Privacy policy
What this site collects, why, who else sees it, and what you can make us do about it.
The short version
You can browse the entire database without an account and without being tracked. There is no analytics, no advertising and no tracking cookies, which is why there is no cookie banner. If you create an account, we store your email address and whatever you choose to save, and nothing more. Nothing is ever sold or handed to advertisers or data brokers.
This is the information notice required by Art. 13 of the General Data Protection Regulation. Art. 14 does not apply, because nothing here is obtained about you from anyone else.
Who is responsible
The controller (Art. 4(7)) is the operator of this site, whose postal details are not published. Reach them through the contact form, which goes to a private inbox only site admins can read. No data protection officer is appointed; none is required at this scale.
What is collected, and why
| What | Why | Legal basis |
|---|---|---|
| Visiting any page | Serving the page and defending against attacks and abuse | Legitimate interest Art. 6(1)(f) |
| Creating an account | Giving you an account and keeping you signed in | Contract Art. 6(1)(b) |
| Saved plants, garden records, watering log, journal, layouts, reviews | Making those features work at all | Contract Art. 6(1)(b) |
| Forum threads, comments and votes | Publishing them, shown under your username | Contract Art. 6(1)(b) |
| Reports and moderation actions | Keeping the forum usable, and Digital Services Act duties | Legitimate interest Art. 6(1)(f) |
| A message you send through the contact form | Reading it and replying, and showing that a request was handled | Legitimate interest Art. 6(1)(f) |
| Turnstile check on forms | Telling people apart from bots | Legitimate interest Art. 6(1)(f) |
| A photo you upload to identify | Sending it to Pl@ntNet for candidate matches | Contract Art. 6(1)(b) |
| A photo you submit to the gallery | Publishing it on your forum post | Contract Art. 6(1)(b) |
| A question you ask the plant assistant | Generating an answer with Cloudflare's AI model | Legitimate interest Art. 6(1)(f) |
| A postal code or place name you type | Looking up your hardiness zone or frost forecast | Contract Art. 6(1)(b) |
Three things worth knowing beyond the table. Forum posts, comments, reviews and gallery photos are public and carry your username — treat them as published. A photo posted to the gallery has its location and other embedded metadata stripped automatically before it is stored; a photo you upload for identification is sent to Pl@ntNet as-is, so strip its metadata yourself first if that matters to you. Your theme and view preferences live in your browser's local storage and never reach the server.
Who else sees it
Your browser contacts these directly, so they necessarily learn your IP address and user agent:
| Recipient | What for | What they get | Where |
|---|---|---|---|
| Cloudflare | Hosting, CDN, application runtime, database and photo storage (Workers, D1, R2), the AI-powered plant assistant (Workers AI), plus the Turnstile anti-spam check on forms | IP address, user agent, requested URL, timestamp; everything you store on the site, including gallery photos, since the database and file storage run here | EU edge locations; company established in the US |
| Clerk | Account signup, sign-in and session management (served via clerk.venlo.wiki) | Email address, username, password credentials, session cookies, IP address | US |
| Wikimedia Foundation | Plant photographs, loaded directly from Wikimedia Commons rather than copied onto this site | IP address and user agent, disclosed whenever a page with photos loads | US |
| Google (Google Fonts) | Web fonts, currently loaded from Google's servers rather than served from this domain | IP address and user agent, disclosed on every page load | US |
These are called by this site's server instead, so your IP address is never disclosed to them — only what the feature itself sends:
| Recipient | What for | What they get | Where |
|---|---|---|---|
| Pl@ntNet | Identifying a plant from a photo you upload | The photo you submit. Your IP address is not passed on | France (EU) |
| Open-Meteo | Frost and planting-weather forecasts, and turning a place name into coordinates | The location you ask about. Your IP address is not passed on | Germany (EU) |
| Zippopotam.us / phzmapi.org | Turning a postal code into a hardiness zone | The postal code you type. Your IP address is not passed on | US |
| GBIF | Native and introduced range data for the range map | Species names only — no visitor data of any kind | Denmark (EU) |
| Brave Search API | Finding nursery listings for the "where to find it" sections, on a scheduled job | Species names only — no visitor data of any kind, and it does not run in response to your visit | US |
Some of these are US companies. Those transfers rest on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Ask if you want the detail for a particular one.
Cookies and storage
Only what the site cannot work without: a Clerk session cookie once you sign in, a Turnstile token when you submit a form, your display preferences in local storage, and a service-worker cache of pages you have already visited. All strictly necessary, so consent-exempt under § 25 Abs. 2 TDDDG. No advertising or analytics cookies exist here.
How long it is kept
Account data lasts until you delete your account, and everything attached to it is deleted with it — saved plants, garden records, journal entries, layouts and notification subscriptions all cascade away. Posts and reviews stay until you delete them or the account, since removing one side of a conversation makes the rest unreadable. Moderation reports are kept while needed for repeat problems. A photo uploaded for identification is not retained after the request completes; a photo posted to the gallery is kept until you delete that post or your account, or it is removed in moderation. Server logs follow Cloudflare's own retention, which is short and set by them.
Your rights
You can require access to what is held about you (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and you can object to anything resting on legitimate interest (Art. 21) — that is the server logs, spam protection and moderation records. Where processing rests on consent you can withdraw it at any time, without affecting what was lawful beforehand.
All of this is free and needs no particular form — just ask through the contact form. Deleting your account is the quickest route to erasure, and the contact form will do it for you if you would rather ask. You can also complain to a supervisory authority (Art. 77), in the country where you live or work or where you think something went wrong; the German state authorities are listed by the BfDI.
Anything else
No automated decision-making or profiling with legal or similarly significant effects takes place (Art. 22) — plant identification returns suggestions for you to judge, and decides nothing about you. Providing any of this is entirely optional: browsing needs no account, and the only consequence of withholding an email address is that you cannot have one. The site is not aimed at children and does not knowingly hold data about anyone under 16. This policy will change as the site does, and the date below always reflects the current version.
Last updated 12 August 2026