Privacy Policy

1. Information you provide

Account information: your email address, display name, account identifier, authentication information, and account or membership status. Password-based sign-in is handled by Supabase. Please never send a password to our support inbox.

Garden information: plant and seed inventories, growing zones, garden or room names, beds and layouts, planting and care records, journal entries, observations, photos, learning progress, badges, settings, and other details you choose to save. If you import a supported spatial scan, it can include a three-dimensional layout, plant positions, identifiers, and capture time. A layout may reveal information about a home or property even without GPS coordinates. The current browser spatial-scan import is held in memory rather than included in cloud garden sync; exporting it creates a file you control.

Orders and billing: contact information, items and quantities, prices and taxes, payment status, subscription and transaction identifiers, paid-through dates, and requested or confirmed pickup arrangements. Stripe collects payment details and billing addresses during checkout; shop checkout can also request a phone number. We receive the information needed to manage the order or subscription, but do not store full payment-card numbers in the app's database.

Support and feedback: the message you send, any contact information you provide, a related account identifier, the feedback category, and the page associated with a report. Avoid including sensitive information that is not needed for the request.

For business-management features, users with authorized access may save supplier and seed-order details, purchase amounts, inventory, receipts-derived fields, customer/order records, nursery records, and related photos. Only provide information you are authorized to use.

2. Device storage, usage events, and referrals

The app uses browser local storage for garden records, preferences, sign-in sessions, cached weather, and some drafts. Local storage usually remains until you or your browser clear it. Anyone with access to the same browser profile may be able to see device-stored garden content, including after sign-out.

We collect first-party usage events such as feature visits and actions, timestamps, selected feature or plant labels, growing zone, and event details. These events do not include your signed-in account ID by default, but event details may still contain personal information. Usage events help us understand and improve the service.

Referral links can store a referral code and a randomly generated visitor identifier on your device. Referral visits and account signups can be associated with the referral to measure referrals and maintain program records. A referrer is not given access to your private garden records through this process.

Our hosting, authentication, email, and payment providers may also process technical data such as IP addresses, browser information, request times, and security or delivery logs to operate their services.

3. How we use information

We use information to provide and sync your garden, personalize guidance to the settings you choose, authenticate access, administer memberships and orders, arrange pickup, send requested or operational messages, respond to support requests, troubleshoot problems, understand feature usage and referrals, maintain security, prevent abuse, and meet applicable recordkeeping or legal obligations.

Private records are not automatically published or reused as public reference images or advertising. Saving content does not transfer its ownership to us. We do not sell personal information, and the current app does not use advertising pixels to build cross-site targeted-advertising profiles.

4. Photos, receipt reading, and identification tools

The normal photo-selection flow resizes or re-encodes images in your browser, which is intended to remove embedded metadata before upload. This is not a guarantee that all metadata or identifying content is removed from every possible input. Visible addresses, faces, documents, and distinctive locations can still identify someone. Check a photo before saving it.

Personal garden photos require sign-in and are linked to your account. Business-management photos require authorized business access. These controls restrict routine access; they are not a promise that no service provider or authorized administrator can ever process stored information for support, security, or operations.

The business seed-order importer reads supported receipt files in the browser. It does not upload the original receipt file through that importer. Reviewed fields, such as supplier, order reference and date, line items, prices, source filename, and notes, are sent to our service when you request an import preview and retained as business records when you save. Do not place unnecessary personal or payment information into saved notes or fields.

The business seed-packet reader performs English text recognition in the browser using locally served reading components. Photos or extracted fields you choose to save may then be uploaded to your authorized records. Local reading does not mean all resulting records stay on the device.

The general plant-photo and seed-packet identification screens may send selected images and growing zone to our own service. Their identification endpoints are currently unavailable and do not forward images to an external AI-identification provider. If a future feature sends personal content to a new AI provider or uses it for a materially different purpose, we will explain that handling before you use the feature and obtain consent where required.

5. Location and weather

Weather is based on a location you enter, such as a city or five-digit ZIP code. The weather feature sends that coarse location to Open-Meteo for a lookup, then requests a forecast using coordinates returned for the place. It does not request your device's GPS location. Your saved location label and weather settings may remain on your device and in synced garden information.

Direct browser requests let the weather provider receive ordinary request information, including your IP address. Avoid typing a street address into garden names or other free-text fields if you do not want it stored with your records.

6. Service providers and other disclosures

We use OpenAI Sites and Cloudflare for website hosting and infrastructure, including database and file storage; Supabase for account authentication; Stripe for payments and billing; Resend for app-generated email; and Open-Meteo for weather and place lookup. Some pages also load YouTube videos through privacy-enhanced embeds and botanical images from Wikimedia servers; those services receive ordinary network requests when their content loads. If you contact our Gmail address, Google processes the message as our email provider. These services receive the information needed for their role and may have additional responsibilities under their own privacy notices.

For example, Stripe receives billing and transaction information, email services receive recipient and message information, and hosting providers process stored records and network requests. A provider's involvement does not mean your private garden has been published.

We may disclose information when reasonably necessary to comply with law or a valid legal request, protect the security and rights of users or the service, address fraud, or obtain professional advice subject to appropriate confidentiality. If the business changes ownership, affected information may be transferred as part of that transaction subject to applicable law and appropriate notice. This is not permission to disregard the protections in this policy.

Links to outside retailers, affiliate offers, or social platforms take you to services with their own practices. They may receive click or referral information and use their own cookies. An affiliate relationship does not give them automatic access to your saved private garden. The current community composer is a device-local preview, not a functioning network feed; its drafts should not be treated as successfully published to other members.

7. Cookies, local storage, and messages

Browser storage supports sign-in, garden saving, preferences, referrals, and cached information. An owner-session cookie supports protected administration. Infrastructure and payment services may use necessary cookies or similar technology for security and their features. We do not currently offer a general analytics-consent switch. Browser settings can clear or block storage, but doing so may sign you out or permanently erase guest-only records.

The current app does not change its collection behavior in response to a browser Do Not Track signal. It does not use a cross-site advertising-pixel system or sell personal information. You may email privacy requests, including any opt-out right available under applicable law. We will update these disclosures and controls before materially changing advertising practices.

Account verification, password-reset, billing, order, pickup, and support messages may be necessary to provide the service. Contact alifeofplanty@gmail.com to ask about optional messages or request that they stop. Optional email programs will include an appropriate working choice before they are used.

8. Retention and security

Information may be retained while needed to provide your account or records, complete orders, meet recordkeeping requirements, resolve disputes, or protect the service. We do not currently have one fixed automatic-deletion period for every category. Retention depends on the purpose, type of data, applicable obligations, and the systems that hold it. Provider backups and legally required transaction records may remain after an active record is removed.

We use authentication, access restrictions, and other technical and organizational measures intended to protect information. No online system or device storage is completely secure. Do not use the app as the only copy of an irreplaceable record, and contact us if you suspect a privacy or security problem.

Service providers may process information in the United States and other countries where they operate. This policy does not claim all data is stored in Texas or exclusively in the United States.

9. Access, correction, copies, and deletion

You can edit supported records in the app. You may also email alifeofplanty@gmail.com to request access, correction, a copy of information, account closure, or deletion. Please identify the account email and the information or action involved. We may need to verify that the request comes from the account holder, but please do not send passwords, complete payment-card details, or identity documents unless a secure and necessary method has been arranged.

The cloud-garden delete control removes the synced garden-state record. It leaves the copy on your device and does not itself delete your authentication account, separately stored photos, purchases, subscription records, support messages, or referral records. Signing out also leaves the device garden available. A broader deletion request needs to be made separately by email. To stop subscription renewal, request cancellation as well; deleting data is not the same as canceling billing.

There is no current one-click export of all account information. We will assess requests and respond as required by applicable law, including any lawful exceptions and explanations of information we must retain. Browser-only records cannot be retrieved from our servers if they were never synced or submitted.

Depending on your location and the law's applicability, you may have additional rights to know about processing, obtain a portable copy, correct or delete data, withdraw consent, or opt out of certain uses. If we deny a request, you can ask us to reconsider by replying with 'Privacy appeal.' You may also contact the relevant privacy or consumer-protection authority. We will not unlawfully discriminate against you for exercising a privacy right.

10. Children

Accounts and purchases are intended for adults age 18 and older. We do not offer child accounts or knowingly collect personal information directly from children under 13. If you believe a child under 13 has provided personal information, contact alifeofplanty@gmail.com so we can investigate and take appropriate action. Please do not create a child profile or upload children's private information to the service.

11. Policy updates and contact

We will show the effective date of this policy and update it when practices change. For material changes, we will provide appropriate notice, and obtain consent when the law requires it. A later policy will not silently authorize materially different uses of information already collected.

Privacy contact: Marisa Jensen, A Life of Planty, alifeofplanty@gmail.com.