What the app holds about you, why it holds it, who else is involved, and what you can ask me to do about it.
Dan Birchwood, who runs What Gardening Today?, is the data controller. I am an individual in the United Kingdom, and this is a personal project rather than a company.
Email whatgardeningtoday@gmail.com about anything on this page, including any of the rights below.
| Information | Where it comes from |
|---|---|
| Your email address | From Google when you sign in. |
| Your Google display name, and a link to your Google profile picture | Returned by Google alongside your email address and kept by the sign-in system. The app does not display either of them. |
| Sign-in times | Recorded automatically when you sign in. |
| Your garden — the name you gave it, and its location stored as coordinates | From you, when you set it up. This may reveal where you live or spend time, so it is one of the more personal things the app holds. |
| What is in your garden — the plants, tools and structures you have added, and any names you gave them | From you. |
| Photos of garden items — one photo per item, where you choose to add one: a resized copy and a small thumbnail | From you. The photo is prepared on your device first: it is resized, and its location, camera details and the date it was taken are removed. The original stays on your device. See below. |
| Photos you ask the app to identify — only if your account can use Identify from photo | From you. The photo is prepared on your device in the same way, sent once to Pl@ntNet to suggest what the plant is, and not stored by the app. See below. |
| A note of each identification — that your account made one, and when | Recorded automatically, to apply the daily limit on identifications. See below. |
| Your own jobs — only if your account can use Your jobs: what needs doing in your words, and any date, repeat, rough duration or garden item you chose, plus which account added, completed or deleted each one and when | From you, and recorded automatically as you use them. See below. |
| Photos of your own jobs — one optional photo per job: a resized copy and a small thumbnail | From you. The photo is prepared on your device in the same way as photos of garden items, and the original stays on your device. See below. |
| What you have done — jobs you have ticked off and when, and jobs you have chosen to hide | From you, as you use the app. This is what stops the same job being suggested again the next day. |
| That you opened the app — one record per garden per day, with a count | Recorded automatically. See below, because it is the item people least expect. |
| That the app looked up your weather — a short-lived note that it did, and when. Kept for five minutes. | Recorded automatically. See below. |
| Feedback you send through the app, together with your email address and which version of the app you were using | From you, if you use the feedback form. |
| Emails and other messages you send me directly | From you, if you get in touch. They include your email address and whatever you choose to put in the message. |
The app keeps a simple daily tally: this garden was opened today, this many times. It does not record which screens you looked at or what you did while it was open.
I use it to understand whether people come back, and whether the app is worth continuing to maintain. Answering that requires recognising that the same garden was opened on different days, which is why it is kept at all. It is not used to profile you, to advertise to you, or to make any decision about you, and it is not used for anything beyond the purposes described in this notice.
A photo belongs to the garden item it was added to, not to the person who added it. Everyone who is a member of that garden can see it, and any member can remove it. The app records which account added a photo, for support and to apply a limit on how many photos one account can add, but does not show this to anyone.
Photos are kept in private storage. They are not public: the app shows a photo only to members of its garden, using a link that stops working after an hour.
Photos are deleted when the photo or item is removed, when its garden is deleted, or when account deletion causes that garden to be deleted. Photos remain with shared gardens that survive an account deletion. A deleted photo disappears from the app straight away; its stored files are then erased by a regular clean-up, normally within a few days.
Your jobs is available only to some accounts while it is being tried out. A job you add belongs to its garden, like a garden item: every member of that garden can see it and its photo, mark it done or delete it, and any member can remove its photo. If a job is moved to another garden, it takes its photo with it and the members of that garden can then see both. A job's photo is separate from any garden item the job is linked to: neither is copied to the other. The app records which account added each job and photo, but does not show this to anyone.
Job photos are kept in private storage, apart from photos of garden items, and are shown only to members of the job's garden, using a link that stops working after an hour. Removing a photo does not recall a link that has already been issued or a copy a device has already cached: the link can keep working until its one-hour limit, and a cached copy can remain until that device clears it.
What deleting does. Removing a job's photo takes it out of the app straight away, and its stored files are normally erased at the same moment. Deleting a job hides it and its photo straight away; the job record and its photo files are kept, hidden, for about ten minutes so that the deletion can be undone, and are then erased by a regular clean-up, normally within a day. A completed one-off job stays under Completed, and can be restored with its photo, for 90 days after it was done; the same clean-up then erases it and its photo. A repeating job is kept as one job for as long as it exists: the app keeps only when it was last done, not a record of every time. Any job photo files left behind (for example if erasing them failed, or an upload was not finished) are erased by the same regular clean-up, normally within a few days. Deleting the garden, or an account deletion that deletes the garden, removes its jobs and their photo records from the database straight away, and the clean-up then erases their photo files. You can ask me to erase any of this sooner (see Your rights).
Identify from photo is available only to some accounts while it is being tried out. When you choose Identify, the app sends the photo you picked to Pl@ntNet, a plant identification service, which suggests what the plant might be.
The photo itself is handled only briefly. It is prepared on your device first: it is resized, and its location, camera details and the date it was taken are removed. The original stays on your device. The app's server passes the prepared photo to Pl@ntNet as the image itself, never as a link to it, and sends nothing that identifies you with it: not your name, email address, account or garden. Neither the app nor its server stores the photo or Pl@ntNet's answer, and the app discards the photo when you finish or leave the identification screen. Pl@ntNet says it holds submitted photos only in its servers' working memory while identifying them, and does not store them in its database. The photo can still show whatever was in the picture, so keep people, house numbers and car number plates out of it: a close-up of one plant works best anyway.
A record of each request is kept separately. Pl@ntNet keeps a history of the requests made through the app's service account, including their dates and times, and says it uses this to track usage and compile statistics. Its terms say this history can include the web address of a submitted image; the app sends the image itself, so there is no app address to record. Every request comes from the app's server under that one service account, so the history does not name you or your account, but it does record that a request was made. Pl@ntNet also receives the ordinary technical information involved in a request from the app's server. Pl@ntNet does not say how long it keeps this history.
If you then add the plant to your garden and your account can add photos to garden items, the same prepared photo is saved as that item's photo and is handled as described above for photos of garden items. Otherwise nothing from the identification is kept by the app.
The note of each identification records only that your account made one, and when. It is used to apply the daily limit and for nothing else. After 24 hours it stops counting towards the limit. It is physically deleted later: the next time anyone uses Identify from photo, or when you delete your account, whichever comes first. While nobody uses the feature, an expired note can therefore stay stored for longer than 24 hours, although it no longer has any effect. Like other database records, a note can also remain in the database backups for up to seven days after it is deleted.
The weather service I use allows the whole app only a small number of look-ups each minute, shared between everyone using it at the same time. To stop one person using them all up, the app keeps a brief note each time it fetches fresh weather for you — that it did, and when. It does not record where you were, what the weather was, or anything about what you were doing.
Each note is discarded five minutes after it is made. It is not used to profile you, to advertise to you, or to make any decision about you beyond that one: whether to fetch fresh weather again right now, or show you the reading it already had.
Some gardening jobs are spoiled by wet ground rather than by falling rain — watering a plant that does not need it, for instance. So when the app fetches fresh weather and finds rain, it keeps a note that it rained in that approximate area, and when, and holds those jobs back for a couple of days afterwards.
That note is about the weather in an area, not about you. It records no name, email address, account, garden or device — only the same rounded, approximate location that nearby gardens already share for the weather look-up, and the time. There is no way to tell from it who was using the app, or whether anyone was. Each note is discarded two days after it is made.
Some jobs only exist because of the weather — getting fleece over tender plants before a frost. When the forecast says a frost is coming, the app adds those jobs to your list and shows a warning above them. So that one long frost produces one warning rather than a fresh one every evening, the app keeps a short note against the garden and the job: that this cold spell is under way, and when it began.
It records no name, email address, account or device, and nothing about what you did — only that a threshold is currently being crossed for a particular job in a particular garden. It is not used to profile you, to advertise to you, or to make any decision about you beyond that one: whether this is the same cold spell you have already been told about. The note is deleted by the app itself once the weather has been clear for two days, and it is deleted with the garden if the garden is deleted.
Whether you have dismissed a warning is not part of that note. That stays on your own device, as described further down.
Alongside the current weather described above, the app also fetches a short forecast for the same approximate area, and keeps it for a few hours so that everyone nearby shares one look-up. Like the rain note, it is about the weather in an area and not about you: it records no name, email address, account, garden or device — only the same rounded, approximate location, and what the weather is expected to do there. Old entries are replaced as newer ones arrive.
You are not required by law to give me any of this. To have an account you must sign in with Google, and to get gardening suggestions you must tell the app where the garden is and what is in it. Sending feedback is entirely optional.
Where the app relies on legitimate interests — including the daily tally of app opens — you can object to it. Email whatgardeningtoday@gmail.com and say what you are objecting to. I will stop unless there is a compelling reason not to, and for the tally I would expect to simply stop.
The app stores the following on your device:
There is no advertising storage, no analytics storage, and nothing that follows you to other websites. These uses fall within the exceptions in the rules on storing things on your device, so the app does not show a cookie banner. The daily tally of app opens is recorded on the server, not on your device.
These are the services involved in running the app.
| Who | What they see |
|---|---|
| Signs you in. Google knows you have signed in to this app. In return the app receives your email address, your display name and a link to your profile picture. Google Fonts also delivers the app’s typefaces to your browser, receiving ordinary request information such as your IP address. | |
| Supabase | Stores the database and photos of garden items and jobs, and handles sign-in, on my behalf. The database and photo storage are hosted in Supabase's London region. |
| Cloudflare | Serves the website. Like any web host it processes technical information such as your IP address in order to deliver the pages to you. |
| GitHub | Runs and stores access-restricted database backups, including garden records and in-app feedback, for up to seven days. These do not include the sign-in system's account records or photos. GitHub also stores access-restricted maintenance reports with counts for each garden item type, showing how many items use a retired type or a type with no garden tasks. These reports contain no garden, user or individual item identifiers. These maintenance reports are kept for up to 90 days. GitHub also serves the older GitHub Pages address, processing technical information such as your IP address when you use that address. |
| jsDelivr | Delivers a software library the app loads in your browser. Like a web host, it receives your IP address and the technical information needed to deliver that file. |
| OpenWeather | Provides the weather, and a short forecast used for frost warnings. For both lookups the server sends a rounded, approximate location, not your name, email address, account ID or garden ID. Nearby gardens in the same rounded area share a cached reading. Weather icons load separately from your browser, so OpenWeather also receives your IP address and ordinary technical request information when an icon loads. |
| postcodes.io | Looks up a postcode you enter, and uses coordinates to check that a garden is in the UK and find its area. Those coordinates may come from your device's location or a postcode lookup. These requests happen from your own browser, so the postcode or coordinates used for the lookup, and your IP address, reach them directly. Coordinates sent for this check are not rounded to the coarse weather location. A free UK service run by Ideal Postcodes. |
| Pl@ntNet | Suggests what a plant is when you choose Identify from photo. It receives the prepared photo from the app's server, not from your browser, with no name, email address, account or garden, along with ordinary technical request information. It says it holds the photo only in working memory while identifying it, and it keeps a history of requests with their dates and times. See About identifying a plant from a photo. |
Nothing is sold to anybody, and nothing is shared for marketing or advertising.
The database is hosted in London.
Some of the services above operate internationally, and your information may be accessed or processed outside the UK — including when a provider's staff access their systems to support them. Where that happens I rely on the safeguards in each provider's data processing agreement, including the UK International Data Transfer Addendum where it applies. That does not cover Pl@ntNet, which is described next.
Pl@ntNet is different. It is a French research project, whose name belongs to the French research organisations CIRAD, INRAE, Inria and IRD, and its terms refer to French data protection law and the GDPR. Its published information does not say where its service is hosted, how long it keeps its request history, or whether submitted photos are used to improve its identification, and its terms do not include a data processing agreement. So the safeguards described above should not be assumed to apply to it. What limits the risk is what it receives: the prepared photo, with nothing that identifies you. I will update this notice if I learn more.
Ask me at whatgardeningtoday@gmail.com if you would like more detail about a particular transfer or the safeguards behind it.
Your account: for as long as it exists. Garden records: for as long as the garden exists. Photos of garden items: until the photo or its item is removed, or its garden is deleted. Your own jobs and their photos: as described in About your own jobs and their photos: a completed one-off job for 90 days, a deleted job only for its brief Undo, and a repeating job for as long as it exists. Photos you ask the app to identify: not kept by the app. Notes of each identification: they stop counting after 24 hours, and are deleted the next time anyone uses Identify from photo or when your account is deleted. Weather look-up notes: five minutes. Notes of recent rain in an area, which are not linked to anybody: two days.
You can delete your account yourself, from Settings inside the app. A successful deletion removes your account, your garden memberships, any feedback you sent through the app and any notes of plant identifications from the live database straight away. It cannot be undone through the app.
A garden where you are the only member is deleted too, including its contents, photos, job history, hidden jobs and daily activity records. If other members remain, the garden and those records stay available to them, including things you added or recorded and photos you added. If you were its only owner, ownership passes to the longest-standing remaining member. Please check what will happen before you confirm.
Deleted information may survive for a short time in access-restricted backups of the database, which do not include photos, for up to seven days, until those backups expire in the ordinary course. They exist to recover from a disaster, not to keep a copy of you, and they are not searched or used for anything else.
Emails and other messages you send me directly live in my email account and are not deleted by deleting your app account. I keep them for up to 24 months after our last exchange, and then delete them — unless one is still needed to deal with a complaint, a security problem or a legal claim. Ask me at any time and I will delete correspondence sooner.
Under UK data protection law you can ask me to:
Email whatgardeningtoday@gmail.com. I will respond without undue delay and normally within one month. If the law allows longer because a request is complicated, I will tell you inside that first month. There is normally no charge.
If you think I have handled your information badly, you can complain to me by emailing whatgardeningtoday@gmail.com. I will acknowledge it within 30 days, look into it, and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office, at any time and whether or not you have contacted me first: ico.org.uk, or 0303 123 1113.
The app stores no passwords — signing in is handled entirely by Google. Access rules are enforced in the database itself as well as in the app, and are designed so that you can reach only gardens you are a member of. Connections are encrypted.
No system is perfectly secure, and this one is run by one person as a hobby. So a practical suggestion rather than a legal one: please don't put anything sensitive into garden names, plant nicknames, job descriptions or feedback messages. The same goes for photos: other members of the garden will see them, so leave out people, house numbers and anything else you would rather not share.
The app is for adults, and you must be 18 or over to create an account. If I find out that somebody under 18 has created one, I will remove the account and its information.
If this notice changes in a way that matters, the date at the top will change and I will let existing users know, either directly or in the app. Small corrections happen without ceremony.
In one paragraph. The app knows your email address, your Google display name, where your garden is, what you grow, any photos you add to garden items, what you have done in it, and a daily count of times you opened it. If your account can identify plants from photos, a photo you choose to identify is sent to Pl@ntNet and not kept by the app. It uses that to tell you what to do in the garden today, to keep the service working, and to judge whether people come back. It shows no adverts, sells nothing, and carries no cross-site tracking. Deleting your account removes it and gardens where you are the only member; gardens with other members and their records remain for those members. Deleted data may remain in backups for up to seven days, and direct correspondence is kept separately as described above.