Grow Your Life

Privacy policy

Last updated: 22 October 2026

Effective from 22 October 2026

This policy covers the Grow Your Life iPhone app and its support, privacy, rules and invitation website. It provides the information required by Article 13 of Regulation (EU) 2016/679 (GDPR). The app is available on the App Store in European Union countries and the United States. See also “If you live in the United States”.

This policy covers versions 1.0 and 1.0.1. Your personal garden stays on your iPhone and, if enabled, in your private iCloud copy. There is no advertising, sale of data or tracking across apps and websites. Analytics are optional, only from age 16 and with your consent.

1. Who is responsible for your data

The data controller is Thomas Nadalet (Gusela Solutions), Via Antole, 58, 32100 Belluno (BL), Italy, VAT number IT01318470257. For privacy, support and safety: info@gusela-solutions.it. You can also write to the postal address above.

2. Your choices and our legal bases

We distinguish between providing the service you request (GDPR Article 6(1)(b)); your optional consent to analytics (6(1)(a)); legal obligations (6(1)(c)); and our legitimate interest in protecting people, data and the service and preventing abuse (6(1)(f)). For legitimate interests, we take account of your rights, especially if you are a child; you can object as explained below.

You do not need to create an app account and can use your personal garden without analytics. iCloud and purchases require Apple services. Data needed for a feature is only required if you use it; responding to an email requires a contact address and enough information about the request.

3. Your personal garden, reminders and sharing

To provide your garden (Article 6(1)(b)), your phone stores themes, activities, plants, diary entries and chosen moods, daily and weekly images and video frames, progress and preferences for language, reminders and how the app addresses you. Garden images are drawn by the app, not taken with your camera. Thomas does not receive this content through ordinary use of the app. It remains until you change or delete it; copies follow the separate arrangements below.

Reminders are local notifications on your phone, kept until delivered, changed or disabled; they do not pass through a server. If you ask to share an image or video, iOS sends it to the app or person you choose (Article 6(1)(b)). That recipient then handles it under their own rules and retention periods: deleting the original does not recall shared copies.

4. Your private iCloud copy and backups

If iCloud is enabled, the app automatically copies your garden to the private Apple CloudKit database so you can recover it with “Find your garden again” on a new iPhone or after reinstalling (Article 6(1)(b), service continuity). The copy includes themes, activities, plants, diary, weekly and video images, progress and preferences. It is encrypted in your iCloud account, uses some of your storage and does not pass through a server run by Thomas. Ordinary developer management tools do not allow Thomas to read or download it.

Old copies from test versions may also contain bees, rewards, blocks and the gift ledger. Recovering this data does not reactivate visits or invitations. The app’s copy excludes age range and acceptance of the old rules, which belong to this phone.

In Settings ▸ “Copy in iCloud”, you can stop updates or delete the copy: turning the feature off does not delete an existing copy. It remains until you delete it through the app or iPhone iCloud settings. “Delete all data” requests its removal, as soon as possible if offline. Reinstalling does not itself delete remote data.

General iPhone backups to iCloud or a computer are separate: they depend on your settings and remain until deleted under Apple’s backup management. Thomas cannot read them. Technical revocation markers, containing no garden content, prevent old copies from restoring deleted data. They remain as long as needed for that purpose, with no preset automatic expiry (legitimate interest in security, Article 6(1)(f)).

5. Features not active in the current version

Visits, invitations, gifts and bees, the hive, the invitation discount, visit safety tools, visit reports and moderation are not active in the current version. No new processing for these features is started in the public CloudKit database, and no gift push subscriptions are activated. Visits and invitations will return in an update after the planned protective measures are completed; we will update this policy and the rules before reactivation. Promo codes on the subscription screen remain available.

6. Data from earlier test versions

For people who used visits and invitations in test versions, the app requests withdrawal of old public records and removal of gift subscriptions. These closure operations may require a connection and the same iCloud account: turning features off does not prove that all remote data has already been deleted. Residual data is handled to complete deletion, prevent republication and respond to requests (Article 6(1)(c) and, for security, 6(1)(f)), only as long as needed. For data still present, including in records created by others, write to info@gusela-solutions.it; copies already obtained by other people are not automatically withdrawn.

7. Age ranges and children

The app is not directed to children under 13, and we do not knowingly collect their personal data. If we learn that a support email is from a child under 13, we reply once, then delete the message and email address from our records. A parent can request deletion by writing to info@gusela-solutions.it.

If Apple reports “under 13”, the app applies “Under 16”: no analytics. The garden copy in the person’s private iCloud remains available; Thomas cannot read it.

During setup, a neutral age-range question offers three equally presented answers, none selected in advance: “Under 16”, “16 or older”, “I'd rather not say”. Where available, the app may ask Apple for your age range (Declared Age Range), using the age threshold of 16. Where required by law, the app may also request it at launch. We do not ask for or store your date of birth. Your phone keeps only the age range and minimum information needed to apply and update protections, until corrected or deleted. We do not publish the age range, send it to analytics or include it in the garden copy. Apple’s signal is an age declaration, not a document-based identity check.

The purpose is to protect minors (legitimate interest, Article 6(1)(f)). Age range controls access to optional analytics: below 16 or without a usable range, TelemetryDeck stays off and consent is not requested. From age 16, consent is still required. Your personal garden remains fully usable. If sources disagree, the more protective result applies. You can correct your answer in “Settings” ▸ “Privacy” ▸ “Your age”.

If Apple does not provide a usable range, your answer applies. With “I'd rather not say”, only what Apple confirms applies; an Apple range spanning age 16 is not enough to enable analytics. A later refusal to share with Apple does not erase a known protection. A less restrictive correction requires confirmation and a new Apple request. When Apple indicates a lower range, you can use “Ask Apple again”. Your range does not increase automatically over time.

Earlier “Under 13” and “13 to 15” answers both count as “Under 16”. Anyone who has not answered receives the question. Changing range does not automatically grant analytics consent or make visits or invitations available in the current version.

Local information includes your answer, what Apple confirms about the age threshold of 16, dates, the rule version and a fingerprint of the iCloud account. Changing the iCloud account on the phone prompts the question again and clears your analytics choice. If you had consented to analytics before the update, that consent is held pending the age answer: it applies again from age 16; below 16 or without a usable range, it is cleared.

8. Requests about earlier tests

You can write to info@gusela-solutions.it about reports or disputes relating to earlier tests, without using visit tools in the app. Thomas and OVHcloud process the correspondence data needed; rights requests rely on Article 6(1)(c), handling disputes and protecting people on 6(1)(f), and legal obligations on 6(1)(c) where applicable. Any existing case files, correspondence and decisions are kept for six months after closure; attachments and copies of content for 90 days. Exceptions for obligations or specific disputes are limited and documented. These periods concern archives managed by Thomas, and do not guarantee simultaneous deletion of provider backups or logs, whose periods still need confirmation.

The 6-month and 90-day periods govern cleanup of records managed by Thomas, including email, exports, downloads and trash. They do not confirm simultaneous deletion of the provider’s backups: backup and log periods and the terms of the OVHcloud mailbox actually purchased still need confirmation. Zimbra terms §7, if applicable to this mailbox, provide for 12 months/one year for certain outgoing emails blocked as spam, fraud or malware, not all email; this does not automatically extend case-file retention. These provider security retention periods are separate from those chosen by Thomas.

9. Anonymous or pseudonymous analytics

Pseudonymous analytics never include diary content or mood. From version 1.0.1, they contain no health information, including theme types. In 1.0, the first-theme event may still include its type, including “health”, without names or content; this information is removed from 1.0.1. The update also discards events containing a theme type still queued on the phone, but not events already sent.

Only from age 16 and with your consent (GDPR Article 6(1)(a) and consent to device access under ePrivacy rules), the app sends counts to TelemetryDeck GmbH, Augsburg, Germany, to understand usage and improve reliability. Without eligibility and consent, the component does not start, send or queue events for later. You can withdraw consent in “Settings” ▸ “Privacy” ▸ “Anonymous statistics”, without losing features. Withdrawal stops transmissions and discards local queues; it does not affect the lawfulness of earlier processing.

Counts cover setup, completed activities, opening recaps and the diary, gardens, offers and subscriptions, with fixed values such as activity type, zone, milestone or plan. Diagnostics may count storage-opening problems without content or file names. We do not send your written text, theme or visit names, titles, notes, diary, activity times, invitation or coupon codes, CloudKit identifiers, email, location or payment details.

The component adds app and system version/build, device model and architecture, screen size/scale/orientation, configured language, region and time zone, appearance and text direction, accessibility settings (text, contrast, motion, transparency, colours), event date/time and periods, App Store/TestFlight/simulator environment, component version, first use, usage days and session counts and durations. Sessions have a random code; launches and sessions are also counted. TelemetryDeck records receipt.

A code derived from the iOS device identifier for the developer is transformed on the phone using SHA-256 and an added value, then transformed again by the provider. TelemetryDeck says it does not retain IP addresses. These measures reduce identifiability, but transforming an identifier alone does not prove anonymity: we therefore describe the analytics as pseudonymous. Thomas sees results in the provider’s dashboard; they are not used for advertising or linked with other websites and apps. We will not try to identify people from pseudonymous analytics or link them to identifying data.

Events already sent follow TelemetryDeck’s stated retention: there is no guaranteed deletion schedule; the provider anticipates 7–10 years without guaranteeing this, and account closure does not necessarily remove events. We do not promise automatic deletion after 12 months. You can exercise the rights below for personal data that remains identifiable; genuinely anonymous aggregates cannot be separated into one person’s data. TelemetryDeck privacy FAQ (checked on 14 October 2026).

10. Purchases, subscriptions and TestFlight

Apple handles sales and payment. The app uses product, verified transaction, status, dates, renewals, revocations and offers to unlock and restore purchased features (Article 6(1)(b)), for as long as needed to verify entitlement. Thomas does not receive card details or the Apple account name or email through this process. Apple keeps history and documents under its obligations; Thomas keeps received statements and documents for the period required by applicable accounting and tax law (Article 6(1)(c)). Any purchase analytics remain separate and require consent.

You can use promo codes from the subscription screen. Apple checks eligibility and redemption; this feature does not create friend relationships or coupon reservations in the public CloudKit database.

If you test the app through TestFlight: Apple automatically collects beta crash and usage data and shares it with Thomas; this may include your name and email depending on the invitation type. Feedback you choose to send, including any screenshots, is a separate flow. This collection is separate from optional TelemetryDeck analytics: turning those analytics off does not stop TestFlight diagnostics, which you cannot opt out of during testing. Thomas uses the received data to fix problems and improve the beta (legitimate interest, Article 6(1)(f)). Retention depends on the need to analyse and verify fixes and availability through Apple; a period for local copies remains to be set. The 6-month/90-day report periods do not automatically apply to beta data. Apple’s TestFlight and Privacy (checked on 15 October 2026).

11. Support and privacy requests

When you write to info@gusela-solutions.it, you share your email address, any name, message, attachments and necessary references. Thomas and OVHcloud, which hosts the mailbox, use them to respond: Article 6(1)(b) for service support, 6(1)(f) for general correspondence and 6(1)(c) for rights requests. Avoid diary content or sensitive information that is not needed. We keep the exchange as long as necessary to resolve the request and check its outcome; afterwards, only documentation needed to demonstrate compliance or defend rights, for the duration of the obligation or dispute.

The OVHcloud mailbox sends at most one automatic acknowledgement every 7 days to the same address. Thomas manually acknowledges subsequent messages when he reads them, without undue delay. Messages in spam may not receive an automatic reply; Thomas checks that folder too. The receipt confirms arrival, not review or a decision.

12. The website and GitHub Pages

The static website is hosted by GitHub Pages, with no cookies, analytics or embedded external resources or scripts. GitHub logs IP addresses for security, even without an account, and processes technical request data under its policy. The legitimate interest in providing and protecting the website is the basis for delivery (Article 6(1)(f)); GitHub sets the bases and retention for its own processing in its policy. Thomas does not keep a separate archive of visitor logs. GitHub uses purpose, security and legal-obligation criteria, without a specific Pages log retention period verified here.

The invitation page only shows information about future availability. It does not display, copy or forward codes, names or garden addresses, open the app or query CloudKit. It only uses the link or browser language, without cookies or persistent storage. In old links, data after “#” is not sent to the server; data after “?” reaches GitHub and may enter logs even though the page ignores it. External links open services with their own rules when you follow them.

13. Recipients and transfers outside the EEA

Recipients are Apple for private iCloud, age services, the App Store and TestFlight; TelemetryDeck for analytics you accept; GitHub for the website; OVHcloud for email; Thomas, and any advisers bound by confidentiality and authorities where necessary. Withdrawal of test data also involves Apple CloudKit and removal of old push subscriptions. Providers may use infrastructure and subprocessors to deliver their services.

Apple processes CloudKit data under the developer agreement and processes account, security and purchase data independently. GitHub’s policy covers its own security processing. TelemetryDeck considers events anonymous and its agreement excludes processor or joint-controller status: this position does not remove your rights where data remains personal. OVHcloud hosts the mailbox, with Zimbra webmail. For correspondence hosting, OVHcloud acts on Thomas’s behalf; the provider’s own processing, including security processing, follows the applicable terms. The contracted product, contracting entity and retention of provider copies still need confirmation: webmail alone does not identify the contract.

Apple and GitHub data may be processed in the United States and other countries outside the European Economic Area (EEA). Apple refers to European Commission standard contractual clauses; GitHub refers to those clauses and the Data Privacy Framework for covered transfers. Safeguards depend on the service and recipient: we do not claim every flow is certified or stays within the EU. TelemetryDeck declares EU servers; this alone does not exclude access from other countries. The email provider’s locations, subprocessors and specific safeguards still need confirmation with the provider: we do not guarantee EU-only storage.

Transfers of personal data require an adequacy decision or suitable safeguards, such as standard clauses and supplementary measures where needed. Write to info@gusela-solutions.it for recipient information and a copy or description of applicable safeguards. See also Apple’s policy, GitHub’s policy and TelemetryDeck’s agreement (checked on 14 October 2026).

14. Deleting data

Settings ▸ “Your data” ▸ “Delete all data” deletes the local garden, diary, images, recaps and choices, requests deletion of the private copy and returns the app to setup. Offline, iCloud operations wait and resume with the same account. Uninstalling before completion may leave remote data: contact support if you have difficulties. General Apple backups, shared copies, technical revocation markers and necessary correspondence follow this policy’s specific criteria. Section 6 also applies to earlier tests.

Uninstalling alone does not delete the iCloud copy, and none of these actions cancels your subscription: manage it in iPhone Settings ▸ your name ▸ Subscriptions.

If you live in the United States

The app is also available in the United States. This policy is effective from 22 October 2026. The controller and contact details remain those in “Who is responsible for your data”.

We do not sell personal data or share it for targeted advertising. We do not use targeted advertising or profiling. Data needed to provide services is processed by the providers listed in this policy.

The app is not directed to children under 13, and we do not knowingly collect their personal data. We ask for an age range; where required by law, the app may also ask Apple for it. The range stays on the phone. “Under 13” is treated as “Under 16”: no analytics, while the private iCloud copy remains available. If we learn that an email is from a child under 13, we reply once, then delete the message and address from our records. A parent can request deletion at info@gusela-solutions.it. More about age.

We receive emails you send us and, through TelemetryDeck, optional pseudonymous analytics, only from age 16 and if you turn them on. They never include diary content or mood. From 1.0.1, they contain no health information or theme types; in 1.0, the first theme’s type, including “health”, may still be sent (details). We will not try to identify people from analytics. Apple provides subscription status to the app and sales reports without buyers’ names to Thomas; we do not receive card details.

Under your state’s applicable laws, you can ask what data we process, obtain a copy, correct or delete it, and opt out of processing. Write to info@gusela-solutions.it: we respond within 45 days. If we refuse, you can appeal by replying to our email; we respond to appeals within 60 days, explaining our decision. You can then contact your state’s Attorney General. The GDPR rights described below also remain available.

Do Not Track: we do not track people across websites and services, and no one else does so through the app or website. The browser’s Do Not Track signal therefore does not change how data is processed.

15. Your rights

Write to info@gusela-solutions.it to exercise, subject to the GDPR’s conditions:

We normally reply within one month. If complexity or the number of requests requires up to two additional months, we explain why within the first month. Requests are generally free. We ask only for proportionate information needed to verify your identity and find your data. Never send your Apple password. If we cannot link pseudonymous data to you, we explain this; it is not an automatic refusal of all rights.

You can complain to the Italian data protection authority, the Garante, or the authority in the EEA country where you live, work or believe the infringement occurred, and seek a judicial remedy. You do not need a favourable response from Thomas first.

16. Automated checks and updates

We do not use advertising profiling or solely automated decisions producing legal or similarly significant effects under GDPR Article 22. The age-range check controls optional analytics. You can challenge an error by writing to Thomas. If purposes or this policy change, we publish a new version with an updated date and provide necessary information before new processing; where required, we request new consent.