Privacy Policy

1. Introduction

Demeter (the “app”) is a farm management application developed and operated by CURLY SCIENTIST PTY LTD (“we”, “us”, “the Company”). This Privacy Policy describes what data the app processes, where that data is stored, who has access to it, and the rights you have under the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the Greek implementation Law 4624/2019.

Demeter is designed as a local-first application. By default, all your farm data is stored on your device and is never transmitted to the Company or any third party. Cloud features (Google Drive backup, Groq AI assistant) are strictly opt-in and require explicit action by you.

2. Data controller

CURLY SCIENTIST PTY LTD — dev@curlyscientist.com

The Company acts as the data controller for any limited diagnostic information described below. For data you store within the app, you remain the sole controller of that data; the Company has no access to it.

3. What data the app processes

3.1 Data you enter (stored only on your device)

• Field information (names, locations, areas, GPS coordinates)
• Crop information (cultivars, planting dates, growth stages)
• Costs (amounts, descriptions, vendor names, receipts)
• Fertilizer applications (product, quantity, location)
• Spraying records (product, dates, protection days)
• Yield records (quantities, prices, buyers, revenue)
• Soil analyses (pH, NPK, organic matter)
• Photos you attach to activities
• Free-form notes

This data is stored in an SQLite database (app.db) inside your device’s app-private storage. It is not accessible to other applications and is removed when you uninstall the app.

3.2 Voice recordings

When you tap the microphone, the app records audio for the purpose of transcribing what you said into a structured farm activity entry. Audio is processed in one of two ways:

• Device speech-to-text (default). The audio is sent to the operating system’s built-in speech recognition (Apple dictation on iOS, Google’s on-device speech recognition on Android). Apple/Google’s terms apply to that processing. The Company does not receive a copy of the audio.
• On-device Whisper (offline fallback). When enabled, a Whisper neural model packaged inside the app transcribes audio entirely on your device. No audio leaves the device.

Audio is not retained after transcription. Only the resulting text is used by the app, and only locally.

3.3 Location

If you grant location permission, the app uses approximate coordinates (latitude/longitude) only for:

• Auto-tagging the field location of new activities (stored locally only)
• Fetching local weather forecasts from the Open-Meteo API (see §4.2)

The app never sends coordinates to the Company. You can revoke location access at any time in your device’s system settings.

3.4 Photos

Photos you attach to activities are compressed and stored locally under <app-documents>/images/. They are uploaded only if you explicitly trigger a Google Drive backup (see §4.1).

3.5 Credentials

If you enable AI features by entering a Groq API key, that key is stored in your device’s secure storage (Keychain on iOS, EncryptedSharedPreferences on Android via flutter_secure_storage). It is transmitted only to api.groq.com when you make an AI request. Google Drive OAuth tokens are stored the same way.

4. Optional cloud features

4.1 Google Drive backup (opt-in)

When you connect Google Drive, the app uploads encrypted backup archives of your local database and photos to your own Google Drive account, in a folder named Demeter Backups. Files are integrity-checked with SHA-256.

• The Company has no access to your Drive contents.
• Authentication uses Google’s OAuth 2.0; we never see your password.
• You may revoke access at myaccount.google.com/permissions at any time.

Google’s privacy policy applies to the data stored in your Drive: policies.google.com/privacy.

4.2 Open-Meteo weather API

Weather forecasts are fetched from the free Open-Meteo public API (open-meteo.com). The app sends only your approximate latitude/longitude. No personal identifiers are sent. See Open-Meteo’s terms.

4.3 Groq Cloud AI assistant (opt-in)

If you enable the AI assistant by adding your Groq API key, the following content is sent to Groq’s servers (groq.com) when you use AI features:

• Voice transcripts for entity extraction (turning “spent €120 on tools” into a structured cost entry).
• Chat messages you send to the AI assistant, plus a summary of your relevant farm data (recent costs, sprayings, yields) for context.
• Weekly summary prompts if the weekly summary feature is enabled.

Groq is the data processor for these requests. Their handling is governed by their privacy policy at groq.com/privacy-policy. You are responsible for choosing whether to enable AI and for the Groq account terms. You can disable AI and clear your API key at any time from Settings → AI Provider → Disconnect or via Settings → Delete All My Data.

5. Permissions explained

6. What we do not do

• We do not sell your data to anyone.
• We do not show advertising.
• We do not use analytics, telemetry, or crash reporting that identifies you.
• We do not have a backend server that stores your farm data.
• We do not collect Advertising IDs (AAID/IDFA).

7. Your rights under GDPR

Because the Company holds no copy of your data, the following rights are exercised entirely on-device or through the third parties listed above:

• Access & portability (Art. 15, Art. 20). Use Settings → Export Database or Export Excel/CSV to obtain a complete copy of your data in a machine-readable format.
• Rectification (Art. 16). Edit or delete any entry directly in the app.
• Erasure (Art. 17, “right to be forgotten”). Use Settings → Delete All My Data to permanently wipe your local database, photos, and credentials. Uninstalling the app also removes all on-device data. To delete cloud backups, sign in to Google Drive and delete the Demeter Backups folder.
• Restriction & objection (Art. 18, Art. 21). You can revoke any individual permission (microphone, location, camera, notifications) in your device’s system settings at any time.
• Withdraw consent for AI processing. Disconnect the Groq API key in Settings → AI Provider.

You may also lodge a complaint with the Greek Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, www.dpa.gr).

8. Data retention

Your data is retained on your device for as long as you choose to keep it. The Company holds no copy and therefore performs no retention or deletion on the Company’s behalf. Cloud backups are retained in your Google Drive until you delete them.

9. Children’s privacy

Demeter is intended for adult agricultural producers and professionals. The app is not directed at children under 16 years of age (the GDPR digital-consent threshold in Greece, Law 4624/2019 Art. 21). We do not knowingly process data from children.

10. Security

• Data is stored in app-private storage that is not readable by other apps on a non-rooted device.
• Credentials (Groq API keys, Google OAuth tokens) are stored using platform-secure storage (Keychain / Keystore-backed EncryptedSharedPreferences).
• All cloud network traffic uses HTTPS/TLS.
• Backup archives include SHA-256 integrity checksums.

Note: the local SQLite database is not encrypted at rest by default. We treat protecting the device itself (screen lock, full-disk encryption, which is enabled by default on modern Android and iOS) as the user’s responsibility. Database-at-rest encryption is on the roadmap.

11. Changes to this policy

We may update this policy. The “Last updated” date at the top reflects the most recent revision. Material changes will be announced in the app’s release notes on Google Play.

12. Contact

For privacy questions, data subject access requests, or any concerns about how Demeter handles your data, please contact:

CURLY SCIENTIST PTY LTD
dev@curlyscientist.com