Sprout Scout

Privacy Policy

Effective 15 October 2026 · Applies to the Sprout Scout iOS app and this website

The short version

  • No account, no sign-in, no ads, no tracking. We don't use analytics, advertising or tracking SDKs, and we never ask to track you across other apps. The app sends only anonymous counts (like "the plans screen was opened"), never linked to you.
  • Your Leafdex is yours. Photos, notes and favourites in your Leafdex are stored on your device and, if you're signed in to iCloud, sync between your devices through your own iCloud. We never see it.
  • Photos you scan are sent to identify them, then discarded by us. Our server passes each photo to an AI service to identify the plant and doesn't keep it.
  • We don't sell or share your data for advertising, and your photos are not used by us or our AI providers to train AI models.
  • Apple handles payments. We never see your name, email or card details.

1. Who we are

Sprout Scout is published by Little Finders Club ("we", "us"). We are responsible for the data described in this policy. You can reach us at support@littlefindersclub.com.

2. What happens when you scan a plant

Identifying a plant needs more computing power than a phone has, so each scan works like this:

  1. Sprout Scout resizes your photo and sends it over an encrypted (HTTPS) connection to our server, which runs on Cloudflare Workers.
  2. Our server forwards the photo to an AI provider: Google (the paid Gemini API). If one Gemini model is unavailable we retry with another Gemini model; your photo never goes to any other AI company.
  3. The AI provider returns the identification, our server sends it back to your phone, and the result is saved in your on-device Leafdex.

Before your first scan, the app asks for your permission to send photos to our server and to these AI providers. If you say no, nothing is sent; you can still browse the app and your Leafdex.

3. Data that leaves your device

WhatWhyWho receives itHow long it's kept
The photo you scan To identify the plant in it (a leaf, flower, tree or houseplant). Our server (Cloudflare), then Google. Our server doesn't store it; it's discarded once the result is returned. The AI provider may keep it for a limited time for safety and abuse monitoring (see section 5), then deletes it.
Your onboarding answers and language setting (for example "Exploring with my kids", "Total beginner", "en_US") So the explanation matches your interests, level and language. Same as the photo, as part of the same request. Same as the photo.
A random install ID Sent with each scan for basic abuse protection. It's a random code created by the app when it's installed, not your Apple ID, advertising ID or any hardware ID, and it isn't linked to your identity. Our server only. We don't pass it to the AI provider. Not stored by us when you're subscribed (see the next row). Deleting the app resets it.
Apple's signed proof of your subscription So only subscribers can run scans, and to apply the fair daily limit (40 identifications a day). Apple signs it; it contains a transaction number and your plan, never your name, email or payment details. Our server only. We don't pass it to the AI provider. We keep only a daily scan count under the transaction number. It is deleted automatically 48 hours after your most recent scan.
The identification result (the text answer, never the photo) So scanning the exact same photo again gives the same answer instantly, without another AI call. Our server's cache (Cloudflare). Up to 30 days, stored under a one-way fingerprint (hash) of the photo. The photo itself can't be recovered from it.
Your IP address and basic connection data Any internet request reveals these. They're needed to deliver the response and protect the server. Cloudflare, which hosts our server. We don't forward them to the AI providers. We don't store them: request logging is switched off on our server. Cloudflare may process them briefly under its own security practices.
Anonymous app counts: that the app was installed, the plans screen was opened, a trial or subscription started, or purchases were restored, with the app's name, the plan's name and a test-version label; and, if you answer it, where you heard about the app (for example "TikTok") To count how many people see the plans and subscribe, so we can keep the app worth paying for. Our server (Cloudflare). Never your device ID, IP address, name, photos or answers: none of these is stored with a count. Up to 13 months.
Subscription updates from Apple: when a subscription starts, renews, is cancelled, expires or is refunded, with Apple's anonymous transaction number, the plan, its price, the dates and, if you told us, where you heard about the app (a label shared by everyone who gave that answer) So a refunded subscription stops working, and so we know how many subscribers stay. Apple sends these to us directly; they don't come from your phone and don't include your name or Apple ID. Apple, then our server (Cloudflare). Up to 3 years (accounting).

That is everything the app sends. We do not collect your name, email address, phone number, contacts, location, browsing history or advertising identifier. Your location is never part of a scan request.

4. Data that stays on your device

  • Your Leafdex: the photos of your finds, their results, your notes, favourites, badges and Sprig's growth stage. These are stored in the app on your iPhone and are never sent to us. Like most app data, they may be included in your own iPhone backups (iCloud Backup or your computer), which Apple or you control.
  • iCloud sync: if you're signed in to iCloud, your Leafdex also syncs between your own devices through your private iCloud database, using Apple's CloudKit. That copy lives in your iCloud account, counts toward your iCloud storage and is protected by Apple; we can't see, read or access it. Apple's handling is covered by Apple's Privacy Policy. Sync only covers devices signed in to the same Apple Account; it doesn't share your Leafdex with anyone else. To keep your Leafdex on one device only, turn off Back up finds to iCloud in the app's Settings; that never deletes the finds on your phone.
  • Your onboarding answers and settings.
  • Your finds map (optional): if you turn on the finds map and allow location access in iPhone Settings, Sprout Scout notes roughly where you made a find. That location is stored on your iPhone with the find, is used only to show it on your map on the device, and is never sent to us or to any AI provider. You can switch it off any time in iPhone Settings › Privacy & Security › Location Services › Sprout Scout; the app works without it.
  • The trial reminder: if you start a free trial and allow notifications, the app schedules one local notification on your phone two days before the trial ends. It's created on your device; we don't use push notification servers and don't receive a notification token.

Deleting Sprout Scout deletes your Leafdex from that device. If iCloud sync was on, a copy stays in your iCloud until you delete it (see section 9). We can't recover your Leafdex for you, because we never had a copy.

5. Our service providers

We use a small number of providers, only to run the app. None of them may use your data for advertising.

  • Google LLC (the Gemini API, on a paid plan) processes scan photos to produce identifications. Under the Gemini API terms for paid services, Google doesn't use prompts or responses to improve its products, and logs them for a limited period only to detect and prevent abuse and to comply with law. See the Gemini API Additional Terms of Service and Google's Privacy Policy.
  • Cloudflare, Inc. hosts our server (Cloudflare Workers) and this website. See Cloudflare's Privacy Policy.
  • Apple processes subscriptions and payments through the App Store. We receive no payment details or personal information from Apple: only confirmation, on your device, that your subscription is active, and the anonymous subscription updates described in section 3. Apple's handling is covered by Apple's Privacy Policy.

These providers may process data in the United States and other countries where they operate. Where the law requires it, these transfers rely on the providers' standard safeguards, such as the EU Standard Contractual Clauses in their data processing terms.

6. What we don't do

  • No accounts, logins, or profiles.
  • No ads, and no advertising or analytics SDKs.
  • No tracking across other companies' apps and websites, and no use of the advertising identifier (IDFA).
  • No selling or "sharing" of personal information, as those terms are defined in US state privacy laws.
  • No storing of your scan photos on our server, and no using them to train AI.
  • No location sent to us. The optional finds map uses your location only on your device (see section 4).

7. Children

Sprout Scout is a family app, made to be enjoyed by kids together with the grown-ups in their life. It is not directed at children under 13 on their own, and we do not knowingly collect personal information from children. We recommend that a parent or guardian sets up the app with younger children, handles the subscription, and decides whether to allow photo scanning and the optional finds map. Sprout Scout has no accounts, chat, public profiles or social features, so children cannot talk to, or be contacted by, other people through the app, and the only data it sends is described in section 3. If you believe a child has sent us personal information (for example, by emailing support), contact us and we will delete it.

8. Legal bases (EEA, UK and Switzerland)

Where data protection law such as the GDPR applies, we process the data in section 3 to provide the service you asked for (performance of a contract), with your consent for sending photos to our AI providers (which you can withdraw at any time in the app's Settings), and for our legitimate interest in keeping the service secure and fair (rate limiting).

9. Your choices and rights

  • Don't want a photo analysed? Simply don't scan it. Nothing leaves your device until you take or choose a photo to identify.
  • Withdraw consent for AI processing at any time in the app's Settings. Scanning will stop until you allow it again.
  • Notifications: turn the trial reminder off in iPhone Settings › Notifications › Sprout Scout.
  • Location: the finds map is optional. Turn off location access any time in iPhone Settings › Privacy & Security › Location Services › Sprout Scout.
  • Delete your data: delete items in the app (with iCloud sync on, that removes them from your other devices too), or delete the app to remove your whole Leafdex from that device and reset the install ID. To remove the iCloud copy, go to iPhone Settings › [your name] › iCloud › Manage Account Storage › Sprout Scout › Delete Data.
  • Access, correction, deletion, objection and portability: depending on where you live, you may have these rights. Because we don't keep scan photos or have accounts, we usually hold no data that can be tied to you. If you have a request, email us and we'll respond within the time the law requires. You may also complain to your local data protection authority.

10. Security

All data the app sends travels over HTTPS. Our server holds no scan photos, and the AI provider keys are kept on the server, never in the app. No system is perfectly secure, but collecting as little as possible is the best protection we can offer.

11. This website

This site uses no cookies, analytics or third-party scripts. Our host, Cloudflare, processes basic request data (like your IP address) to deliver pages and protect against attacks.

12. Changes

If we change how Sprout Scout handles data, we'll update this page and the effective date above, and for significant changes we'll tell you in the app before the change applies.

13. Contact

Questions or requests: support@littlefindersclub.com
Little Finders Club