Privacy, in plain language.
Your plans on your device
The website stores plans, crop details, notes and unfinished forms in your browser. The mobile app stores plans and growing records in a local database. Account credentials are stored using the device’s secure storage. Export a backup before clearing browser storage or removing the app. Exported files are shared only through the destination you choose; that destination has its own privacy practices.
Account sign-in and backups
We use your email to verify sign-in and connect your account across devices. Cloudflare hosts our service and database, and Resend delivers sign-in and recovery emails. Session credentials and verification secrets are stored as hashes on the server.
When signed in on the website, indoor plans and their unfinished forms are backed up under your authenticated account, identified using a one-way hash of your email. In the mobile app, you select plans in Account & backup and sync them. Synced plans include crop details, progress, observations, and season settings such as ZIP and city. Separate calendar task checkmarks and task notes stay on the mobile device. Sign-in alone does not upload every local mobile plan.
Location references
ZIP reference lookup uses reference data supplied with this product. The website requests a regional file based on the first two ZIP digits and matches the full ZIP locally. The ZIP lookup itself does not send your full ZIP, growing zone or frost settings to GeoNames, USDA, NOAA or our product analytics. Weather requests are described separately below. They are included in an account backup when the plan is backed up. Hosting logs may record regional file requests.
Outdoor gardens, photos and local weather
Outdoor gardens, their unfinished edits, connected growing projects and garden photos are saved locally in the browser or mobile app where you edit them. Outdoor gardens and photos are not included in the indoor account backup and do not automatically sync between the app and website. Use an outdoor JSON export to keep or transfer a copy. Clearing browser storage or removing app data can remove these local copies. Your device or operating-system backup settings may also affect local copies.
Choosing device location requests a location fix from your browser, with your permission. You can use ZIP lookup or enter location information instead. The app does not continuously track your location. Local weather requests send the garden’s coordinates to the US National Weather Service; that service also receives normal network request information, including your IP address. Nearby observations and forecasts may differ from conditions in your bed. Sun and shadow views are calculated from your supplied location and scene; they are not measurements of your garden.
Payments and purchase access
Stripe handles website checkout. Apple handles App Store in-app purchases where enabled. We do not receive your full payment-card number. For website purchases, we store the checkout and payment references, purchase email, entitlement status and purchase time. For Apple purchases, we store an account-to-purchase identifier and verified transaction references, product, environment, purchase status and verification times. These records support purchase access, restoration and refund reconciliation.
Our server verifies Apple purchases; a purchase is not confirmed solely by a message from the device. The app can cache verified Complete access for up to seven days while you stay signed in. Checking access contacts our service and may require verification with the payment provider.
Website analytics and operational records
Website analytics count named events by day, such as generating a schedule or using repair. These counts do not store plan contents, advertising identifiers, cross-site cookies or analytics user profiles. A daily salted hash of the request address limits abusive requests. Cloudflare, email and payment providers may maintain operational records under their own policies. Information you send to support is used to respond to your request.
The website also honors the browser’s Do Not Track signal. Aggregate counts cannot recover a deleted plan.
Removing plans and account data
Deleting a backed-up plan also requires its account backup to be updated. On mobile, complete the sync and resolve any removal choices shown. Other connected devices receive changes when they sync. Local copies can remain on other devices, and files you previously exported are not removed. Clearing local storage alone does not erase an account backup.
Disconnecting a device signs it out; it does not delete the account. In the mobile app, open Account & backup and choose Delete account after signing in. This control appears when the server confirms deletion is available. If it is unavailable, use the help page for an account-data request; signing out alone is not deletion. Confirmed account deletion removes account backups, sign-in sessions and pending sign-in or recovery links. Local plans remain on the device. Account deletion also removes server-side Apple purchase-account links and removes your email from existing website purchase records. The mobile app clears its cached purchase access when it confirms deletion; other devices check their sessions when they next connect. Limited transaction references, payment status and accounting records remain separately for financial recordkeeping. App Store access can be restored using an Apple-signed receipt; website access after deletion can be restored using your original purchase email and checkout reference. Deletion does not issue a refund. See website purchase restoration. For account-data, purchase-record or privacy requests, contact us through the help page.
Where account deletion is enabled, a separate restricted record keeps an email-derived identifier, deletion time and outcome so that restoring an older backup does not bring deleted account data back into service. It contains no plans or notes. This identifier is pseudonymous, not anonymous. We retain these records while older recoverable backups may contain the account. Historical backups are not erased instantly.