Privacy

This site has no advertising trackers, no analytics, and passes nothing to anyone for commercial purposes. There is no cookie banner because there is nothing to make you accept.

The only data kept is what you enter to manage your own plant collection.

Your account: email address, name if you give one, a hash of your password — never the password itself —, a Google identifier if you sign in that way, chosen language, dates of creation and confirmation.

Your plants: the name you give them, the species, any description you add, the photos you upload, the watering rhythm and the watering history.

Your problem reports: your message, the severity you picked, the page involved, your browser, your screen size and your language.

To work offline, the app keeps a copy of its pages and files in your browser's memory. That copy holds no personal data, and clearing the site's data erases it.

The account and the plants are needed for the service you ask for: keeping your collection and reminding you to water. Without an account, nothing is kept.

Reports are kept to fix the problems people run into, which is the legitimate interest of keeping the site working.

Your account and your plants are kept as long as the account exists, and erased when it is deleted.

An address-confirmation link lasts twenty-four hours, a password-reset link one hour. After that they are unusable and deleted.

A session lasts thirty days, or until you sign out.

Reports are kept as long as they help fix the problem described.

Nobody. No data is sold, rented, or passed to third parties for commercial purposes.

Three providers are involved technically: o2switch, in France, which hosts the database and the photos and sends the emails; Netlify, in the United States, which serves the pages; and Google, if and only if you choose to sign in with a Google account — Google then passes us your address, your name and your identifier.

As Netlify is a US company, serving the pages involves a transfer outside the European Union. Those pages contain no personal data: your plants never pass through them, they are requested straight from the French server.

Three cookies, not one more. The session one keeps you signed in for thirty days; it is out of reach of JavaScript and only travels over HTTPS. A temporary ten-minute cookie protects the Google sign-in against request forgery. The last one remembers the language you chose.

These three cookies are strictly necessary to the operation or are a display preference: the rules exempt them from consent, which is why no banner is forced on you.

The browser's local storage keeps the offline copy described above.

You can ask to see the data about you, to correct it, to erase it, to receive a copy, or to object to its processing.

Write to the address below: your request will be handled within one month. Deleting an account erases the account and the plants stored under it.

If the answer does not satisfy you, you can refer the matter to the French data-protection authority (CNIL), 3 place de Fontenoy, 75007 Paris.

Everything travels over end-to-end HTTPS. Passwords are kept as a hash, never in the clear. The database is reachable only from the server that uses it, never from the internet.

No system is perfectly safe. If you find a flaw, please write to us rather than publish it.