Privacy policy

1. Who we are and how to contact us

TESSARO APPS is an independent Brazilian studio that publishes and maintains its own mobile apps and games. Marau, Brazil.

This policy covers every product the studio publishes on Google Play and the App Store. Questions and requests about personal data: contato@tessaroapps.com.

The data protection officer required by art. 41 of the LGPD can be reached at contato@tessaroapps.com. It is the same channel for exercising the rights described in section 6.

2. What data each app collects

Account. GarageRank, Coin Value Snap, PlantScan AI, PhotoEvolve and Íris ask for an email address and a password to create an account. PhotoEvolve also allows signing in with a Google account, in which case we receive the email address and name attached to it. Idle Realms: Rise, VELDRA, InBloom and Íris work with an anonymous account: an identifier generated on the device itself, with no email and no name.

Photos you send. GarageRank stores photos of die-cast models, Coin Value Snap photos of coins, PlantScan AI photos of plants and PhotoEvolve the photos you choose to analyse. No app scans your gallery: you pick each photo yourself, one at a time, every time.

Audio. Íris only, and only when you choose to record a journal entry by voice. The other apps do not access the microphone.

What you create inside the app. Journal entries in Íris, models and ratings in GarageRank, the coin collection in Coin Value Snap, the identification history in PlantScan AI, game progress in Idle Realms: Rise and VELDRA. In InBloom, the couple's content stays on your device only and is never sent to our servers.

Subscription. When you subscribe, RevenueCat sends us your account identifier, the platform and the subscription status. Payment is processed by Google Play or the App Store: we never see, receive or store your card details.

Notifications. Coin Value Snap, GarageRank, InBloom, Íris, PhotoEvolve and PlantScan AI store a device notification identifier so we can deliver alerts. If you decline notifications, that identifier is never created.

What we do not collect. None of the apps collect location, contacts, calendar, browsing history or advertising identifiers. No app contains an advertising, analytics or tracking SDK: we do not measure your behaviour and we do not sell profiles.

3. How each type of data is used

Account: to recognise you between sessions and sync your data across devices. Legal basis: performance of a contract (LGPD art. 7, V).

Photos: the photo is sent to Anthropic's artificial intelligence model to produce the answer the app gives you — identifying the coin, the plant, or analysing the image. Anthropic uses the photo only to produce that answer. The photo is also kept in your account so you can revisit your history. You choose each photo you send. Legal basis: performance of a contract.

Audio: to transcribe and analyse the journal entry you recorded in Íris, and return the text and reflections inside the app. Because a personal journal can reveal information about your health, we treat this content as sensitive personal data. Legal basis: specific and highlighted consent (LGPD art. 11, I), requested in Íris before the first recording and revocable at any time.

What you create: it exists so the app can work. A journal has to store entries; a game has to store progress. We do not read this content and do not use it for anything else. Legal basis: performance of a contract — except the Íris journal, which follows the specific consent described above, as it involves sensitive data.

Subscription: to unlock paid content and recognise your subscription when you change devices. Legal basis: performance of a contract.

Notifications: to send the app's own alerts. We do not use this channel for third-party advertising. Legal basis: consent, which you can withdraw at any time in your device settings.

4. Third-party services that receive data

Supabase — database, authentication and file storage. Receives everything your account holds: email address, content you create, photos and audio. The servers are in the United States and Canada, which constitutes an international transfer of data under art. 33 of the LGPD. That transfer relies on art. 33, IX combined with art. 7, V: it is necessary to perform the contract you are a party to — without storing your data on Supabase the account cannot work. Policy: https://supabase.com/privacy

Anthropic — the artificial intelligence model used by Coin Value Snap, PlantScan AI, PhotoEvolve and Íris. Receives the photo or text at the moment of analysis and uses that content only to produce the answer the app displays. The call is made by our servers, never directly from your device. Policy: https://www.anthropic.com/legal/privacy

RevenueCat — subscription management. Receives your account identifier and the purchase status, never payment details. Policy: https://www.revenuecat.com/privacy

Google Play and the App Store — process subscription payments under their own policies. We only receive confirmation that the purchase exists.

Expo — delivers notifications. Receives the device notification identifier. Policy: https://expo.dev/privacy

Google — if you choose to sign in to PhotoEvolve with a Google account, we receive that account's email address and name. Policy: https://policies.google.com/privacy

5. Retention

For as long as the account exists. We do not delete what you store on a schedule: your journal, collection, photos and progress stay available until you delete them or delete the account.

Deletion inside the app. In GarageRank, Íris, InBloom and PlantScan AI, the delete-account button immediately erases the account and everything attached to it, including stored photos and audio. The action is immediate and cannot be undone.

Deletion on request. In Coin Value Snap, PhotoEvolve and Idle Realms: Rise, the delete-account option opens the deletion page on our website, which describes the procedure. We complete those requests within 30 days.

Uninstalling does not delete. Removing the app from your device does not delete the account or what is stored on the server. To erase it, use account deletion.

Subscription records. Purchase data may remain with Google, Apple and RevenueCat for as long as tax law and those companies' policies require, even after you delete your account with us.

6. Your rights under the LGPD

Under the Brazilian data protection law (LGPD, Law 13.709/2018) you may request: confirmation that we process your data, access to it, correction of incomplete or outdated data, anonymisation, blocking or deletion of unnecessary data, portability, information about who we share it with, and withdrawal of consent.

To exercise any of these rights, write to contato@tessaroapps.com with the subject “Privacy”. We answer within 15 days. If we need to confirm your identity, we ask only for the minimum required to do so.

7. How to request data deletion

Send an email to contato@tessaroapps.com with the subject “Data deletion”, telling us the app name and your account identifier (the registered email or the ID shown inside the app).

We confirm receipt and complete the deletion within 30 days. Data we are legally required to keep — such as tax records of purchases — is kept only for the legal period and then removed.

8. Minimum age

Our apps and games are not intended for children under 13. We do not knowingly collect data from children in that age range.

If we learn that an account belongs to someone under 13, we delete the data attached to it. Parents or guardians who identify such a case can write to contato@tessaroapps.com, and the deletion follows the procedure in section 7.

9. Changes to this policy

We may update this policy when we ship new features or when the law changes. The version in force is always the one published on this page.

Material changes to how we handle data are announced inside the app before they take effect.

10. Last updated

Last updated: August 21, 2026