The Short Version
- We only collect what we need to run your account and save your garden plans.
- No ads, no analytics trackers, no selling or sharing your data with advertisers.
- You can delete your account and everything in it at any time, in one click.
Who we are
Understory (https://understory.garden) is a garden planning app run by Baobab Tree LLC ("we", "us"). We are responsible for the personal information described in this policy. Questions? Write to hello@understory.garden.
What we collect
- Account details: your email address and password when you sign up with email. Your password is stored scrambled (hashed) by our login provider, and we never see it.
- If you sign in with Google: your name, email address and profile picture link, as shared by Google. We never see your Google password.
- Your garden plans: plan names, the place or USDA zone you choose, garden type and size, the plants on your grid, their dates and varieties, and the steps you tick off in your Garden Script.
- Place searches: what you type into "Where Are You Growing?" is sent to our server to find matching towns. We don't keep it with your account; we only save the place you pick for a saved plan. We never ask for your device's GPS location.
- Technical logs: like every website, our hosting provider records basic request information (such as IP address, browser type, the page requested and the time) to keep the site running and secure. These logs are kept for a short time.
- Emails: when we send you account emails (confirming your sign-up, resetting your password), our email provider processes your address and whether the email was delivered.
Cookies and storage on your device
We use one kind of cookie: the one that keeps you logged in. It is strictly necessary for your account to work, so we don't ask for consent for it. We use no advertising or analytics cookies.
The app also saves a few things in your browser's local storage, which never leave your device unless you save a plan: the last place you picked, an unsaved draft of your grid, and plans you made before signing up (so you can bring them into your account). Clearing your browser's site data removes them.
How we use it
- To run Understory: create your account, log you in, save your plans, and show you planting dates for your place.
- To send you account emails you need, like sign-up confirmations and password resets. We won't send you marketing emails unless you ask for them.
- To keep the service secure and working, and to fix problems.
- To meet legal obligations.
We do not sell your personal information, share it for targeted advertising, or use it to train AI models.
Legal bases (for people in the EU, EEA, UK and Switzerland)
We process your information because it is needed to provide the service you signed up for (performance of a contract), because we have a legitimate interest in keeping Understory secure and working (for example, technical logs), and where the law requires it. If we ever ask for your consent for something, you can withdraw it at any time.
Who we share it with
Only with the service providers that run Understory for us, who may use it only to provide their service:
- Vercel: hosts the website.
- Supabase: stores accounts and saved plans, and handles logging in.
- Resend: delivers our emails.
- Google: only if you choose "Sign in with Google". Google's own privacy policy applies to your Google account.
We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganization of the business, in which case this policy continues to protect your information.
Where your data is processed
Understory is run from the United States, and our service providers may process your information in the United States and other countries. Where the law requires it, these transfers are covered by safeguards such as the European Commission's standard contractual clauses.
How long we keep it
We keep your account and plans for as long as you have an account. When you delete a plan or your account, it is removed from our database right away. Copies may remain in our providers' backups for a limited time until they are overwritten. Technical logs are kept only for a short time.
Your rights and choices
- Delete: use "Delete My Account" at the bottom of your plans page (Your Garden's Paper Trail). It permanently deletes your account and all your saved plans.
- Access, correct or export: email us and we'll send you a copy of your information or fix what's wrong. You can also print any plan's Garden Script.
- Object or restrict: email hello@understory.garden.
We'll answer requests within 30 days and won't treat you differently for making one. If you are in the EU, EEA, UK or Switzerland, you can also complain to your local data protection authority.
California and other US state residents: you have the right to know what personal information we hold about you, to correct it and to delete it. We do not sell or share personal information as those laws define it.
Security
All traffic to Understory is encrypted (HTTPS), passwords are stored hashed, and our database only lets each account read its own plans. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you, as the law requires.
Children
Understory is not directed at children. You must be at least 13 to create an account (or older, if your country requires it to use an online service without a parent's permission). Kids are very welcome in the garden itself, with a grown-up running the account. If you think a child has given us personal information, email us and we'll delete it.
Changes to this policy
If we change this policy, we'll post the new version here and update the date at the top. If the changes are significant, we'll also let you know by email or in the app before they take effect.
Contact
Questions or requests about your privacy: hello@understory.garden.