1. What we collect
We collect the minimum needed to run a grow log. That falls into three groups: account details, the cultivation records you create, and a small amount of technical information needed to keep the service working.
- Account details: your email address, and the display name and preferences you enter during onboarding.
- Cultivation records: batches, stage events, harvests, contamination events, substrate recipes, reminders, and any photos you upload.
- Billing details: handled by Stripe. We store a Stripe customer identifier and subscription status, never your card number.
- Technical information: standard server logs and error reports used to keep the service available and secure.
2. How your data is protected
Every record in the database carries an owner, and access is enforced by row-level security inside the database itself. That means a query made on your behalf can only ever return your own rows, regardless of what the interface asks for.
Uploaded photos are stored in a private bucket. Access rules are scoped to a folder named after your user identifier, so one account cannot read another account’s files.
Subscription status is readable by your account but not writable by it, so plan entitlements cannot be altered from the browser.
3. How we use your data
Your cultivation records are used to render your own dashboard, analytics and exports. We do not sell personal data, and we do not use your grow records to train machine learning models.
Your email address is used for account messages and for the reminders you configure yourself. We do not send marketing email, and reminders can be switched off individually or entirely.
4. Cookies and local storage
We use essential cookies and local storage to keep you signed in, to remember your theme preference, and to remember your cookie choice. These cannot be switched off without breaking sign-in.
Analytics cookies are off by default. If you choose "accept all" on the cookie banner, privacy-respecting analytics may be enabled. Choosing "essential only" leaves them off.
5. Third parties
We rely on a small number of processors to operate the service. Each receives only the data needed for its specific role.
- Supabase — database, authentication and file storage.
- Stripe — subscription billing and the customer portal.
- An email provider — account messages and reminders you configure.
- Hosting infrastructure — serving the application and storing server logs.
6. Retention and your rights
Your records are retained while your account is open. You can export everything as CSV or JSON at any time from Settings, and you can delete your account permanently from the same screen, which requires a typed confirmation.
Depending on where you live, you may have additional rights to access, correct, port or erase your personal data, and to object to certain processing. Requests can be made through the contact details on this site.
7. Children
The service is not directed at children, and we do not knowingly collect personal data from anyone below the age at which they can consent to data processing in their jurisdiction.
8. Changes to this policy
If this policy changes materially, we will make the change visible in the application before it takes effect. Continuing to use the service after a change means you accept the updated policy.