LeafRanger — AI Plant Care App and Plant Marketplace

LeafRanger's onboarding starts with the room, not the plant. The idea from day one was environment first: if the app knows the light at each spot, it can say where a plant belongs and how fast it will drink.

The model of a home

A home holds floors, rooms, spots and placements, drawn on a floor-plan canvas with draggable markers. The structure follows the home type, so on a farm each greenhouse sits at the floor level.

The light reading

A photo of a spot goes to a vision model, which sorts the light into one of five classes, from low light to direct sun. The app then blends that with signals a photo can't carry:

• the compass direction of the nearest window, mirrored north to south for homes below the equator;
• the type of placement (shelf, sill, floor);
• the local weather from Open-Meteo, so an overcast frame isn't read as a darker corner than it is.

One photo gives a usable first estimate straight away. Up to six photos taken at other times of day are added to the same spot and sharpen the reading; nothing makes the user wait for a perfect set. Each reading becomes a zone, such as Bright Indirect Zone.

Scoring without AI

Placement scoring is deterministic. Each species' light and water needs are scored against the zone, so the same plant in the same spot always gets the same answer, with the reason shown. AI reads the photos; rules make the decisions.

A number we removed

Early builds showed a confidence percentage on light readings, plant IDs and diagnoses. In July 2026 an audit found that one chip appeared in 11 places with five different meanings. We removed the number and show instead what each answer is based on, what is missing and a one-tap way to improve it, with certainty carried by words like likely and one possibility.

Every scan in LeafRanger is a paid API call, so we metered AI from the start rather than after the first bill.

Two services, two kinds of call

Perception (light, plant ID, leaf diagnosis, soil) runs on a small vision model with the photo and a strict JSON reply format. Herb, the chat assistant, picks a model for each turn: a small, cheap model for greetings and simple questions, a larger one when the turn has a photo, uses diagnostic words (yellow, rot, pest), asks two or more questions, runs past 220 characters or sits deep in a long thread. If a call fails, Herb falls back to the cheaper model and then to a fixed answer, so the chat never errors out.

Telemetry on every call

The token usage from each AI response is recorded per user per day, priced in micro-dollars against a per-model table, and summed into an AI cost, last 30 days card on the admin dashboard. Background work, such as researching a species the first time someone adds it, is billed to a separate system bucket. A scan with no photo attached never reaches the model and is not counted.

What the numbers said

In July 2026 the measured cost was about $0.004 per vision scan and about $0.01 per chat turn on the larger model. That set the pricing: scans are cheap enough to be the free tier's generous hook, and chat with Herb became the paid perk.

At the cap the API answers with a 429 and an upgrade message built from the same tier table, so the copy can never quote a stale number. Quotas reset at midnight UTC.

Watering is the promise the app lives or dies on, so it got the hardest review.

Groups, not plants

Plants with the same care profile in the same light zone are clustered into water groups, each with its own cadence and a friendly name. The user gets one reminder for the group, not one per pot, and can water, snooze or skip it in one tap.

What the review found

A sweep of 148 weather scenarios turned up four faults, and every one pushed the same way: water sooner.

1. Weather was applied twice, once baked into each group's base interval and again as a read-time adjustment with identical conditions.
2. Climate was part of the stored grouping key, so a hot week reshuffled people's groups.
3. A missing weather reading defaulted to zero and read as bone-dry.
4. Worst, none of the nine watering call sites passed a location, so every schedule had been using a fixed 31°C, 28% humidity placeholder that looks like a heat wave. For our test user's city the app said water every 3 days where the real answer was every 5.

The fix

Weather is now applied once. The location is anchored to the home rather than the phone, because plants don't travel with their owner. One resolver feeds every call site, and the forecast falls back in four steps (live reading, today's forecast, last known, unknown) with the source sent to the app, so a stale reading is shown as stale. The scenario suite now passes 195 of 195, and we proved it guards the fault by putting the bug back and watching it drop to 139.

Reminders that don't go quiet

The same review found that a group nobody watered was never reminded again. The server now works out each reminder time in the user's own time zone, respects quiet hours, and sends a push itself for people who stop opening the app.

The shop lets independent nurseries sell plants, pots, soil and supplies inside the app. Four rules made it more than a product grid.

Shop by Zone

A listing can be linked to a species. When a buyer picks a spot in their home, the same placement engine that scores their own plants scores each listed species against that spot's light zone, and listings that fit are badged and filtered. Pots and soil have no species, so they are left unscored rather than scored badly.

Live plants stay in their country

Live plants need phytosanitary certificates and import permits to cross a border, and soil is banned outright in many places. Rather than manage that, delivery is domestic only: a shop delivers in one country, with optional regions, and a separate region list for live plants, because five days in transit is fine for terracotta and fatal to a fern. One deliverability service now decides for every surface that shows or sells a product, after an earlier version applied the rule call site by call site and missed three of them.

Markets open one country at a time

Commerce is closed by default. An owner-only admin action opens a country only once it has a currency, a VAT rate, a shipping rate and a way to pay its sellers. The trigger was concrete: we could take payment from a buyer in Portugal but had no rail to pay a Portuguese vendor.

Disputes and money

A buyer can raise a dispute from payment until 14 days after delivery. The shop answers first; if it replies, the buyer can escalate at once instead of waiting out 48 hours, so being ignored is never the faster route. Only the disputed order's payout is held. Underneath sits an append-only, double-entry ledger in integer minor units, tested across currencies with zero, two and three decimal places, and running in shadow until live money flows.

Checkout itself still runs on a payment simulator. Connecting the live gateway is the next piece of work.

Subscriptions went through two designs in two weeks, and the second one has fewer moving parts.

First: RevenueCat

In early September 2026 we built subscriptions on RevenueCat, with its webhook as the only thing allowed to change a user's plan, refunds removing access straight away, and every charge posted to the ledger. It was tested end to end on the simulator.

The question that retired it

LeafRanger launches on Android first, with iOS later. Asked what RevenueCat did that we couldn't, the honest answer was: nothing Google doesn't expose directly. A cross-store layer earns its keep when both stores are live. On 10 September we replaced it:

• On the phone: our own Kotlin TurboModule over Play Billing Library 9.1.0, behind the same one-file purchases wrapper the screens already called, so not one screen file changed.
• On the server: a purchase is verified with the Play Developer API, the plan is granted, and only then is the purchase acknowledged. Google's real-time notifications arrive by Pub/Sub push, are checked with OIDC, de-duplicated by message ID, and always trigger a fresh fetch of the subscription rather than trusting the message. A daily job reconciles the lot.
• Grace periods keep access, as Google recommends; a refund drops the user to the free plan at once and posts a reversal to the ledger.

What testing caught

A 67-case suite runs against a stand-in for Google's API over real HTTP. Its first run booked a $499.00 charge for a $4.99 plan, because reference prices are stored in cents; it was fixed before anything shipped. On Android, Billing Library 9.1.0 refused to start a subscriptions-only app without enableOneTimeProducts(), and the error was being swallowed. We only found it by making the device test read the module's own log lines instead of the screen.

The work was merged in September 2026. A real test purchase waits on the Play Console account, which is the next step on the store side.