Privacy Policy

My Garden is operated by Comenium Consulting. Comenium Consulting (“we”) is responsible for your personal information as its “controller.” You can reach us about anything in this policy at support@comenium.info.

This policy explains what information My Garden collects, how we use and share it, how long we keep it, and the rights you have. It applies to the My Garden website and related features.

Depending on how you use My Garden, we process:

• Account information from Google sign-in: your email address, name, and account identifier.
• Your generated or chosen community nickname, and your settings.
• Garden information: plant names, photos, locations, notes, dates, care schedules, and care history.
• Information about caretaker invitations, caretaker access, blocks, reports, and notifications. If you invite someone by email, we store the address you entered.
• What you submit to AI features, including plant photos and the plant-care context you provide.
• Records of AI feature use: the feature, the model, the amount of content processed, and when.
• The date and version of the Terms of Service you accepted.
• Technical and usage information: page-view analytics, product events such as adding a plant, device and browser details, and the approximate city inferred from your IP address when you sign in.

We do not collect precise location. Location data embedded in photos (such as GPS coordinates) is removed when a photo is uploaded.

We use information only for the purposes below. If you are in the European Economic Area, the United Kingdom, or Switzerland, each purpose relies on the legal basis shown.

• Running the service you asked for: your account, private garden, reminders, Community sharing, caretaker collaboration, and the AI features you request. Legal basis: performing our contract with you (the Terms of Service).
• Keeping the service safe and affordable: automated safety reviews of photos, community notes, nicknames, and new shared care guides; usage limits; security; preventing abuse; and fixing problems. Legal basis: our legitimate interests in a safe, reliable service.
• Service emails: caretaker invitations and care notifications. Legal basis: our legitimate interests. You can turn them off in Profile.
• Understanding and improving the service: product analytics and AI usage records. Legal basis: our legitimate interests.
• Legal and account administration: recording Terms acceptance, approving or blocking accounts, and responding to lawful requests. Legal basis: legal obligations and our legitimate interests in enforcing our Terms.

We do not use your information for advertising, and we do not sell it.

Your garden is private by default. If you share a plant with Community, anyone can see that plant's species information, its name, your community nickname, a public note, and the photos you selected for sharing. Private notes, locations, watering history, schedules, and health reports are never part of the Community view.

If you invite a caretaker, that person receives only the access and permission you grant, and may see private information needed to care for that plant. When you invite someone by email, you will not learn whether the address has a My Garden account, or which nickname it belongs to, unless they accept.

We use these service providers, which process information only to provide their services to us: Supabase (sign-in, database, and file storage), Vercel (hosting and privacy-friendly analytics), OpenAI (AI features and safety reviews), Resend (email delivery), and Google (sign-in). We may also disclose information when required by law or to protect people's safety.

Our service providers store and process information in the United States and other countries. When information about people in the European Economic Area, the United Kingdom, or Switzerland is transferred, we rely on our providers' Standard Contractual Clauses and, where they participate, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

When you request plant identification, care-guide drafting, or a health check, we send the relevant photos, plant details, and context to OpenAI and use the response to provide the feature. Photos, community notes, nicknames, and new shared care guides are also checked automatically by OpenAI before they are published. We ask OpenAI not to store these requests, though OpenAI may keep them briefly to monitor for abuse under its own policies.

The automated safety review decides whether content can be published. It has no legal or similarly significant effect on you. If you think content was declined in error, contact us and a person will review it.

My Garden uses only cookies that are necessary for sign-in and for confirming your account's access. Your browser also stores a few interface preferences, such as dismissed notices. Our analytics do not use cookies, and we do not use advertising or cross-site tracking.

Because we do not track you across other websites, the site behaves the same whether or not your browser sends a Do Not Track signal. We honor Global Privacy Control signals as a request to opt out of the sale or sharing of personal information. We do not sell or share personal information.

• Your account and garden are kept while your account exists.
• Photos, plants, and health reports you delete are permanently erased within 30 days.
• When you delete your account, it and its private data and photos are deleted right away.
• Sign-ups that are not approved are deleted after 180 days.
• Accounts an administrator removes are deleted after 90 days. Blocked accounts are kept while they are blocked, to prevent abuse.
• Email addresses in caretaker invitations are erased 30 days after the invitation ends.
• Usage-limit records are kept for about 2 days.
• Product analytics events and AI usage records are kept for about 13 months and are no longer linked to you once your account is deleted.
• Care guides you added for a new species stay in the shared plant library without your identity. Care you recorded on another gardener's plant stays in their history as “Former gardener.”
• Our providers may keep backups and server logs for a limited time under their own schedules.

Private garden information is limited to the account owner and the caretakers they authorize. Photos are kept in private storage, and data is encrypted in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Wherever you live, you can use these tools at any time, even if your account is not approved:

• Get a copy of your data: use Download my data in Profile, or on the account status page if your account is not approved, to receive your information in a machine-readable file.
• Correct your data: edit it in the app, or contact us.
• Delete your data: delete individual items, or delete your whole account from Profile.

Depending on where you live, you may also have the right to object to or restrict how we use your information, and to withdraw any consent you gave. To make a request, email support@comenium.info from the address on your account. We respond within one month, or within 45 days for California residents, and may need to confirm your identity first. You will not be treated differently for using your rights.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may also complain to your local data protection authority, such as the UK Information Commissioner's Office.

In the past 12 months we collected these categories of personal information:

• Identifiers, such as your name, email address, and account identifier.
• Internet or other electronic activity, such as product events and page views.
• Approximate location (city-level), inferred from your IP address at sign-in.
• Photos and content you create, such as plant photos, notes, and health reports.

We collect this information from you, from your browser, and from gardeners who invite you. We use it for the purposes in section 3 and disclose it only to the service providers in section 5 for those purposes. We do not sell or share personal information, have not done so in the past 12 months, and do not knowingly sell or share information about anyone under 16. We do not use sensitive personal information to infer characteristics about you, and we do not share personal information with third parties for their own marketing.

California residents have the right to know what we collect, to delete it, to correct it, to opt out of its sale or sharing, and not to be discriminated against for using these rights. You can use the tools in section 11, or an authorized agent can contact us on your behalf with your written permission.

My Garden is not directed to children and requires users to be at least 13. We do not knowingly collect personal information from a child who is not permitted to use the service. If you believe a child has provided personal information, contact us so that we can review and delete it.

We may update this policy when the service or the law changes. We will post the updated policy here and change the effective date, and we will give notice in the app or by email before significant changes take effect.

Questions about this policy or a privacy request may be sent to support@comenium.info.