Draft for the invite-only pilot. The final notice will replace this text.
Privacy notice
What we keep
Your email address and first name, the photos of your garden you upload, what your gardener notes about them (areas, things and short observations) and its replies. Photos are re-encoded in your browser and again on our servers, which removes location and camera data from them.
Signing in with Google
If you continue with Google, Google tells us your email address, whether Google has verified it, and your name. We keep the address, the name and Google’s ID for your account, and nothing else: not your picture, and not the tokens Google issues, as we never call Google on your behalf. If the address is one you already sign in with by email, Google is added to that account and we email the address to say so.
How your photos are looked at
Each photo you upload is sent to OpenAI’s API, where an AI model describes what it can see. When a later photo shows something for the first time, up to three earlier photos of the same look are sent again so your gardener can mark it on them. We ask OpenAI not to store its answers. The model provider’s own retention terms for API requests will be stated here before the pilot opens.
Your garden’s place and the weather
If you choose to, you can tell us roughly where your garden is, which way it faces and its size. We keep the place only to 0.1° (about 10 km). When you use a photo’s location, your browser reads and rounds it on your device; the photo itself is still uploaded without it. We use the place to work out the sun, and send the same approximate place to Open-Meteo for the weather. It is never sent to the AI model, which gets only the resulting sun and weather facts. You can change or clear it in Garden settings.
Where it is stored
Photos are stored with Cloudflare in Western Europe, and records in a database hosted by Neon in London. Our logs never contain your photos, your email address or your gardener’s replies.
A copy, or deletion
You can delete a garden, or your whole account, yourself from Account (the round button at the top right); you sign in again first to confirm it’s you. Deleting erases your photos and everything your gardener noted, usually within minutes and always within 7 days, and backup copies expire within 30 days. We keep a record of the deletion with its reference, and nothing from your garden, for 30 days after it is complete. Records of model costs, which hold no garden content, are kept for 90 days. During the pilot, ask by email at support@thallo.garden for a copy of your data.