Legal
Privacy Policy — Harvest Journal
Version: 1.1
Effective date: 12 October 2026
Last updated: 22 October 2026
1. Introduction and controller
This Privacy Policy (the "Policy") explains what data we collect, why we collect it, how we use it, and what rights you have when you use the mobile application Harvest Journal: Stats & Diary (the "App") or visit our website harvestjournal.app (the "Website").
The controller of personal data within the meaning of Regulation (EU) 2016/679 (the "GDPR") is:
| Business name | mondov, s. r. o. |
| Registered office | Cintorínska ulica 983/10, Krompachy 053 42 |
| Company ID (IČO) | 57 481 831 |
| Commercial register | Municipal Court Košice, Section Sro, Insert No. 65127/V |
| Contact email | support@harvestjournal.app |
(the "Controller", "we", or "us")
This Policy covers personal data processing only. Your use of the App is also governed by our separate Terms of Use.
2. Who this Policy applies to
This Policy applies to individuals who:
- download, install, or use the App on iOS or Android;
- visit the Website, including the free Harvest Report.
2.1 Age
The App and Website are intended for users who are at least 16 years old. If we learn that we have processed personal data in connection with use by someone under 16, we will take reasonable steps, including deleting analytics data where technically possible.
3. Principles we follow
We process personal data in line with GDPR principles, including:
- Lawfulness, fairness and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
4. What we collect and why
4.1 App — data stored only on your device
The App stores the following only locally on your device. This content is not uploaded to our servers or to third-party servers as part of an account or cloud sync:
| Data type | Purpose |
|---|---|
| Harvest logs (crops, amounts, units, timestamps) | Core harvest tracking |
| Journal entries (notes, photos you attach, activity types) | Garden diary features |
| Your crop list and related settings | Personalise the App |
| App preferences | Remember your choices |
| Export / import backup files you create | Move or back up your data under your control |
We have no access to this local garden content. It is deleted when you uninstall the App or reset the device (unless you previously exported a backup elsewhere).
4.2 App — analytics (PostHog)
To improve the App and fix technical issues, we use PostHog, hosted in the European Union. Analytics data collected through PostHog does not leave the EU/EEA for our EU-hosted instance.
Examples of data we may collect:
| Data type | Purpose |
|---|---|
| Feature usage (e.g. logging a harvest, opening stats or journal — not the content itself) | Product improvement |
| In-app navigation and screen views | UX analysis |
| Technical errors and crashes | Debugging |
| Device / OS / App version | Compatibility and support |
| Anonymous device identifier generated by PostHog | Distinguish unique installs |
What we do not collect via analytics:
- Your name, email, phone number, or other direct identifiers (the App has no account)
- The text of journal notes, photos, or detailed harvest amounts as content backups
- Precise GPS location
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — improving the App and fixing bugs.
Analytics events are tied to an anonymous device identifier. We generally cannot link them to a named person. We still treat them cautiously as potentially personal data under the GDPR.
4.3 Website — hosting logs
When you visit the Website, our hosting provider Vercel, Inc. may automatically record standard server logs, which can include IP address, browser and OS type, date/time, requested URL, and HTTP status codes. These are used for security, availability, and troubleshooting.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — operating a secure Website.
4.4 Website — analytics (PostHog)
We may use PostHog on the Website to understand traffic and improve the marketing site (for example page views and basic interaction events). Website analytics uses a first-party PostHog cookie and local storage so a returning browser can be recognized on this site.
Website analytics may still process limited technical data (such as approximate region derived from IP by the provider, browser type, and pages visited), associated with an anonymous identifier where applicable. See also section 4.2 for our general approach to PostHog data.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — understanding and improving the Website.
4.5 Direct communication
If you email us, we process your email address and message content to respond. We do not automatically delete email; we will delete it on request unless we must keep it for legal claims or legal obligations.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4.6 Purchases (Apple, Google, and RevenueCat)
Premium is optional. Yearly Premium is USD 24.99 per year. Lifetime Premium is a one-time purchase of USD 57.99. The store shows the price in your local currency, including tax where applicable, before you pay. What Premium includes, and how renewal and cancellation work, is in the Terms of Use.
Payment is processed by Apple (App Store) or Google (Google Play). We do not receive your payment card number, full billing address, or Apple ID / Google account password.
To unlock Premium on your device we use RevenueCat, Inc. The App sends RevenueCat an anonymous app user identifier, the platform (iOS or Android), and purchase or entitlement status — for example whether Yearly or Lifetime Premium is active. RevenueCat does not receive your garden journal content.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) when you buy Premium, and legitimate interest (Art. 6(1)(f) GDPR) in confirming that entitlement and restoring a purchase on a new device.
4.7 Website — Harvest Report
The free Harvest Report at /harvest-report is built in your browser. Crop totals, dates, notes, and plans stay on your device (in local storage). Photos you add stay on your device (in the browser's IndexedDB) and in a PDF you download. We do not receive that report.
The share link and the QR code put the totals and dates in the URL hash. Anyone with that link can open the report. Photos are not included. The hash is not sent to our server.
Before you download the PDF you can leave an email address to hear about product news and new free tools. That is optional. Skip and download does not subscribe you, even if the field has text in it. If you choose to subscribe, Brevo sends a confirmation email; you are added to the list only after you click the link in that email. We send the address only to Brevo (Brevo SAS, Paris), which stores our mailing list. Brevo's contact databases are in the EU. The address is not sent to PostHog.
Legal basis: consent (Art. 6(1)(a) GDPR) for the mailing list. You can unsubscribe in any email, or ask us to delete the address at support@harvestjournal.app.
5. Recipients
We may share data with:
| Recipient | Reason | Location |
|---|---|---|
| PostHog, Inc. | Analytics and error tracking | EU (EU-hosted instance) |
| Vercel, Inc. | Website hosting and server logs | EU and/or USA (see below) |
| Apple Inc. | App distribution and payment for Premium | USA (their policy) |
| Google LLC | App distribution and payment for Premium | USA (their policy) |
| RevenueCat, Inc. | Premium entitlement status | USA (see below) |
| Brevo SAS | Mailing list, only if you subscribe from the Harvest Report | EU (France) |
| Public authorities | Where required by law or court order | Slovakia / EU |
International transfers: PostHog for our product is hosted in the EU. Website hosting via Vercel, and purchase processing via Apple, Google, and RevenueCat, may involve transfers to the USA. Where that happens, transfers rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or another valid mechanism.
We do not sell your personal data.
6. Cookies and similar technologies
The marketing Website sets a first-party PostHog analytics cookie and uses local storage to measure traffic on this site.
Essential technical storage required by the browser or host to deliver the site may still occur as part of normal web operation (separate from analytics cookies). The Harvest Report uses local storage for the draft and IndexedDB for photos you add. That stays on your device. The App may use on-device storage for your garden data and preferences (see section 4.1); that is not website cookie use.
App store platforms (Apple / Google) may process data under their own policies when you download or update the App.
7. Retention
| Data type | Retention |
|---|---|
| Local App garden data | Until you uninstall the App, clear App data, or reset the device (or delete items in-app) |
| PostHog analytics (App) | Up to 10 years; typically shorter per our internal settings |
| PostHog analytics (Website) | Up to 10 years; typically shorter per our internal settings |
| Hosting server logs | Per host policy, typically 30–90 days |
| Email correspondence | No automatic deletion; deleted on request unless law or legal claims require retention |
| Harvest Report mailing list (Brevo), if you subscribe | Until you unsubscribe or ask us to delete it |
| Harvest Report draft and photos | On your device until you clear site data for this Website |
| Premium purchase status (via Apple, Google, and RevenueCat) | For as long as needed to provide Premium and restore a purchase, then under the store and RevenueCat retention rules |
8. Your rights
Under the GDPR you may have the right to:
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction (Art. 18)
- Portability (Art. 20) — for local garden data, use the App's export feature
- Object to processing based on legitimate interests (Art. 21)
Note: Because analytics are tied to an anonymous device ID and we do not hold your name or email from the App, some rights (access/erasure of specific analytics rows) may be technically limited unless you can provide information that lets us identify the relevant records.
To exercise your rights, contact us at support@harvestjournal.app. We will respond without undue delay and within 30 days where required.
9. Complaints
If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava
Tel.: +421 2 3231 3214
Email: statny.dozor@pdp.gov.sk
Web: https://dataprotection.gov.sk
10. Security
We apply appropriate technical and organisational measures, including:
- EU-hosted PostHog with restricted access
- HTTPS/TLS for network transfers
- Keeping garden journal content on-device rather than in an account cloud
No system is perfectly secure. If a breach likely affects your rights and freedoms, we will notify as required by the GDPR.
11. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
12. Changes
We may update this Policy (for example when features or laws change). Material changes will be reflected by updating the "Last updated" date and, where appropriate, a notice in the App.
13. Contact
mondov, s. r. o.
Email: support@harvestjournal.app
This Privacy Policy is effective as of 12 October 2026.