Lilora
Last updated: 13 October 2026
Lilora is a notebook for house plants, published by Umut OREN ("we").
What the app stores
When you use Lilora without an account, everything you enter stays on your iPhone or iPad: plant names, species you type, rooms, notes, care entries, snooze settings, reminder settings and plant photos. We do not receive this guest information. Photos you add are copied into the app's own storage without their original metadata, such as location.
What we collect
If you choose to sign in, Lilora uses your email address to authenticate your account and stores the display name you enter. If you create or join a household, its plant and room details, care records and photos are stored using Supabase so household members can use the same garden. Records are linked to your account and show who recorded care.
Invitation email addresses are stored to let invited people join the household.
You choose whether to move your existing guest plants into a household. Their details, care history and selected plant photos are then uploaded to that household. The app also keeps a local household cache and pending changes so you can read saved data offline.
Household members can access the household's shared plants, photos, care records and display names. The household owner can manage members and invitations. This is private household sharing; there is no public feed.
Identifying a plant from a photo
Photo identification is optional and needs an account. Before the first identification, the app explains what happens and asks for your agreement. When you choose a photo to identify, Lilora removes location and other photo details, then sends a copy of the photo through our server to Pl@ntNet, a plant identification service run by a third party in France. Only the photo and the app language are sent; no account, household or device information. Pl@ntNet's terms say the photo is processed to return suggestions and is not saved in its image database; Pl@ntNet keeps records of requests for quotas and statistics.
Lilora does not keep the photo for identification.
We keep a record of each identification linked to your account: when it was made, the version of the explanation you agreed to, the suggested species names, and whether it used one of your identifications. We use it to count your identifications, to avoid charging twice for the same photo and to confirm a species you chose from the suggestions.
Suggestions are never added to a plant unless you choose one.
Purchases
Identification packs and the Lilora Plus subscription are sold through Apple's App Store. Apple handles payment; we never receive your card or Apple Account details. To add identifications to your account, the app sends us the App Store's signed transaction details (such as product, transaction ID and purchase date), and Apple sends us notifications about renewals, refunds and cancellations. We keep these records with your account to show your balance, restore purchases and prevent the same purchase being used twice.
How we use it and where it is stored
We use this information to provide sign-in, shared plant care, photo identification, purchases and account controls.
Account, household, identification and purchase records are stored with Supabase in Frankfurt, Germany. Our server logs record technical details such as response codes and timings, not photos, codes or identification results. Lilora has no advertising, analytics SDK or cross-app advertising tracking. If you contact support, we receive your email and the details you choose to send to help you.
Permissions
- Camera and photo library: asked only when you tap Take photo or Choose photo, so you can add a picture of a plant or identify one. Guest photos stay on your device; household photos are uploaded to private household storage. A photo you identify is sent as described above.
- Notifications: asked only when you turn reminders on. Reminders are scheduled on your device; no notification data is sent to us.
You can change these permissions at any time in iOS Settings.
Deleting your data
Guest data is stored on the device. Removing the app removes its local data; archiving a plant keeps its history so you can restore it.
Signing out clears the household's cached data and photos from that device. It does not delete the online household. Leaving a household or being removed ends your access.
To delete an online account, use Settings → Delete account and confirm the explanation shown there. Your account and household membership are removed. If other members remain, shared care records stay with them and your attribution becomes “Former member”. An owner's role passes to another member. If you were the household's only member, the household and its data are deleted. Replaced or closed-household photos are queued for server removal. Identification and purchase records linked to your account are deleted with it. Removing the app alone does not delete an online account. Deleting your account does not cancel an App Store subscription; cancel it in your App Store account settings.
Children
Lilora is not directed at children under 13 and does not knowingly collect their data.
Changes
When a new version changes how data is handled, this policy will be updated before that version is released, and the date above will change.
Sign-in emails
Verification emails needed to sign in to your account are sent by Supabase through Resend. Resend processes your email address, message content and delivery information to deliver these emails. Lilora’s Resend sending domain is configured in Ireland (eu-west-1). This setting does not mean that all of the provider’s data processing takes place only in this region.
Website and support email
This website is hosted on GitHub Pages. GitHub processes technical requests to serve the site and logs visitors’ IP addresses for security purposes. See GitHub Pages documentation. This website does not use analytics or advertising scripts.
Messages sent to support@lilora.app are forwarded by Namecheap to our support inbox in Gmail. Namecheap and Google process your email address, message content and any attachments to deliver and store this correspondence. These providers’ processing is separate from the app records stored in Supabase’s Frankfurt region.