Privacy in the app

Effective 10 November 2026.

This policy covers the Positive app for Android. When the iPhone app comes out, this page will be updated to cover it too. The waitlist on this website has its own notice: How we use your email.

Who runs Positive

Positive is an independent project by Alexis Chatelain, who decides how the app’s data is used (the data controller). Write to hello@positivegarden.app about anything on this page. If you write, we keep your message only as long as we need it to help you.

In short

• There is no account. Positive never asks for your name, your email or your age.
• What you write, your moods, your photos and your garden stay on your phone. We can’t see them.
• Anonymous stats are off until you say yes, and they never hold your words or your moods.
• If you buy Positive Plus, Google Play takes the payment and RevenueCat keeps track of the subscription for us.
• No ads, no ad trackers, and we never sell anything about you.

What stays on your phone

Your garden and your strengths, your jar moments and everything you write in them, how your little things felt (your mood answers), your check-in times, your settings and whether you have Plus are kept in the app’s own storage on your phone. They are never sent to us or to anyone else.

When you save a jar moment, Positive looks for a few words that might mean you’re going through something very hard, so it can show where to find someone to talk to, just in case. That check happens on your phone. Nothing is sent or counted.

Check-ins, and the reminder two days before a free trial of Plus ends, are set and shown by your phone. Nothing is sent to show them.

Your phone’s backup and your exports

Android can back up your garden, your jar and your settings to your own Google account, as it does for most apps. Google keeps that copy, not us, and you turn it on or off in your phone’s settings. On Android 12 and later, Positive lets it go to Google’s cloud only when the backup is end-to-end encrypted. Your photos and the stats ID below are never part of it. Android’s phone-to-phone transfer can copy the same garden, jar and settings to a new phone.

In Settings, under “Backup and export”, you can export your jar or everything as a file. You choose where it goes, through the share sheet or by saving it; we never receive it. Once you send it to another app or service, that service’s own policy applies.

Photos, with Positive Plus

With Positive Plus you can add a photo to a jar moment. Android’s photo picker opens, and Positive receives only the one photo you choose, never the rest of your gallery. The picker needs no permission, and Positive doesn’t ask for your camera, contacts, microphone or location.

Positive keeps its own copy of the photo in the app’s private storage, with all its hidden details removed, including where it was taken. Your photos never leave your phone, except in an export you make, and they are not part of Google’s backup. You can remove a photo at any time.

Anonymous stats, only if you say yes

Positive can count a few anonymous things, to see whether people come back and which little things they do. Stats are off until you say yes, on the “What stays on this phone” step when you start, or later in Settings, under Privacy, with “Anonymous stats”. Either answer is fine; the app works the same. Until you answer, counts wait in the phone’s memory: they are sent if you say yes, and dropped if you say no.

When stats are on, each count is the name of something that happened and a few fixed values, never anything you typed:

• Opening the app, and whether from your home screen or a check-in.
• Getting started: each step shown, the check-in choice made there, and whether notifications were allowed.
• Today’s little thing: started, done or put off (which one, its kind and length, and whether a plant grew), swapped for something else or kept, and that a mood was answered, never which mood.
• The garden: a strength planted (which one), the shed or a strength’s page opened, picking which strength to water, moving to another bed, a tap on Pip, and Pip remembering a moment.
• The jar: opened, with the number of moments as a range such as 5 to 19, and shaken.
• Rough days: “Not a great day?” opened, the option chosen, and a gentle practice started, done or skipped.
• Check-ins: how often and roughly when (morning, afternoon or evening), a check-in shown or opened, and check-ins easing off.
• Your data and settings: an export made or an import finished (its kind, never its content), and a change to “Less motion” or to check-ins.
• Positive Plus: the Plus screen opened and from where, a plan tapped, a trial started, a purchase and its plan, a restore and whether Plus was found, Plus ending, and a garden theme chosen.

Each count also carries the number of days since the stats ID was made, your phone’s language and the app’s version. Nothing else: no device model, no location, no time zone, nothing about who you are. Opening “Someone to talk to” and the just-in-case card after a hard moment are never counted, and neither is the stats switch itself.

The stats ID. So that one phone counts once, stats use a random ID made on your phone when you turn them on. It is replaced by a new one every 13 months, or when you tap “Reset my anonymous ID” in Settings, and it is deleted as soon as you turn stats off. It is never backed up, so a restored phone gets a new one, and Positive never links it to anything else.

Who receives the counts. TelemetryDeck GmbH, in Augsburg, Germany, over an encrypted connection; its servers are in the Netherlands and Germany. TelemetryDeck scrambles the ID on your phone before it is sent, then again on its server with a secret of its own, so neither TelemetryDeck nor we can turn it back into the ID on your phone. It says it never stores IP addresses. TelemetryDeck keeps the counts it receives and has set no date for deleting them; once the ID is gone from your phone, nothing links those counts to you. More in TelemetryDeck’s privacy FAQ.

Why, and on what basis. Only to see whether Positive works for people, never for ads. We rely on your consent (Article 6(1)(a) of the GDPR), and you can withdraw it at any time by turning stats off.

Positive Plus and purchases

Positive Plus is an optional subscription, bought and cancelled through Google Play. Google takes the payment as its own data controller, under its privacy policy. Positive never sees your card details, your name or your email.

To know whether Plus is active, restore it and follow renewals and the free trial, Positive uses RevenueCat, Inc., a company in the United States that does this for us (a processor). RevenueCat receives:

• a random ID that its code makes on your phone, not linked to your name, email or Google account;
• the purchase token and receipt details Google Play gives for a purchase, the product and its price;
• whether a subscription or trial started, renewed, was cancelled or ended, and when;
• basic technical details: that the phone runs Android, the Android and app versions, the type of device, and your country, language and currency.

Positive checks with RevenueCat when the app starts, so RevenueCat gets the random ID and the technical details even if you never buy Plus. It gets no advertising ID and no location beyond your country. Like any server, it sees your phone’s IP address when the app connects; RevenueCat says it doesn’t keep it. It never receives your jar, your moods, your photos or your garden.

RevenueCat keeps this data on Amazon Web Services servers in the United States. Sending it there from the EU is covered by the European Commission’s Standard Contractual Clauses, which are part of RevenueCat’s data processing agreement. The basis is the contract you make when you subscribe (Article 6(1)(b) of the GDPR). More in RevenueCat’s privacy policy.

Deleting your data

• Uninstalling Positive deletes everything it kept on your phone: your garden, jar, photos and settings, the stats ID and RevenueCat’s random ID. If Google’s backup is on, Android may put your garden and settings back when you install Positive again.
• In Settings, “Start over” clears your garden, your jar and your settings from this phone, and turns stats off.
• Turning stats off deletes the stats ID at once, and nothing more is sent.
• Google’s backup of the app is in your Google account, where you can delete it.
• To have what RevenueCat holds about your purchases deleted, write to hello@positivegarden.app. The order number from Google Play’s receipt email (it starts with GPA.) helps us find it. Google Play keeps its own record of the purchase in your Google account.

Your rights

You can ask to see, correct or delete personal data we hold about you, to receive a copy of it, to object to its use or limit it, and to withdraw your consent at any time. Write to hello@positivegarden.app; we’ll answer within a month. Most of what Positive knows is only on your phone, where you are in charge of it, and the stats can’t be traced back to you, so we may ask for something that helps us find your data, such as that order number. You can also complain to the CNIL, France’s data protection authority, or to the authority where you live.

Who it’s for

Positive is for people aged 16 and over. It is a wellbeing app, not a medical app.

Changes

If this policy changes, the new version will be on this page with a new date.