Last updated: September 2026
This page explains, plainly, what data the IQtent app collects, what it's for, where it goes, and what control you have over it. There's no hidden fine print — if anything here isn't clear, write to support@iqtent.com.
Data controller: Luis Fleming, Matosinhos, Portugal — support@iqtent.com. This is who to contact about anything to do with your data.
IQtent is an app for following the light and the growth in an indoor LED tent, plant by plant. We do not collect health data, financial data (beyond what's needed for payment), or any special category of data.
You can use IQtent without creating an account. In that mode, your tent and plant configuration is stored only on your own device (local browser storage) and never reaches our servers. Creating an account is optional and lets you sync across devices, access the app from the web, and use Pro features.
If you create an account, we use Supabase (a backend provider; this project is hosted in London, United Kingdom — a country covered by a European Union adequacy decision) for authentication, database, and file storage.
| Data | What for | Legal basis |
|---|---|---|
| Email, username, and password | Create and authenticate the account. The password is never stored as plain text. | Contract performance |
| Tent and plant configuration | Making the app work and syncing across your devices. | Contract performance |
| Subscription status | Knowing whether the account is Pro. | Contract performance |
We don't sell, share, or use your data for advertising — IQtent has no ads and no third-party tracking for marketing purposes.
Photos have two modes, and the difference is real — it's not just a sync preference.
The photo is saved in the device's own internal storage (IndexedDB). It never goes through our servers and never lives in your account. What syncs is only an internal photo identifier, never the image itself. Practical consequence: if you open your account on another phone, those photos won't be there — the app marks them as saved on another device. If you uninstall the app or clear its data, they're gone, and we have no copy and no way to recover them.
The photo is uploaded to a private storage space in Supabase, accessible only through your account. That's what lets you see it across multiple devices. You can delete any photo at any time, and deleting your account deletes them along with everything else.
The camera is used in exactly one place: the Augmented Reality studio, to show your space with the light grid overlaid on it. The image is drawn on screen in real time and is never recorded, saved, or sent anywhere. Closing that screen ends camera access. Permission is requested at that moment, and declining it only disables that view.
On Android, that view runs on ARCore (Google Play Services for AR), which is provided by Google LLC and governed by the Google Privacy Policy. ARCore processes camera and motion-sensor data on the device to detect surfaces; IQtent itself never records, stores or uploads that image.
Approximate location is used in exactly one place: the weather card in the Today tab, which shows outdoor conditions to help you anticipate ventilation and humidity needs in your tent.
When you allow it, your coordinates are sent to two external services, which receive them with no identifier tying them to your account:
We don't store your location on our servers. If you decline the permission, the app uses a default location and marks it as estimated — it keeps working, just not about your actual place.
The AI tab only sends data when you actively use it — asking something or analyzing a plant photo. It's never used at any other time.
Your messages (and the photo, if you attach one) are sent to our server and then to a language-model provider to generate the reply. The provider is chosen on our side, not by the app or by you; today it can be:
There is no option today, on your end, to choose the provider or keep the processing on your own device.
We don't keep your AI conversations beyond what's needed to generate the reply in real time; the conversation history lives on your device, not on the server.
If you report an AI answer, the answer, the question that led to it and any note you add are stored on our server so we can review it. Reports are deleted together with your account.
Pro subscription payments are processed by Stripe (via web checkout) or by the app store (Google Play/App Store), depending on where you subscribe. We never see or store your card number — that's handled entirely by the payment processor. We only store the subscription status (active, cancelled, renewal date) to know whether the account is Pro.
In the Android app, Google Play purchases are verified through RevenueCat (United States), which receives your account's internal identifier and the purchase receipt from Google Play — never your email or name.
Reminders are local notifications scheduled by the app on your own device. No identifier, token or schedule is sent to our servers, and turning them off simply cancels them on the device.
We use Sentry to be alerted when something goes wrong in the app — a technical error (e.g., a function that failed), never the content of your plants or photos. We don't tie error reports to your identity. Reports are stored in the European Union (Germany).
To understand which screens are used and where people give up before paying, the app sends a short list of named events (onboarding finished, paywall seen, purchase started or completed, optimizer applied, plant added) to PostHog, hosted in the European Union. There is no cookie and no persistent identifier: nothing links one session to the next or to your account, no clicks or URLs are recorded, and no session is replayed. Your browser's "Do Not Track" setting switches it off. It is switched on only in builds configured for it; it is never used to serve advertising.
| Processing | What for | Legal basis |
|---|---|---|
| Account, configuration, cloud photos, subscription status | Making the app work and sync. | Contract performance |
| Questions to the AI Advisor (text, tent numbers, attached photos) | Generating the reply. | Consent, asked before the first question |
| Approximate location | Weather on the Today tab. | Consent (device permission) |
| Technical error reports | Knowing when the app fails and fixing it. | Legitimate interest in keeping the app working |
| Usage events, without an identifier | Understanding which screens are used. | Legitimate interest |
| Reports of AI replies | Reviewing and fixing wrong replies. | Legitimate interest |
The main infrastructure (Supabase) is in the United Kingdom, a country covered by a European Union adequacy decision. Sentry and PostHog are hosted in the European Union. Beyond that, there are these transfers, all tied to features that only run on your initiative:
For as long as your account exists. When you request account deletion, we delete the data stored in our systems — configuration, cloud photos, and history — immediately, including reports of AI replies. Our provider's daily backups (Supabase) disappear after 7 days. Billing records stay with Stripe and Google Play for as long as tax law requires of them. You can delete your account in the app itself (Profile) or ask us by email.
Under GDPR, you have the right to:
To exercise any of these rights, write to support@iqtent.com. We respond within 30 days.
If this policy changes in a meaningful way, the date at the top of this page is updated, and we flag it in the app when the change affects what we collect or share.