This Privacy Policy explains how TwinFlame Development, LLC ("InnerLeafs," "we," "us," or "our") collects, uses, and shares information when you use InnerLeafs. By using the service you agree to the practices described here.
Information you provide directly:
Information collected automatically:
InnerLeafs uses PostHog to record anonymised sessions to help us understand how the app is used and identify areas for improvement. Recordings are masked — your private content (messages, leaf text, contributions, and other personal content) is never captured.
Session recordings are retained for 30 days and are only accessible to InnerLeafs staff. You can opt out of session recording at any time in Settings → Privacy → Session recording.
We use the information we collect to:
We do not sell your personal information.
Lawful bases for processing (EEA and UK users). If you are located in the European Economic Area or United Kingdom, we process your personal information on the following legal grounds under the GDPR and UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Creating and maintaining your account | Performance of a contract (Article 6(1)(b)) |
| Providing the service | Performance of a contract (Article 6(1)(b)) |
| Service-related communications | Performance of a contract (Article 6(1)(b)) |
| Security, fraud prevention | Legitimate interests (Article 6(1)(f)) |
| Service improvement and analytics | Legitimate interests (Article 6(1)(f)) |
| Marketing communications | Consent (Article 6(1)(a)) |
| Legal compliance | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests, you have the right to object to that processing. See §12 for how to exercise this right.
With other users. InnerLeafs is designed to support sharing with people you choose. Content you share in groves, garden club connections, or direct messages is visible to the users you share it with. Content you contribute to shared spaces (such as grove reflections and collaborative leaves) is visible to active grove members.
With service providers. We share information with third-party vendors who help us operate the service, including:
These vendors are contractually required to use your information only to provide services to us and to handle it in accordance with applicable law.
For legal reasons. We may disclose your information if we believe in good faith that doing so is required by law, to protect the rights or safety of TwinFlame Development, LLC, our users, or the public, or in connection with a legal proceeding.
Business transfers. If TwinFlame Development, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
Personal account data. We retain your account information for as long as your account is active. When you delete your account, your profile, credentials, and private content are permanently deleted.
Private content (solo trees, leaves, reflections, and sessions). Content you created entirely for yourself — trees, leaves, branches, contributions, and watering sessions not connected to a shared grove — is permanently deleted when you delete your account.
Shared and collaborative content. Content you contributed to shared groves — including reflections, leaf contributions, and collaborative trees — forms part of a shared record with other participants. When you delete your account, your identifying information in grove content is replaced with a pseudonymous identifier. The content itself is retained as part of the integrity of that shared record and remains visible to the other grove members. Your name, profile photo, and any other personally identifying details are removed from grove content at the time of deletion. De-identification of certain collaborative session data is an ongoing improvement; we will update this policy as that work is completed.
Treemail. When you delete your account, your Treemail inbox is no longer accessible. Messages are permanently deleted from our servers when their automatic retention period expires; the retention period varies by subscription tier.
Audit records. We retain a record of account deletion and data de-identification events for seven years as required for legal and compliance purposes. These records contain only a pseudonymous identifier confirming the deletion occurred — not your name, email address, or content.
Backups. Deleted data may persist in encrypted backups for a period before those backups are rotated and permanently overwritten.
Account deletion. You can delete your account at any time from Settings → Account. Deletion is permanent.
Marketing opt-out. If you have opted in to marketing emails, you can opt out at any time from Settings → Account, or by clicking "Unsubscribe" in any marketing email.
Access and correction. You can view and update most of your profile information directly in the app.
Additional rights for EEA and UK residents are set out in §12 below.
For all other requests regarding your personal information, contact us at support@innerleafs.com.
InnerLeafs is not intended for children under 18. TwinFlame Development, LLC does not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such information, please contact us at support@innerleafs.com and we will delete it promptly.
We implement reasonable technical and organizational measures to protect your information. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
InnerLeafs is operated by TwinFlame Development, LLC, based in the United States. If you access the service from the European Economic Area, United Kingdom, or other regions, your personal information will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country.
For EEA and UK users: We transfer your personal data to the United States and to our service providers (including Google Firebase, Resend, Stripe, RevenueCat, and our AI service providers) on the basis of Standard Contractual Clauses approved by the European Commission, or other appropriate safeguards as required under Chapter V of the GDPR. You may request a copy of the applicable safeguards by contacting us at support@innerleafs.com.
We may update this Privacy Policy at any time. We will notify you of material changes through the service or by email. Non-material updates — such as changes to the specific service providers within a disclosed category — take effect immediately upon posting.
If you are located in the European Economic Area or United Kingdom, the GDPR and UK GDPR grant you the following rights with respect to your personal information. We will respond to verified requests within 30 days.
Right of access (Article 15). You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data and information about how it is processed.
Right to rectification (Article 16). You have the right to have inaccurate personal data corrected and incomplete data completed.
Right to erasure (Article 17). You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and there is no other lawful basis), where you object and we have no overriding legitimate grounds, or where deletion is required by law. Note that content you contributed to shared groves will be de-identified rather than deleted — see §5 for details.
Right to restriction of processing (Article 18). You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.
Right to data portability (Article 20). You have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller, where processing is based on consent or contract and carried out by automated means.
Right to object (Article 21). You have the right to object to processing of your personal data where we rely on legitimate interests as the lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims. You have an unconditional right to object to processing for direct marketing purposes at any time.
Right to withdraw consent (Article 7(3)). Where processing is based on your consent (such as marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Right not to be subject to automated decision-making (Article 22). InnerLeafs does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
How to exercise your rights. Submit requests to:
TwinFlame Development, LLCWe may ask you to verify your identity before responding to your request. We will not charge a fee for reasonable requests; we reserve the right to charge a reasonable fee or decline manifestly unfounded or excessive requests.
Right to lodge a complaint. If you believe we have processed your personal data in violation of applicable law, you have the right to lodge a complaint with the supervisory authority in your EEA member state or, for UK residents, with the Information Commissioner's Office (ICO) at ico.org.uk. We encourage you to contact us first so we can try to resolve your concern directly.
Controller identity. The data controller for your personal information is TwinFlame Development, LLC, 5600 Roswell Rd, Bldg C, Sandy Springs, GA 30342, United States. Contact: support@innerleafs.com.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), may provide you with additional rights regarding your personal information.
Categories of personal information we collect.
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Name, email address, IP address | Yes |
| Internet or network activity | Pages viewed, features used, session data | Yes |
| Geolocation data | Approximate location from IP address | Yes (approximate only) |
| Inferences | Preferences derived from your use of the service | Yes |
| Sensitive personal information | Account login credentials | Yes |
We do not sell or share your personal information for cross-context behavioral advertising as those terms are defined under the CCPA.
Your California rights. California residents may have the right to:
How to submit a request. Contact us at support@innerleafs.com. We will verify your identity before processing your request and will respond within 45 days. We may extend this period by an additional 45 days with notice.
Authorized agents. California residents may designate an authorized agent to submit requests on their behalf. We will require written proof of the agent's authorization and may verify your identity directly.