Privacy

We hold your garden, your photos, your email address and the coordinates of your plot. We also use two analytics tools. PostHog shows us which pages and buttons get used and catches errors — it never sees a word you type or a photo you take, and it never sees your name or your email — once you sign in it knows your account only as a random number and which plan you are on. On the website, Ahrefs Web Analytics counts visits to each page, with no cookies. We do not sell any of it, we run no advertising trackers, and we never took your address in the first place. This page names every piece, says who else can see it, and tells you how to get it deleted.

Reading the site takes nothing from you

Browsing gardentrack.app — the guides, the plant database, the tools — does not require an account and does not identify you. There are no advertising trackers on this site, and two analytics tools run on it. Ahrefs Web Analytics counts visits to each page: which page, where the visit came from, and the country your IP address points to. By Ahrefs' own account it never stores the address itself, uses no cookies, and cannot follow a visitor from one day to the next. PostHog only ever sees which pages you opened, which buttons you tapped, and whether something broke — see the counting we do below for exactly what that means.

Two things happen in your own browser and never reach us. Plants you add from a plant page are saved in that browser and are not sent anywhere — that is why they are there when you come back on the same device and absent on a different one. A ZIP you type into a tool is used to work out an answer, is hidden from any recording of your screen, and is not stored against you. The link you arrived from is also remembered in that browser for 30 days: if you came from one of our posts, we keep that post’s campaign tag, so that if you later sign up we know which post brought you. It holds no name, email or anything you typed, and it is dropped after 30 days.

Our host, Cloudflare, processes ordinary request data — IP address, which page, when — to serve and protect the site, as every host on the internet does.

What we hold if you use the app

The app keeps your garden on your phone so it works without signal, and backs it up to your account on our server whenever you're online. That's what lets it survive a lost phone and show up on a second one. That copy is:

Your email address, when you joined, when you last opened the app, and your time zone so dates land on the right day. No name, unless you type one into a garden.
Your garden — beds, trays, plants, varieties, the dates you did things, what you harvested, and anything you wrote in the journal.
Where your garden is — coordinates and, if you gave one, a ZIP. We keep the coordinates and the dates, not the address. A street address is used to find the frost record for the roughly 800-foot square around your plot, and isn't kept with your garden.
The drawing of your yard, if you drew one: the outlines of your house and your neighbors' houses, and your trees, fences and sheds, measured in feet across your yard. It holds no address.
Your photos, kept in private storage that is never on a public web address.
Your conversations with the app, so it can remember what you just asked it.
Whether you've turned on sharing your Talk chats, and when you last changed it. It's off unless you turn it on — see sharing your Talk chats below.
Notification settings, if you turn alerts on.
Anything you send us through the feedback box, along with which screen you were on when you wrote it, so we can work out what went wrong.
A count of the questions and photos you send the app, and what answering them cost us. There are limits on a free product and this is how they are counted.
Which buttons you tap and which screens crash, through PostHog, our analytics tool — see the counting we do below. In the app, PostHog can also record your screen: every word you typed and every word on screen is hidden before the recording is made, and your photos are blocked from it entirely. It never sees your name or your email; once you sign in it knows your account only as a random number and which plan you are on.

Before you have an account, your setup answers stay on your phone. Two things go out while you answer, so the app can find your frost dates: the ZIP or address you type, and the spot on the map it turns into. Your garden reaches our server when you make the account at the end of setup.

Signing in has no password

You type your email, we send a six-digit code, you type it back. The code is short-lived, works once, and is stored scrambled rather than as the digits themselves — so even we cannot read it back out. There is no password for you to reuse and no password of yours for us to lose.

Your Season Recap and garden emails

When you make a Season Recap on our website, what you said goes to Anthropic's model to sort it by plant. We don't keep what you said, only the sorted recap. We keep that for 90 days so you can save it to your account. If you save it, it stays with your account. If you don't, we delete it after 90 days. The card picture we store for your email is deleted after 90 days either way.

If you give us your email for your card, we keep it with your recap, along with your first name, ZIP code and what brought you here, if you gave them. Our email provider, Loops, sends your card, a short follow-up and the occasional garden email, and uses your ZIP code, if you gave one, to time frost and seed-starting emails for your area. Loops keeps your email address until you unsubscribe, and every email has an unsubscribe link.

The cover of your Season Recap is painted by an image model, ByteDance's Seedream, which we reach through a company called fal. It's sent the kinds of plants you grew, whether they grew in beds, in the ground or in pots, and which backdrop to paint. It never gets your words, your name or your email. We pick the backdrop from roughly where you are, which Cloudflare estimates from your IP address. We don't keep that location, but the backdrop stays in the painting, where anyone you share your card with can see it. People who grew the same plants the same way in the same region share one painting, so we keep a painting as long as a recap uses it. We also keep a scrambled form of your IP address with your recap, with the painting and in our usage count, to stop one person asking for hundreds. It isn't the address itself, but it could be matched back to one.

Asking to join the beta

When you ask to join the beta, we keep your email with your answers: how long you’ve gardened, what you want help with, whether you use other garden apps and which ones, and that you agreed to send us feedback. We also keep which page you asked from and, if the link you came in on carried campaign tags, those tags. We store a scrambled form of your IP address, never the address itself, so one connection can’t flood the form. If you’re signed in, the request is tied to your account.

Who else sees any of it

These companies, each doing one job:

Cloudflare — runs the site, the app and the database, and stores the photos. Everything above lives on their infrastructure.
Anthropic — the model behind the app's answers. When you ask a question or send a photo, that question and that photo go to the model to answer you. They are not used to train it.
Resend — sends the sign-in code to your inbox, so it sees your email address.
Loops — sends the Season Recap and garden emails, and holds your email address until you unsubscribe.
fal — passes a list of plant kinds and a backdrop to the image model that paints a Season Recap's cover and a garden plan's cover. No name, no email and none of your own words go to it.
ByteDance — makes that image model, Seedream, and may see the same list.
Telegram — when somebody makes an account, or writes to us through the feedback box, our server sends us a Telegram message about it. So the email address, and anything written in the feedback box, pass through Telegram.
Google Workspace — our own mailbox, so it holds any email you send us.
PostHog — our analytics tool, hosted in the United States. It sees pages opened, taps, errors and, in the app, a masked recording of your screen. No name, no email — see the counting we do below.
Ahrefs — counts visits to the website's pages, never the app's, with no cookies. It works out your country from your IP address and, by its own account, never stores the address.

Two US government services answer questions for us too, and both get them from our server, never from your phone, so they never see your IP address, your name or your email. The National Weather Service gets your garden's spot on the map, to within about 36 feet, so the app can show your forecast and warn you about frost. The US Census Bureau's address lookup gets an address or ZIP you type into the app or a frost tool, so it can be turned into a spot on the map.

Drawing your yard from the maps asks three more services, the same way: from our server, never your phone. FEMA's building outlines (kept on Esri's servers), the USDA's aerial photos and Meta's tree-height map (kept by Source Cooperative) each get a square of the map about 600 feet across, around your garden, so the app can draw your house and trees. An address you type to find your yard goes to the Census Bureau's lookup above. We keep the drawing, never the address.

That is the whole list. Nobody buys this data, nobody rents it, and it is not passed to advertisers — there are no advertisers.

The counting we do, named

Two different things happen here, and this page names both rather than folding them into one vague word.

PostHog is the analytics tool behind the site, the tools and the app. It sees pages opened, buttons tapped, and errors — and in the app, it can record your screen. Every character you type and every word on the screen is hidden before that recording is made, and your photos are blocked from it entirely — a garden name, a journal entry, a question in Ask (the in-app question feature), none of it ever reaches PostHog as text. It never gets your name or your email; once you sign in, the app tells it only a random number for your account and which plan you are on, never anything that identifies you. The app also tells PostHog which kind of thing happened — a plant added, a question asked — never the words: never a plant's name, never what you typed, never a photo. For each answer Ask (the in-app question feature) gives, PostHog gets which model answered, how long it took, and how many tokens it used — never your question and never the answer. It lives on PostHog's servers in the United States. Two things turn it off completely: a browser sending Do Not Track or Global Privacy Control never loads it at all, and it never runs anywhere but gardentrack.app — not while we are building, not in a preview. If your browser or an extension blocks it, that is respected too; nothing about the site breaks.

Separately, we also count four things ourselves, on our own server: how many people open the app, how many start setting up their garden, how many finish, and how many make an account. What a single one of those records holds is a random number, which of the four things happened, and when — nothing else, no name, no email, no location, no plants, no photos. It is invented on your device the first time you open the app and is not worked out from anything about you or your phone, which is what makes it a random number rather than a fingerprint. It stops the moment you make an account — by then every question we might ask about a signed-in gardener is answerable from their account, so the app stops sending it and it is never in the same breath as your email. It lives in our own database, and — because it travels as part of the web address our app calls — in Cloudflare's request logs, which they keep for their own operational purposes.

Why we do either. Somebody who opens GardenTrack, looks at the setup questions and leaves again is exactly the person we most need to hear from, and until the first-party count existed they were invisible to us. PostHog answers a different question — what is actually getting used, and what is breaking — that neither of us could answer by guessing. Neither is for advertising, neither is sold, and neither can be tied back to you by name.

What we do not do

We do not sell or rent anything about you, to anyone, at any price.
We do not run ad trackers, pixels or fingerprinting. We do not route PostHog around an ad-blocker's own protections — if yours blocks it, it stays blocked.
We do not send PostHog your garden's words, your journal, your chats in Talk (the in-app chat), or your photos — see above.
We do not use your garden or your photos to train models.
We do not store the street address you type in to get your frost dates or draw your yard.
We do not put your photos on a public address, ever.

Turning PostHog off

Turn on Do Not Track or Global Privacy Control in your browser and PostHog never loads for you, on the site or in the app — no setting to find on our side, no request to send us. Many ad-blockers and privacy extensions already block it, and that works too.

Getting it back, or getting rid of it

Deleting your garden is built in: Restart my garden, on your profile in the app, clears your plants, beds and journal from your device and from our copy.

Deleting your account itself, and getting a copy of your data to keep, are things you have to ask us for. There is no button for either yet, and rather than describe one that does not exist: email hello@gardentrack.app and say which you want. It is a small team and we will not pretend otherwise about how fast, but neither request is a fight. The whole picture is here.

Who on our side can see it, and what happens when they do

We have a support tool for answering "I lost my garden" without guessing. Three things about it are true and worth knowing:

It cannot change your garden. Not by policy — by construction. There is no path from that tool to your plants at all, so nobody on our side can quietly edit your records while looking into a problem.
Every look is recorded — who looked, at whose account, and when. If you ever ask us who has opened your account, that is a question with a real answer rather than a reassurance.
It sits behind a separate sign-in from any GardenTrack account, and it is not reachable from the app or this site.

The reason to open your account is a problem you have written to us about, or Talk chats you chose to share with us — see sharing your Talk chats. Beyond that, the people who build GardenTrack can reach the database, as at any service you use.

Children

GardenTrack is not built for children and we do not knowingly hold an account for anyone under 13. If one exists, tell us and it goes.

Questions, and changes to this page

Ask us anything about the above at hello@gardentrack.app. If what we hold changes, this page changes with it and the date below moves — and the interesting changes get written up in the updates log rather than quietly amended.

Last updated October 13, 2026 · Written by us, in plain language, and checked against what the code actually stores rather than what we remember building.