Privacy policy

Who is responsible

Bram van der Holst, the Netherlands. Send questions about your data to bramvanderholst@gmail.com.

Which data, and for what

Account

At the first start, the app makes an account without a name or email address. If you link your Google account, we keep your name and email address from Google. With it, you get your plants and purchases back on a new phone. The app also takes your first name from Google, for when you share a garden. You can change this first name in the app.

Your plants

For each plant, we keep the species, the place (garden, terrace or indoors), a nickname and cultivar if you enter them, the date since when you have the plant, a photo, your reminders and the tasks that you tick off. The app plans your care with this data.

Sharing a garden

With a linked Google account, you can share your garden, or become a member of the garden of another person.

• An invite is a code of 6 characters, also as a link or a QR code. It works one time and for 7 days. We keep the code, who made it, who used it and when. Of a wrong code, we keep only the time, to limit the guessing of codes.
• All members of a garden see and change the plants with their photos, the areas, the reminders and the tasks. They see the first name of the owner and of the other members, who added a plant, who ticked off a task and when, and how many spots the garden has. They do not see your Plant doctor diagnoses.
• Only you see your own settings for a garden: which notifications you get and at what time, whether you mute the garden, and the name that you gave the garden.
• If you buy spots for the garden of another person, these spots belong to that garden. We keep who bought them.
• While the app is open, it gets a signal when another member changes the garden. This signal contains only who made the change. Supabase deletes it after a few days.
• If you leave a garden, or the owner removes you, you cannot open that garden anymore. The plants that you added and the tasks that you ticked off stay in that garden, with your first name.

Scanning

The app sends the photo of a scan through our server to Pl@ntNet to recognise the plant. We do not keep that scan photo. If you add the plant, we keep a smaller version as the photo of your plant. For each scan, we keep the time, the best species and how sure the match is. With this, we keep the limit of 25 scans per day and see which species are still missing from the catalogue.

Plant doctor

The app sends the photo of a sick plant through our server to Plant.id. We keep the result and a smaller version of the photo, so that you can see earlier diagnoses again. Plant.id deletes the diagnosis as soon as we have the result.

Location

Only if you choose “Use location” in the app. The app rounds your location to about 1 km and keeps it on your phone. For the weather forecast, the app sends that rounded location to our server. The server asks for the forecast for a point in a grid and keeps it without a link to you. Without your location, the app uses the weather in De Bilt (the Netherlands).

Purchases

You pay through Google Play. We keep which product you bought and the purchase code from Google, so that the app can give you your spots and diagnoses. We do not see your payment details.

Calendar and notifications

If you choose the calendar, the app puts your tasks in a separate calendar for each garden on your phone. The app also plans notifications on your phone. Nothing goes to our server for this.

Usage overviews

We make overviews of the use, such as how many plants people add and how many people still use the app after a week. For this, we keep for each account on which days and how often you opened the app, and on which days the app had contact with our server. The overviews contain no data about you as a person.

Waiting list on this website

If you sign up for the waiting list, we keep your email address and whether you have an iPhone. We email you when the app is available.

Legal basis

We use your data to make the app work that you use (performance of the contract). For the scan limit, the improvement of the catalogue and the usage overviews, we have a legitimate interest. For your location and the waiting list, we ask your consent. You can withdraw it at any time.

Who processes your data

• Supabase hosts the database, the photo storage and our server, in Frankfurt (Germany).
• Pl@ntNet (France) recognises the plant on a scan photo. Pl@ntNet does not keep the photo, only during the recognition.
• Plant.id by Kindwise (Czech Republic) assesses the photos of the Plant doctor.
• MET Norway (Norway) supplies the weather forecast. It gets only the grid point from our server, no data about you.
• Google processes the sign-in with Google and the payments through Google Play.
• GitHub by Microsoft (United States, under the EU-US Data Privacy Framework) keeps our backups of the database and the photos. We encrypt them before we send them, so GitHub cannot read them.
• Anthropic writes care advice for species that are not in the catalogue yet. It gets only the name of the species.

Supabase and the providers process technical data, such as your IP address, for a short time for security.

How long

We keep your account and everything that belongs to it until you delete the account. An account without a link to Google that had no contact with our server for 12 months, we delete automatically, with everything that belongs to it. While the app is on your phone, it has contact every day, also if you only get notifications.

If you delete your account, we also delete your first name, your memberships and your invites. If you share your garden, that garden also goes for the members. Plants that you added to the garden of another person belong to that garden and stay there, with their photos. Your name then goes from that garden.

We keep a backup for 14 days. If you delete your account, your data stays in a backup for at most 14 days.

We keep your email address on the waiting list until you ask us to delete it.

Your rights

You may see your data, have it corrected, have it deleted or receive it in a file. You may also object to the use. Email bramvanderholst@gmail.com for this. If you do not agree with how we use your data, you can make a complaint to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority in your country.

How to delete your account and data is on Delete account.

Children

Garden Hero is not for children younger than 16 years.

Changes

If this policy changes, the new date is at the top of this page.