Privacy Policy

Effective 24 October 2026

This policy explains how Garden Sage ("we", "us", or "our") handles information when you use the Garden Sage iOS app and related services. Garden Sage does not sell personal information and does not use your data for cross-app tracking or third-party advertising.

Information we collect

• Account information: your account identifier and email address when supplied through Sign in with Apple, Sign in with Google, or email sign-in. If you choose Google, its sign-in SDK may process Google profile and contact information, account and device identifiers, approximate location, and sign-in usage information for authentication, fraud prevention, and service analytics. Garden Sage verifies the identity token and retains your Google account identifier and email address. We do not request access to Gmail, Google Drive, or your contacts. For email sign-in, we store a salted, one-way password hash rather than the password you enter.
• Garden content: uploaded plant photos, plant and garden records, notes, care history, chat messages and replies, and the identification or care results associated with them.
• Location and weather context: a coarse location when you choose to share it, including optional country, US state, and USDA hardiness zone selections, plus derived local weather and seasonal context. We use location and weather context for plant-care personalisation; optional structured profile selections also support privacy-bounded aggregate analytics. Structured profile geography is selected by you and is not inferred from your free-text growing region, IP address, or precise location.
• Subscription information: App Store product and transaction identifiers, subscription status, eligibility, and renewal or expiry dates. Apple processes your payment details; Garden Sage does not receive your full payment-card information. We use subscription and checkout outcomes to measure how people move from free access to Premium and improve the upgrade experience.
• Service and diagnostic information: product interactions, app version and build, request timing, error, security, and performance records needed to operate, protect, analyse, and troubleshoot the service.
• Acquisition information: if you use a Garden Sage invitation or campaign code, the app may keep that unapplied code on your device for up to 30 days so it survives sign-in or restart, and removes it sooner after application, terminal rejection, confirmed account deletion, or credential revocation. When a valid code is accepted, we link your account to its keyed one-way digest, short support hint, and controlled source, campaign, partner, page, and broad campaign-region fields. We do not retain the raw referral URL or unrestricted UTM text, and we do not use the code for cross-app tracking.
• Optional discovery and research information: you may select how you first found Garden Sage and enter the exact words you remember searching. Those search words stay with your account and are excluded from product-analytics events. Separately, you may explicitly allow us to email your account address about an optional user-research conversation. This permission is versioned and timestamped, is never inferred from your account or acquisition answer, does not subscribe you to marketing, and can be revoked in Account settings.
• Website contact information: if you previously joined a waitlist or contact us, we process the name, email address, request type, and message you choose to provide.

Education offers: when you request an education invitation, we record confirmation that you are an eligible US adult, an internal verification reference, the offer assigned to your Garden Sage account, its expiry and redemption status, and the related App Store transaction. We use these records to provide the offer and prevent it from being claimed by another account. We do not put school documents or redeemable offer codes in the app database. These account-linked records remain until you delete your account; deletion removes the account link and verification details, while a minimal offer reference, product and status remain to prevent reuse.

Acquisition measurement runs in the background by default. A random identifier stored with the app lets Garden Sage measure its first observed opening, sign-in and signup steps and their outcomes, and return visits. After sign-in, these records can be linked to your account to understand which campaigns lead to signup and useful app activity. We record controlled categories and app version and build, not passwords, email addresses, photo content, or free-text error messages in these events. The app may also obtain a short-lived Apple attribution token; our server asks Apple whether a Garden Sage ad led to the download and retains the returned campaign identifiers, country, and download type. Raw Apple tokens are not stored. We do not collect IDFA or use this information for cross-app tracking.

You can turn off Acquisition measurement in Account settings. Existing explicit opt-outs are respected. Turning it off stops new acquisition measurement and requests removal of its installation and campaign details; it does not disable the service and product analytics described elsewhere in this policy. Unlinked installation records are scheduled for deletion within 30 days, and account-linked records within 400 days or earlier when you delete your account. Minimal one-way withdrawal markers and Apple token digests may remain for up to 400 days to prevent delayed requests from restoring withdrawn data. Pending installation events stay on the device for at most 7 days, and pending removal requests for at most 30 days.

How we use information

We use this information to:

• authenticate your account and keep your garden available across sessions;
• identify plants, assess visible plant-health concerns, and provide care guidance;
• personalise results using your garden, location, season, weather, and care history;
• save plants and observations you choose to keep;
• understand which first-party invitations and campaigns lead to useful Garden Sage accounts, and improve those experiences;
• understand optional, self-reported discovery patterns in aggregate and, only with separate current permission, invite you to voluntary user research;
• verify subscription access, restore purchases, and prevent duplicate or fraudulent entitlement claims; and
• respond to support or privacy requests and maintain security, reliability, and legal compliance.

Photo, machine-learning and computer-vision processing

Photos, questions and the garden context needed for a request are sent to Garden Sage's secured backend. Depending on the request and current service configuration, PlantNet-based identification systems, Hugging Face inference services, OpenAI, or Google Gemini may process that content to identify plants, explain visible features or answer garden questions. Chat shares your messages, a bounded recent conversation, relevant records for the plant you select and a selected photo only when you choose to include it. Before the first upload or chat message, the app asks for your explicit permission for this processing. You can revoke that permission in Account › Privacy; the next request will ask again before sharing. Revocation stops future sharing but does not undo processing already completed.

Results are informational, may be uncertain, and are not professional agricultural, toxicology, veterinary, or medical advice.

When information is shared

We share information only as needed with:

• hosting, storage, model-processing, monitoring, and support providers acting on our behalf;
• Apple for sign-in, App Store subscriptions, purchase restoration, and related platform services;
• authorities or other parties when reasonably necessary to comply with law, protect users, prevent abuse, or defend legal rights; and
• a successor if Garden Sage is involved in a merger, acquisition, financing, or sale, subject to this policy and applicable law.

When personal information is shared under this section, we require it to be used only for the stated purpose and protected to the same or an equivalent standard, except where disclosure is required by law.

Private garden clubs

When you join a club using an invitation, its organisers can see your display name and club role. Club members can see the posts, plant labels, photos and replies you choose to share after organiser approval; organisers can also review pending contributions and reports. Joining does not share your private garden records, location or AI conversations. Uploaded club photos are re-encoded without photo location metadata.

You can report a conversation, block a gardener or leave the club in the app. Organisers can remove contributions and revoke club access. Posts stay in the club after you leave unless you delete them beforehand; deleting your Garden Sage account removes your authored club content. Members may retain content they already copied. Saving advice explicitly copies it, with its author and club named, to your private plant notes. Club conversations and these copied suggestions are not automatically sent to AI providers or added to the botanical knowledge base.

Optional website analytics

We use Google Analytics only if you choose Allow analytics. Until then, and if you choose Continue without analytics, we do not load Google Analytics, send it website data, or set its cookies. Both choices let you use the whole website. You can change your choice through Analytics preferences in the footer.

With your permission, Google processes page visits, basic visit and device information, approximate geography, and which of our four App Store links you choose. Analytics cookies use a random browser identifier to recognise visits; we do not send an account identifier or join website visits to your app account. Google receives your IP address when handling these requests and can derive your country. We disable its granular location and device collection, including city and device model. Google processes technical request information under its privacy policies.

We send only the page's public canonical address and a controlled App Store link category. We exclude URL queries and fragments, full referrers, invitation codes, search terms, and form or message contents. Invitation pages do not load analytics. Google signals, advertising personalisation, advertising storage and enhanced measurement are disabled. These reports describe people who opt in; they do not measure all visitors or prove an App Store download.

Your choice is stored in this browser for up to 180 days. Analytics cookies last up to 90 days without extending their original expiry on each visit. Withdrawing permission stops new measurement, removes these analytics cookies and reloads the page. It cannot recall requests already sent or erase reports already received by Google. Clearing browser storage also resets your choice. See Google's privacy policy and Google Analytics regional privacy controls for details about its processing.

Website delivery

Garden Sage's hosting and network providers may process limited technical request information needed to deliver and secure gardensage.co. Garden Sage does not use website information for cross-app tracking or third-party advertising.

Separately from optional browser analytics, to understand search discovery and App Store interest, our web server may keep a redacted request record containing only the time, response status, request-method category, one controlled page or App Store-link category, one approved referral or campaign-source category, a claimed crawler category, one finite interaction category, and one coarse App Store-link origin category. The last two are reduced from standard browser request hints, an exact QR-link value, or a short first-party page allowlist. Before that record is written, the full request is removed, including the IP address, query string, headers, cookies, full referrer, and any unknown page or source text. Browser hints and claimed User-Agents can be absent or spoofed; they are not proof of a person, crawler identity, indexing, citation, or a completed App Store visit.

In normal operation, these redacted request-level records are kept for no more than four daily windows. A prolonged web-server or host outage can delay rotation until service resumes. Daily category counts contain no visitor identifier and are scheduled for deletion after 400 days. We cannot join a website visit to a later App Store action; Apple's privacy-protected aggregate reporting is separate.

Retention and account deletion

We keep account and garden information while your account is active and only as long as needed for the purposes above. You can delete your account by opening Account in the app and tapping Delete Account in the Privacy section. This removes the account and associated garden records from the active service. Stored media is queued for secure deletion and may take a short time to be removed.

Deleted information may remain temporarily in protected rotating backups or limited records retained for security, fraud prevention, accounting, or legal obligations. Those records are not used to continue providing a deleted account.

Privacy-bounded product analytics and accepted acquisition records are scheduled for deletion within 400 days and are removed earlier when the linked account is deleted. An acquisition-code definition contains no raw code or contact details and is deleted after its expiry is more than 400 days old once no retained account record references it. Clearing optional structured geography stops its active-profile use but does not rewrite earlier immutable analytics snapshots; those follow the same 400-day limit and account-deletion rule. Garden Sage does not use this information for cross-app tracking.

An optional discovery answer and its exact search words remain account data until you clear them or delete the account. Product analytics retain only the selected discovery category, whether search words were supplied, and categorical grant, revoke, or clear revisions—never the search words themselves. Research-contact permission and its latest grant timestamp remain account data until you revoke it, delete the account, or the permission expires after 400 days. Revocation removes the account from current research eligibility immediately. Grant or revocation timestamps and the notice version are cleared once their relevant timestamp is more than 400 days old. Non-content discovery and consent revision counters may remain with the account solely to prevent old updates from being replayed; categorical consent events follow the same 400-day analytics limit and account-deletion rule.

Readable product-analytics events waiting for delivery remain on your device until they are accepted, your account data is cleared, or delivery resumes after the server's seven-day past-event window has expired. The app does not infer expiry from your device clock. When the server confirms that a queued event is too old, the app removes that event and its retry metadata; it does not discard potentially deliverable events merely to make room.

If an on-device analytics queue becomes unreadable, the app may keep one exact recovery snapshot for each affected queue store for up to 30 days. Garden Sage never semantically parses or transmits that snapshot, and the app removes it sooner after confirmed account deletion or credential revocation.

Professional outreach

Garden Sage is responsible for the professional outreach records described here. You can contact us at hi@gardensage.co.

We may research a public professional contact route to make a specific enquiry relevant to that person's work or an organisation's activities. Our records may include the professional name, role, organisation, published contact details, source page, reason for relevance, and any correspondence or objection. The first message identifies the public source used. A published address does not by itself establish permission to send marketing, and we assess the applicable contact rules before use.

Where personal data is involved, we assess our legitimate interest in discussing a relevant professional collaboration against the necessity of the contact and the recipient's reasonable expectations and rights. We use consent where it is required. We do not enrol a professional contact in a newsletter or use tracking pixels. We do not make automated decisions that produce legal or similarly significant effects about a professional contact.

We keep these records in working files with access limited to Garden Sage's authorised work and the workspace services needed to support it. For a message, the authorised email service also processes the details needed to deliver it and handle replies. We do not sell outreach lists. Before connecting an email service, we review its handling of the data, including any processing outside the European Economic Area, and the applicable transfer arrangements. You can request details relevant to your record or message from the contact address above.

We retain outreach records only while assessing or pursuing a relevant professional enquiry or relationship. We review whether they are still needed when an enquiry closes or the reason for contact no longer applies, and remove records that are no longer relevant. A minimal suppression record is kept for as long as needed to respect an objection and prevent renewed contact. Records needed for a specific legal obligation or dispute are limited to that purpose.

You may object to direct marketing at any time, without giving a reason. Reply STOP, say no thanks, or email hi@gardensage.co. We stop marketing contact and record the objection; we do not switch addresses to bypass it. You can also request access, correction, erasure or restriction of your personal data, as applicable. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. You may complain to the Irish Data Protection Commission or another competent supervisory authority. No reply, account or purchase is required.

Your choices

• You can decline or revoke location and photo-library access in iOS Settings.
• You can clear optional country, state, and USDA-zone profile selections in Account.
• You can edit or clear your optional discovery answer and separately grant or revoke user-research contact permission in Account.
• You can choose which photos to submit and which results to save.
• You can revoke machine-learning and computer-vision photo-processing permission in Account › Privacy; Garden Sage will ask again before a future upload.
• You can manage or cancel a subscription in your Apple Account settings.
• You can request account deletion directly in the app.

Security and international processing

We use technical and organisational safeguards designed to protect your information. No service can guarantee absolute security. Information may be processed in countries other than your own by providers supporting Garden Sage, subject to appropriate contractual and legal safeguards.

Children

Garden Sage is not directed to children under 13, or the higher minimum age required in their country. We do not knowingly collect personal information from children below that age.

Changes to this policy

We may update this policy as Garden Sage evolves. We will publish the revised policy at this URL and update the effective date. Material changes will be highlighted in the app or through another appropriate notice.

Contact

For privacy questions or requests, email hi@gardensage.co or visit Garden Sage Support.

Garden Sage gives practical gardening guidance, but plant identification and health suggestions can be wrong. If a plant may be toxic or poses a risk to people or animals, contact an appropriate qualified professional.