Privacy Policy

1. Who we are

Gardnz is a garden planning application published by Simple Digital Solution LLC ("we", "us", "our"), an Aerion Health project. Gardnz helps home growers plan planting dates for their hardiness zone, lay out beds, track plantings, and log harvests.

This policy covers the Gardnz mobile app, the Gardnz API that backs it, and this website at gardnzapp.com.

2. What we collect

Gardnz collects the information you enter to build your garden, plus the minimum needed to keep you signed in and to keep the service running. Nothing below is optional trivia — each item is stored because a feature uses it.

Account information

• Email address. Required. It is your account identifier and is stored in lowercase.
• Display name. Optional, only if you supply one when registering or if your Apple/Google sign-in provides one.
• Sign-in method. Whether you registered with an email and password, with Apple, or with Google.
• Password. If you register with a password, we store only a bcrypt hash of it. We never store or log the password itself.
• Session tokens. Access and refresh tokens are stored on our servers only as SHA-256 hashes, with their expiry and revocation times. The tokens themselves live on your device.

Garden and location information

• Garden coordinates. If you grant location permission during setup, the latitude and longitude reported by your device are saved with your garden. They are used to determine your USDA hardiness zone and to fetch local weather. Location is optional — you can skip it and set your zone by hand instead.
• Garden details. Garden name, time zone, unit preference (imperial or metric), hardiness zone, whether that zone was auto-resolved or set manually, and when you confirmed it.
• Beds. Bed name, type (raised, in-ground, container), shape, width, length, depth, sun exposure, and display order.

Planting and harvest information

• Plantings. Which plant you chose from our catalog, planting date, expected harvest date, status, quantity, how the planting was created, and any notes you write.
• Growth stage events. Stage changes recorded against a planting and when they occurred.
• Harvest logs. Harvest date, quantity, unit, an optional 1–5 quality rating, and any notes you write.

Technical information

• API request logs. Our server writes an operational log line for each request containing the HTTP method, path, response status, response time, and a randomly generated request identifier. Our hosting providers additionally keep their own standard infrastructure and network logs.

Stored on your device only

• Your signed-in session (email and tokens).
• Your onboarding answers — growing goals, rough garden dimensions, and sun exposure — which stay in local app storage.
• Watering and harvest reminders, which are scheduled locally by the operating system.

3. What we do not collect

To be explicit, the current release of Gardnz does not collect any of the following:

• No analytics, telemetry, attribution, or crash-reporting SDKs are bundled in the app.
• No advertising identifiers, and no advertising or cross-app tracking of any kind.
• No photos. The app does not capture, upload, or store images.
• No contacts, calendars, microphone, health, or fitness data.
• No payment or billing information. Gardnz does not process payments in the app.
• No push notification tokens — reminders are scheduled entirely on your device.
• No personal information is sent to third-party AI providers. Planting guidance is produced from our own plant catalog, your growing zone, and public weather data.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. Device permissions

Gardnz asks for a permission only when a feature needs it, and the app remains usable if you decline.

• Location (while using the app). Used to resolve your USDA hardiness zone and to request a local forecast. Requested during onboarding and on the weather screen. If you decline, you can still use Gardnz and set your zone manually under Settings.
• Notifications. Used only to schedule local watering and harvest reminders on your device. We do not receive a push token and cannot send messages to your device from our servers.
• Camera. The app package declares camera access for garden photo capture. The current release does not take, upload, or store any photos. If we ship that feature, we will update this policy before it collects anything.

You can change or revoke any of these permissions at any time in your device settings.

5. Location and weather

Weather is the one feature that sends your coordinates outside our own systems, so here is exactly how it works.

• When the app needs a forecast, it sends latitude and longitude to a weather proxy we operate on Cloudflare Workers. The request carries no account identifier, no email, and no authentication token.
• The proxy rounds your coordinates to two decimal places — roughly a one-kilometre area — and uses that rounded value as a cache key.
• On a cache miss, the proxy requests the forecast from Open-Meteo, a public weather API, using those rounded coordinates.
• Cached forecasts contain weather data only — no user data — and expire on a short timer (30 minutes by default).
• If the proxy is unreachable, the app falls back to requesting the forecast directly from Open-Meteo.

6. How we use your information

• To create and authenticate your account and keep you signed in.
• To determine your hardiness zone and frost windows from your garden location.
• To show local weather and generate planting, watering, and harvest guidance.
• To save and display your gardens, beds, plantings, and harvest history.
• To operate, debug, and secure the service, including rate limiting and abuse prevention.
• To respond to support and privacy requests you send us.
• To comply with legal obligations.

7. Sharing and service providers

We do not sell your information or share it with advertisers. We use a small number of providers that process data on our behalf so the service can run:

• Microsoft Azure — hosts the Gardnz API.
• A managed PostgreSQL database — stores your account, gardens, plantings, and harvest logs, reached over an encrypted connection.
• Cloudflare — runs our weather proxy and its short-lived forecast cache.
• Open-Meteo — supplies forecasts in response to rounded coordinates.
• Apple and Google — only if you choose to sign in with them. Apple identity tokens are verified against Apple's published public keys; Google tokens are verified with Google's token information endpoint. We receive your email address (and name, if provided) from that sign-in.
• GoDaddy — hosts this website.

We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of our users.

8. Retention and deletion

We keep your account and garden data for as long as your account exists. You can delete it yourself at any time, from inside the app.

Deleting your account immediately and permanently removes your user record and everything linked to it: your email address and display name, your password credential, all access and refresh tokens, your gardens and their coordinates, your beds, your plantings and stage events, and your harvest logs. This cannot be undone and we cannot restore it.

Two things persist briefly and independently of your account: operational request logs, which contain no garden content and are retained for a limited period by our hosting providers, and the anonymous weather cache, which is keyed by rounded coordinates and expires on its own within about 30 minutes.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing.

• Delete: available in the app under Settings → Privacy & data, or by email.
• Correct: garden, bed, planting, and harvest details can be edited in the app.
• Access or export: email us and we will provide a copy of the data associated with your account.

We respond to verified requests within 30 days. Exercising these rights will never cost you anything or degrade your use of Gardnz.

10. Children

Gardnz is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

11. Security

• All app-to-server traffic uses HTTPS, and the database connection is encrypted with certificate verification in production.
• Passwords are hashed with bcrypt. Session tokens are stored server-side only as SHA-256 hashes.
• Access tokens are short-lived (15 minutes) and refresh tokens rotate on use, so a stolen token has a narrow window.
• Authentication endpoints are rate limited to slow credential guessing.
• Every garden request is scoped to the signed-in account, so one user cannot read another user's garden.

No system is perfectly secure, but we design for the smallest useful amount of data and the shortest useful retention.

12. Changes to this policy

We may update this policy as Gardnz changes. When we do, we will revise the "last updated" date above, and for material changes we will provide additional notice in the app or by email. If a future release starts collecting something new, this page will say so before that release ships.

13. Contact us

For any privacy question, data request, or account deletion request:

Simple Digital Solution LLC
Email: admin [at] simpledigitalsolution.com