momirootPrivacy Policy
Last updated: 13 October 2026
This policy explains what data the momiroot app collects, why, who we share it with and what your rights are. It applies to users in Brazil (LGPD), the European Union and the United Kingdom (GDPR / UK GDPR).
Who we are
momiroot is provided by Lifter Digital, CNPJ [CNPJ], [address], Brazil, the controller of your data. Privacy contact: [email protected].
Data we collect
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email and password (stored only as a cryptographic hash) | Create and secure your account and let you sign in | Contract |
| Homes, rooms, plants, nicknames, position and light conditions of each plant | Build your care schedule and sync across devices | Contract |
| Watering records (date, time and who watered) | Care history and reminders | Contract |
| City of each home (name and approximate city coordinates) | Show the weather and adjust watering tips | Contract |
| Members of shared homes (name and email visible to other members) | Caring for plants together | Contract |
| Crash reports (screen, app version, device model and OS) | Find and fix bugs | Consent (can be turned off in the app) |
| Anonymous usage statistics (e.g. plants added, waterings logged) | Understand what to improve | Consent (can be turned off in the app) |
Crash reports and statistics never include your name, email, photos, precise location or your plants' nicknames. We do not sell data, show ads or use your data for advertising.
Data that stays on your device
- Photos (avatar and plants) stay on your device and are not uploaded to our servers.
- Location: if you allow it, it is used once to find your home's city. Precise location is not stored; we keep only the chosen city.
- Notifications: reminders are scheduled on your device.
Who we share data with
We use providers that process data only to run the service, under contract:
- Cloudflare — network, security and hosting of catalogue images.
- A cloud PostgreSQL database provider — storage of your account and plants.
- Open-Meteo — city search and weather; receives only the city name or coordinates, never account data.
- BigDataCloud — turns your location into a city name when you use "Use my location"; receives only the coordinates, never account data.
- Sentry — crash reports, if you allow it.
- PostHog (EU servers) — usage statistics, if you allow it.
- Apple and Google — process Premium subscriptions; we never receive your card details.
Some providers may process data outside your country. In those cases we rely on the safeguards required by the LGPD and GDPR, such as standard contractual clauses.
How long we keep data
We keep data while your account exists. When you delete your account we erase your personal data within 30 days, except where the law requires us to keep it. Crash reports are deleted automatically within 90 days.
Your rights
You can at any time access, correct and export your data, ask us to delete your account and all data, withdraw consent (in Profile → Privacy in the app) and object to processing. Email [email protected]; we reply within 15 days. You may also complain to your data protection authority (ANPD in Brazil, the ICO in the UK, or your EU authority).
Children
momiroot is not directed at children under 13 (or 16 in some EU countries) and we do not knowingly collect children's data.
Security
All traffic is encrypted (HTTPS), passwords are stored only as hashes and access to data is restricted. No system is 100% secure; if an incident affects you, we will notify you as required by law.
Changes
If we make an important change, we will tell you in the app before it takes effect.