Overwater Privacy Policy

Version: 1.8 | Effective: 2026-06-04

Core principles — Overwater collects only the minimum necessary

Overwater does not require sign-up. The app runs on an anonymous device identifier (Device ID). User content such as your to-dos and notes is stored locally on your device.

When you use AI plant identification, the photo you take is sent to Overwater's server for processing and forwarded to PlantNet and Google Vertex AI (Gemini). The photo is discarded immediately after processing and is never permanently stored on Overwater's servers.

When you use the Today daily brief (humanSummary, plantSummary, lifestyle cards), your location coordinates and optional anonymous labels (e.g., age range) are forwarded to Google Vertex AI (Gemini) to generate the brief text. The input context is discarded immediately; the generated text is stored in the server cache for up to 25 hours.

When you use the Plus voice readout, the generated daily brief text is forwarded to Google Cloud Text-to-Speech to synthesize audio. The input text is discarded immediately; the synthesized audio is stored in the server cache for up to 25 hours.

Location data is used only for weather lookups and is passed to Open-Meteo, plus the Korea Meteorological Administration public data portal (data.go.kr) for Korean users. The KMA transfer uses grid cell numbers rather than raw coordinates. Overwater does not store location data.

Crash and diagnostic data is sent to Sentry for app stability. No personally identifying information is collected by default.

We collect no personal information for advertising or marketing purposes.

Overwater complies with the Korean Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Act on Consumer Protection in Electronic Commerce, among other applicable laws.

1. Information we collect

Required

• Device identifier (Device ID): anonymous account identification, request authentication — generated automatically on first launch
• Client secret hash: request integrity verification (original value never stored)

Optional (only when you provide it)

• Plant identification photo: forwarded to PlantNet / Google Vertex AI, discarded immediately after processing
• Daily brief input context (location coordinates, optional anonymous labels): forwarded to Google Vertex AI; input is discarded immediately, the generated text is cached on the server for up to 25 hours
• Daily brief text (humanSummary) for Plus voice synthesis: forwarded to Google Cloud Text-to-Speech; input text is discarded immediately, synthesized audio is cached on the server for up to 25 hours

Automatically collected

• Server access logs (IP, path, timestamp): security anomaly detection, rate limiting
• Crash and diagnostic data (Sentry): app stability improvement, exception/session tracking (no PII by default)

What we do not collect

• Sign-up information (name, email, phone number, date of birth) — Overwater has no sign-up flow
• Location data — sent to Open-Meteo for weather lookups, plus the KMA public data portal (as grid cell numbers) for Korean users only, never stored by Overwater
• To-dos, notes, and other user content — stored locally on device only
• Advertising identifiers (IDFA/AAID), behavioral tracking data
• Marketing or advertising data of any kind

2. Retention periods

• Device identifier / client secret hash: until device data is deleted or the user requests removal
• Plant identification photos: discarded immediately after processing (in-memory only, no server storage)
• Daily brief input context: discarded immediately after the generation request is processed
• Daily brief generated text / Plus voice synthesis output — server cache: up to 25 hours (hash-keyed; auto-deleted after expiry)
• Server access logs: 90 days
• Crash and diagnostic data (Sentry): retained according to the vendor's policy

3. Deletion procedure

• Electronic files are permanently deleted in a non-recoverable manner.
• Data is deleted without delay when retention expires or the purpose of processing is fulfilled.
• If a future payment feature creates legally required retention obligations, that information will be deleted after the applicable period ends.

4. Third-party sharing

We do not sell personal information or share it for advertising. Exceptions:

• With your prior consent
• When required by law (lawful requests from authorities)
• Coordinates shared with Open-Meteo (Germany), and KMA grid cell numbers (not raw coordinates) shared with the Korea Meteorological Administration public data portal (Korea, not a cross-border transfer) for Korean users — for weather lookups
• Photos shared with PlantNet (France) and Google LLC Vertex AI / Gemini (United States) for plant identification
• Location coordinates and optional anonymous labels shared with Google LLC Vertex AI / Gemini (United States) for daily brief text generation
• Daily brief text shared with Google LLC Cloud Text-to-Speech (United States) for Plus voice synthesis

5. Processing entrustment

• Server hosting (Railway, United States): server operations and data storage
• Open-Meteo (Germany): weather lookup API
• Korea Meteorological Administration public data portal data.go.kr (Korea, not a cross-border transfer): Korean weather warnings and short-term forecasts (grid cell numbers forwarded; raw coordinates are not transmitted)
• PlantNet (France): plant species identification API (image forwarded, discarded after processing)
• Google Cloud Vertex AI — identification (United States): AI plant identification inference (image forwarded, discarded after processing)
• Google Cloud Vertex AI — daily brief (United States): Today tab humanSummary/plantSummary/lifestyle card text generation (input context forwarded then discarded; generated text cached on server up to 25 hours)
• Google Cloud Text-to-Speech (United States): Plus user humanSummary voice synthesis (input text forwarded then discarded; synthesized audio cached on server up to 25 hours)
• Sentry (Functional Software, Inc., United States): mobile app crash and diagnostic data processing

6. Personal information of children under 14

Overwater does not require sign-up and may be used anonymously, including by children under 14.

The current version has no paid subscriptions or in-app purchases, so children cannot make purchases inside the app. If paid Plus subscriptions are introduced later, this policy will be updated in advance with the required guardian-approval information.

7. Your rights and how to exercise them

• Request access to, correction of, or deletion of your personal information. In-app data can be removed by the user directly or by uninstalling the app.
• Request deletion of server-stored data tied to your anonymous device identifier — contact the privacy officer below.
• Subscription refunds and cancellations: the current version does not sell subscriptions in the app. If subscriptions are introduced later, the relevant payment-provider procedure will be described.

8. Automated collection (cookies, etc.)

The app does not use cookies. Device identification relies on a UUID stored locally on the device.

9. Privacy officer and external reporting channels

• Name: Jiwon Jeong
• Email: hello@overwater.app

For privacy infringement reports or inquiries, you may contact:

• Personal Information Infringement Reporting Center (privacy.kisa.or.kr / 118)
• Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
• Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr / 1301)
• National Police Agency Cyber Investigation Bureau (cyberbureau.police.go.kr / 182)

10. Scope

This policy applies to the Overwater mobile app and the overwater.app website. After navigating to external services (Apple, Google Cloud (Vertex AI/Text-to-Speech), Open-Meteo, the KMA public data portal, PlantNet, Sentry, etc.), the respective vendor policies apply.

11. Policy changes

This policy may be revised as laws and services change. We will provide advance notice as follows:

• General changes: announced at least 7 days before the effective date through in-app notices or updates.
• Material changes (such as added collection items or changes in purpose of use): announced at least 30 days before.

This policy is written based on the Korean Personal Information Protection Act, the Information and Communications Network Act, and the Act on Consumer Protection in Electronic Commerce.