Effective 30 September 2026
Gnome identifies a plant from a photograph and tells you what that plant is reported to contain. This policy says, in plain words, exactly what information the app and its server handle, and what happens to each piece of it.
Gnome is built and run by its developer, reachable at depthnoteapp@gmail.com. The app talks to one server, which we run ourselves at gnome-api.barbershops.cc. There is no other company behind the app: no analytics service, no advertising network and no third-party account system.
Identifying a plant needs a Gnome account, and there are exactly two ways to make one: Sign in with Apple and Sign in with Google. You never type a password into Gnome and we never see one. Apple or Google tell our server who you are, our server checks that their answer is genuinely signed by them, and it keeps only what it needs to recognise you the next time.
That is the entire user record. There is no name, no phone number, no postal address, no contact list, no location and no advertising identifier in it, because the app never asks you for any of them.
Identification is a paid feature. Your app store (the App Store on iPhone, Google Play on Android) takes the payment — we never see your card, your billing address or your store password. When a free trial or a subscription starts, the app sends the store’s own receipt to our server, the server asks Apple or Google whether that receipt is real, and it records the answer against your account:
When you tap the shutter or choose a picture from your library, that one image is sent over an encrypted connection to our server. Our server passes it straight to our vision-model provider, OpenAI, which reads the picture, and returns the result to your phone. If OpenAI does not answer, our server sends the same image once more to the same OpenAI model hosted by Microsoft Azure, reached through the routing service OpenRouter, on terms under which neither of them keeps it. There is no other place the image can go.
Our server counts how many identifications an account, and an internet address, have asked for in the current hour — and how many results an account has reported — so that one person cannot exhaust the service for everybody else. A counter holds the account id or the address and a number — nothing else — and every counter older than two days is deleted automatically.
The server also writes an ordinary operations log. It records the method and path of a request, the account id, and the hazard level and confidence of a finished identification. It never records the photograph, a request body, a session token or your email address.
If a verdict looks wrong, or its text offensive, "Report this result" on the card sends it to us from inside the app. The report carries what the card showed — the plant's names, its hazard class, the confidence, the gnome rating and the words the vision model wrote on it — with the reason you pick, anything you type, and which app and version sent it. It does not carry the photograph, your account id or your email address, and it is stored without them: it cannot be traced back to you, which is also why deleting your account does not delete it. We read reports to find and correct wrong answers. Each one is deleted automatically two years after it was sent.
Your scan history, the photographs themselves, your setup answers, your birth date and your signed-in session are written to this device’s private app storage. They are not copied to our server. Deleting the app deletes them.
Gnome asks for your birth date once, to check that you are 18 or over. The date stays on this phone, is never sent to us, and is used for nothing else. Gnome does not ask for your sex, height or weight — it computes nothing from them, so it does not collect them.
Gnome contains no analytics SDK, no crash-reporting SDK, no advertising network and no tracking technology of any kind. Nothing you do in the app is combined with data from other apps or websites, nothing is sold, and nothing is handed to a data broker. There is no advertising identifier in the app and no tracking permission prompt, because there is nothing to track you with.
Open Settings → Account → Delete account and confirm. The app asks our server to delete you; the server removes your user record and, with it, the subscription record attached to it. If you signed in with Apple, the server first asks Apple to revoke Gnome’s access to your Apple ID, and if Apple refuses, the deletion stops and the app tells you why instead of pretending it worked.
Two things deletion does not do, said plainly. It does not cancel a paid subscription — the store owns that, so cancel it in your app store’s subscription settings (on iPhone: Settings → your name → Subscriptions; on Android: the Play Store app → your profile picture → Payments & subscriptions → Subscriptions). And it does not erase the copies held on your phone: Settings → Delete my data does that, erasing your scan history, the stored photographs, your answers and your birth date from this device.
The account and subscription records exist to give you the service you asked for and to check that a subscription is real — that is the contract between us. The photograph is handled on your instruction, each time you submit one. The rate-limit counters exist to keep the service working for everyone, which is our legitimate interest.
Gnome is for adults aged 18 or over and asks for a birth date before the first scan. It is not directed at children and must not be used by them.
Depending on where you live — for example under the GDPR in the EU and UK, or the CCPA in California — you have rights to access, correct, delete, port or object to the processing of your personal data. Everything we hold about you is the short list above: the app shows it under Settings → Account, and Delete account erases it. If you want a copy in writing, an account deleted by hand, confirmation that a deletion happened, or an answer about how our vision-model provider handled one request, write to depthnoteapp@gmail.com and we will answer.
Every request between the app and our server travels over HTTPS, and the app refuses to talk to an address that is not HTTPS. The server is reachable only through an encrypted tunnel, and the keys it uses to reach Apple, Google and the vision model live in a file on that machine which nothing else can read. The copies on your phone sit in the app’s private storage, protected by the phone’s own encryption. No system is perfect; the strongest protection here is still that there is very little to steal.
If this policy changes materially, the updated version is published with a new effective date, in the app and at gnome-api.barbershops.cc/privacy, before the change takes effect.
Privacy questions and requests: depthnoteapp@gmail.com.