.org;
• Website: https://dachamatics.org.

The Operator organizes the processing of personal data and is the person responsible for organizing such processing.

The Service is intended for users located in the Russian Federation. Personal data are processed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“Law 152-FZ”). Provisions concerning users outside the Russian Federation are set out in Section 9.

This Privacy Policy applies to the Dachamatics mobile application, the website https://dachamatics.org and related backend services and is published on that website.

Personal data are transferred outside the Russian Federation to the recipients listed in Section 7 on the basis of a separate document, the Consent to Personal Data Processing.

2. Categories of Data We Process

The data processed depend on the functions the User uses. Data categories are listed in Sections 2.1–2.11; purposes, legal bases and retention periods are set out in Section 3.

2.1. Account and Authentication Data

We process:

• email address;
• password hash;
• Google account identifier, if Google Sign-In is used;
• registration date;
• administrator status, where assigned;
• account status;
• subscription information;
• application and website session information;
• password-reset information;
• IP address in website and administration sessions.

Passwords are not stored in plain text.

Password hashes are generated using scrypt with a random salt.

When the User first signs in with Google using an email address already registered with a password, Google Sign-In is linked to the existing account. Linking removes the account password and revokes its sessions, device push tokens and reminder schedule.

The email address currently does not require separate email verification.

No age is currently collected during registration; age requirements are set out in Section 14.

2.2. Garden and Plot Data

Dachamatics stores information entered or created by the User in relation to gardens, plots, beds and plantings, including:

• garden name;
• garden dimensions;
• city coordinates;
• exact plot coordinates, if provided by the User;
• soil texture and soil type;
• water source;
• plan orientation;
• watering-can volume;
• cellar temperature and humidity;
• calculation settings;
• bed names and shapes;
• greenhouse/open-ground status;
• frost-cover time;
• linked sensors;
• measured soil temperature;
• crops and varieties;
• sowing and planting dates;
• planned and actual harvest dates;
• planting status;
• plant count;
• tree height;
• bud stage;
• journal events;
• free-text notes;
• water volume;
• harvest weight;
• pesticide product information;
• target pest;
• waiting period;
• bed notes;
• map shapes and markers;
• layout information;
• soil test results, including pH, N/P/K, humus and related measurements;
• fertilizer applications;
• watering records;
• seed-lot information, including crop, variety, quantity, purchase date, expiry date and price;
• storage-lot information;
• user-created varieties and growing parameters;
• achievements and related dates.

Garden data are associated with the User's account and as such constitute personal data.

The server stores synchronized garden records as structured data associated with the relevant user account.

2.3. Garden Sharing

Dachamatics allows a User to share a garden with other Users.

For this functionality we process:

• garden identifier;
• owner account;
• participating account;
• participant role;
• invitation information;
• garden name;
• invitation acceptance information;
• timestamps associated with sharing.

A participant sees the garden owner's email address, and the owner sees participating users' email addresses.

A shared garden member receives access to all records of the shared garden, including sensor readings.

Changes made by a co-editor are associated with the co-editor as the last writer.

Users should only share gardens with people they trust.

2.4. Subscription and Entitlement Data

Dachamatics does not process payment-card information or other payment data.

Paid access is granted free of charge:

• by an administrator;
• by activation code;
• through administrative/command-line mechanisms.

The Service stores:

• subscription plan;
• subscription status;
• entitlement source;
• start date;
• expiry date;
• trial dates;
• administrator notes;
• activation-code information;
• redemption information;
• entitlement audit records;
• device-pass information where direct sensor mode is used.

Activation codes and certain related identifiers are stored in hashed form.

2.5. Push Notifications and Reminders

If notifications are enabled, Dachamatics processes:

• Firebase Cloud Messaging token;
• Firebase installation identifier;
• platform information;
• reminder schedule;
• reminder type;
• due time;
• reminder title and body;
• planting identifier;
• sent time;
• device time zone;
• notification preferences;
• quiet-hours settings.

Reminder titles and bodies contain the crop name and bed name.

Push notifications are delivered through Google Firebase Cloud Messaging. The Firebase SDK embedded in the application transmits a Firebase installation identifier to Google.

2.6. Sensors

If the User connects supported sensors, Dachamatics processes:

• hardware/hub identifier;
• sensor/device identifier;
• garden association;
• user-supplied labels;
• claim information;
• creation and last-seen timestamps;
• battery voltage;
• signal-strength information, including RSSI and SNR;
• soil temperature;
• soil moisture;
• air temperature;
• air humidity;
• measurement timestamps;
• receipt timestamps.

Sensor readings do not contain a separate location value. Their location is determined by the garden to which the sensor is linked.

Raw sensor readings are retained for 14 days. Daily summaries are retained until account deletion.

2.7. Technical Data and Logs

We process technical data necessary for authentication, security, rate limiting and operation of the Service, including:

• IP addresses;
• email addresses used as rate-limit keys;
• timestamps;
• session information;
• operational logs;
• error information.

IP addresses and email addresses are used for rate limiting of sign-in, registration, password reset, activation-code redemption and hub claiming. Such rate-limit data are retained for 24 hours.

Website and administration sessions contain an IP address and are retained for 30 days; they are deleted on expiry, or earlier on sign-out or account deletion.

Web-server logs of the entry node contain the IP address, User-Agent and requested page address and are retained for 14 days. The server system journal contains scheduled-job output and error information, including mail delivery errors and the first 8 characters of an invalid push token, and is retained for 30 days.

The application and website contain no third-party SDKs for advertising, analytics or crash reporting.

2.8. Cookies and Local Storage

The website uses cookies necessary for its operation:

• sg_account — account and administration session, 30 days;
• sg_issued_codes — administration functionality for issued activation codes, 5 minutes;
• sg-site-mode — display mode on test servers, 30 days.

Browser local storage is used for interface preferences (theme selection).

2.9. Information Stored Only on the Device

The mobile application stores locally:

• the full local garden data;
• data belonging to shared gardens accessible by the User;
• session token;
• account email;
• installation identifier;
• language;
• theme;
• currency preference;
• temperature scale;
• calculation settings;
• reminder settings;
• calendar-sync setting;
• cached subscription information;
• cached sensor readings;
• reference photographs.

The data listed in this section are not transmitted to the Operator, except for data synchronized with the server in accordance with Sections 2.1–2.6.

With the User's permission, Dachamatics creates calendar entries on the device for reminders.

The operating system may synchronize such calendar entries with the User's calendar account.

The application provides an Android home-screen widget displaying upcoming reminders.

Exports created by the User, including JSON backups, calendar files and plan images, leave the device only through the operating system's share functionality.

Signing out does not remove locally stored garden data. When deleting the account, the User may choose to erase the data on the device.

2.10. Device Permissions

The current application requests permissions relating to:

• notifications;
• calendar read/write;
• starting after device reboot;
• Internet access.

The application does not request:

• device location/GPS;
• camera;
• microphone;
• Bluetooth.

The city name and plot position are entered by the User. If future versions change the set of permissions, this Privacy Policy is updated in accordance with Section 16.

2.11. Records of Document Acceptance

On registration, on first sign-in with Google and on acceptance of a new version of a document, the following are recorded: the account identifier, the document (Terms of Use, Privacy Policy, Consent to Personal Data Processing), its version, the date and time of acceptance and the acceptance channel (application or website).

3. Purposes, Legal Bases and Retention

Personal data are processed only for the purposes listed in the table. For each purpose the table states the data categories, the legal basis under Law 152-FZ and the corresponding basis under the EU General Data Protection Regulation (GDPR), and the retention period.

4. Processing Operations and Destruction

The following operations are performed with personal data:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating, modification);
• retrieval;
• use;
• transfer (provision, access);
• anonymization;
• blocking;
• deletion;
• destruction.

Processing method: automated processing with transmission over the Internet.

Personal data are destroyed when the purposes of processing are achieved, when the retention periods set out in Sections 3 and 10 expire, when consent is withdrawn and no other basis for processing exists, and when unlawful processing is detected. Destruction after the purpose is achieved or consent is withdrawn takes place within no more than 30 days; in the case of unlawful processing, within no more than 10 working days from detection (Law 152-FZ, Art. 21(3)–(5)).

Destruction is performed by deleting records from the server database without the possibility of recovery by means of the Service. Copies in backup snapshots are destroyed together with the snapshot, whose retention does not exceed 30 days.

Destruction of personal data at the request of the data subject or upon detection of unlawful processing is confirmed by a destruction certificate and an extract from the event log in accordance with the Requirements for Confirmation of Destruction of Personal Data approved by Roskomnadzor Order No. 179 of 28 October 2022. Deletion performed by the User in the application is recorded in the server operation log.

5. Automated Recommendations and Predictions

Dachamatics automatically processes User Data and external information to generate forecasts, calculations and recommendations.

Inputs include:

• garden configuration;
• plot location entered by the User;
• crop and variety;
• planting dates;
• harvest information;
• soil information;
• sensor measurements;
• pests and disease information;
• weather information;
• seasonal factors;
• public datasets;
• scientific publications;
• agricultural reference information;
• statistical methods and algorithms.

The resulting recommendations are predictive and informational.

They do not constitute guaranteed instructions or professional agricultural advice. No decision producing legal effects concerning the User or otherwise affecting the User's rights and legitimate interests is made solely on the basis of automated processing.

6. External Data Providers and Services

Open-Meteo. Data sent: city name entered by the User; coordinates; device IP address as part of the network request.

Purpose: geocoding; weather forecasts; historical weather information; frost and heat-sum calculations.

ISRIC — World Soil Information (SoilGrids). Data sent: plot coordinates; device IP address as part of the network request.

Purpose: obtaining soil texture/type suggestions and related information.

Wikimedia Foundation (Wikimedia Commons). Requests for reference photographs disclose the device IP address to Wikimedia Commons as part of the network request.

Google LLC — Firebase Cloud Messaging. Data sent: push token; reminder title and body; planting identifier; the Firebase installation identifier transmitted by the Firebase SDK on the device. Purpose: push notification delivery.

Google LLC — Google Sign-In. If Google Sign-In is used, Google processes the authentication request and Dachamatics receives the relevant account identifier and email address from the verified authentication response.

Email. Password-reset messages are sent by the Operator's own mail server. The message, containing the recipient's address and the password-reset link, is received by the recipient's mail server.

Hosting. The database containing personal data and the entry node (reverse proxy) of the website and server are located in the Russian Federation. The entry node stores no personal data other than the web-server logs described in Section 2.7.

Personal data are not sold or disclosed to third parties for advertising.

7. Cross-Border Transfer of Personal Data

Personal data are transferred across borders to the following recipients:

The legal basis for cross-border transfer is the User's consent given in the Consent to Personal Data Processing (Law 152-FZ, Art. 6(1)(1)).

The Operator notifies Roskomnadzor of the intention to transfer personal data across borders in accordance with Article 12 of Law 152-FZ.

8. Rights of the Data Subject

Under Articles 14–17 of Law 152-FZ, the User has the right to:

• obtain information about the processing of their personal data, including its purposes, methods, periods and recipients;
• require clarification, blocking or destruction of their personal data where the data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to personal data processing;
• appeal against actions or omissions of the Operator to Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media) or in court.

Some rights are exercised in the application: the User edits garden data, exports them to a JSON file and deletes the account independently.

Requests are submitted to support@dachamatics.org. A request contains information confirming the User's relationship with the Operator (the account email address) and other information required by Article 14(3) of Law 152-FZ; a request in the form of an electronic document is signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator responds within 10 working days of receiving the request. The period may be extended by no more than 5 working days by sending the User a reasoned notice stating the grounds for the extension.

9. Users Outside the Russian Federation

This section contains the information whose disclosure is required by the EU General Data Protection Regulation (GDPR) and similar legislation, for cases where such legislation applies to the processing of the User's data. This section does not constitute an offer of the Service in the relevant states.

The controller is the Operator identified in Section 1. No representative in the European Union has been designated.

The legal bases under the GDPR are stated for each purpose in Section 3: performance of a contract (Art. 6(1)(b)), consent (Art. 6(1)(a)), compliance with a legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)). The Operator's legitimate interests are the security of the Service, prevention of abuse and the protection of rights in disputes concerning entitlement operations.

Providing an email address and password is necessary to enter into the contract and create an account. The application works without an account; in that case garden data are stored only on the device.

Data are stored in the Russian Federation and transferred to the recipients listed in Section 7. The European Commission has not adopted an adequacy decision in respect of the Russian Federation; transfers are based on the User's consent (GDPR Art. 49(1)(a)) and on the necessity of performing the contract (GDPR Art. 49(1)(b)).

The User has the right to:

• access their data (Art. 15);
• rectification (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• receive their data in a structured, machine-readable format and transmit them to another controller (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3));
• lodge a complaint with a supervisory authority in the Member State of habitual residence, place of work or place of the alleged infringement (Art. 77).

Requests are submitted to support@dachamatics.org and handled within the periods stated in Section 8.

10. Data Retention

• account data — until account deletion;
• application sessions — 30 days, extended on use; deleted after expiry;
• website and administration sessions, which contain an IP address — 30 days; deleted after expiry, or earlier on sign-out or account deletion;
• password-reset requests — 24 hours;
• rate-limit data (IP address, email) — 24 hours;
• deleted-record markers — 90 days;
• raw sensor readings — 14 days;
• daily sensor summaries — until account deletion;
• entitlement audit records — the user identifier is anonymized 3 years after account deletion;
• backups — no more than 10 snapshots, each no older than 30 days;
• web-server logs (IP address, User-Agent, requested address) — 14 days;
• server system journal — 30 days;
• document acceptance records — until account deletion;
• push token — until sign-out, account deletion, password reset or invalidation by Firebase.

The anonymization period for entitlement audit records corresponds to the general limitation period (Article 196 of the Civil Code of the Russian Federation).

11. Account Deletion

The User deletes the account independently in the application. When deleting the account, the User may choose to erase garden data on the device.

Deletion of an account deletes:

• application and website sessions;
• push tokens;
• reminder schedules and preferences;
• shares and owned invitations;
• subscription information;
• synchronized records associated with the account;
• sensors and associated readings, including daily summaries;
• document acceptance records;
• the account itself.

The owner of a shared garden cannot delete the account while the shared garden has members; the Service lists such gardens, and the owner first ends the members' access.

After account deletion:

• redeemed activation-code records are anonymized;
• accepted invitations are anonymized;
• sensor hubs remain without an owner;
• records the User edited in another user's shared garden remain with that user's garden;
• the user identifier in entitlement audit records is anonymized after 3 years;
• backups contain the data until the snapshot is destroyed, no later than 30 days.

12. Security

We apply legal, organizational and technical measures to protect personal data in accordance with Articles 18.1 and 19 of Law 152-FZ, including cryptographic password hashing, storing hashes of session tokens instead of the tokens themselves, encrypted connections, access controls and rate limiting.

No Internet-based system can guarantee absolute security.

13. Incidents

Upon detecting an unlawful or accidental transfer (provision, dissemination, access) of personal data that has resulted in a violation of data subjects' rights, the Operator notifies Roskomnadzor (Law 152-FZ, Art. 21(3.1)):

• within 24 hours of detection — of the incident, its presumed causes, the presumed harm, the measures taken and the person authorized to communicate on the incident;
• within 72 hours of detection — of the results of the internal investigation and, where identified, the persons whose actions caused the incident.

Users whose data are affected by an incident are notified at the account email address with a description of the incident, the categories of data affected and the measures taken.

14. Children

The Service is intended for persons aged 14 or older. By registering, the User confirms having reached that age.

The current registration process does not collect age information.

If you believe that data of a person under 14 are being processed, contact support@dachamatics.org; such data are destroyed in accordance with Section 4.

15. Future Functionality

Future versions may introduce:

• optional GPS/location access;
• camera/photo uploads;
• plant or garden image analysis;
• additional sensor integrations;
• online payment for paid access;
• other third-party integrations.

Where the categories, purposes or recipients of personal data change, this Privacy Policy is updated in accordance with Section 16 before such processing begins.

16. Changes

We update this Privacy Policy as the Service, its data processing or legal requirements change.

Each version of the Privacy Policy has the designation shown in the document header. The User is notified of material changes and asked to accept the new version the next time the application writes data to the server. Working offline and reading the User's own data are not restricted.

A User who does not accept the new version may stop using the Service and delete the account.

17. Contact

• Operator: Карпов Егор Андреевич;
• Email: support@dachamatics.org;
• Website: https://dachamatics.org.