Privacy

This page explains what data Family Greenhouse collects, why, and what you can do about it. We’ve deliberately written it as plain text rather than a template — if anything is unclear, email hello@familygreenhouse.net and we’ll fix the wording.

What we collect

To run the app, we collect:

• Account info — email, password (hashed), and display name. Your password is only ever held by AWS Cognito. Your email and display name are stored in Cognito and also copied onto your membership record in our database, so the app can show who is in a household and reach you about it.
• Plant + task data — every plant, task, and completion you record, along with photos you upload. Stored in AWS DynamoDB and S3 in a US region (us-east-1).
• Optional household location — only if you set one. Used to fetch local weather for climate-aware care tips. We store the city name and the geocoded coordinates we got back from the geocoder; we do not request precise device geolocation.
• Optional phone number — only if you opt in to SMS reminders, and only after you verify it. Turning SMS reminders back off stops the messages but keeps the number on file; clear the field in notification settings to remove it.
• Notification credentials — a browser push subscription or native-device notification token only when you explicitly enable a supported notification channel. These credentials identify an app installation for delivery; they are not used for advertising or cross-app tracking.
• Care-assistant conversations — the prompts you send, the assistant responses, and any plant/task context needed to answer. Conversation rows expire after 30 days. If you report a response, we retain the flagged response, your selected reason, and optional details for up to 90 days so we can investigate it.

To understand service reliability and feature use, we also collect:

• A small set of typed lifecycle events: signup, household created, plant added, task completed, etc. Your verified session supplies a pseudonymous account and household UUID server-side; the event body cannot supply identity. We do not capture page views, autocapture clicks, or session recordings. The full event list is in our repo at docs/analytics.md.
• Sanitized browser error summaries and LCP, CLS, and INP performance measurements with an anonymous session UUID, normalized route, and release id. These go to our own API, not to a vendor. On this rail we do not send stack traces, query strings, account ids, email, phone, tokens, or plant and household names — the error name and message are both restricted to a fixed list of values, so free text cannot ride along.

Browsers that send DNT: 1 have analytics suppressed automatically.

Who else sees your data

The third parties involved in running the service:

• AWS — hosts our database, file storage, authentication, email, SMS, and serverless functions. Bound by their Data Privacy commitments.
• Amazon Bedrock (only when you use the care assistant or plant health analysis) — processes your prompt and the relevant plant-care context to generate a response. We use Bedrock through our AWS account; reported responses are reviewed by us, not sent back to the model as training data by Family Greenhouse.
• Stripe (only if your household buys or manages a paid plan) — runs checkout, the billing portal, plan changes, and cancellations. Stripe receives your email address and your household’s opaque id so it can create and match the customer record. We never see or store a card number. On your household’s billing record we store the Stripe customer and subscription ids, the plan, its status, and the current period end.
• Plant.id (optional, only if you use plant identification) — receives the plant photo you upload for identification.
• Perenual (optional, only when species enrichment is enabled) — receives only species names (a public botanical fact, not your data).
• OpenWeatherMap (optional, only when you set a household location) — receives your saved city name and the coordinates we got back from geocoding.
• PostHog (optional, when analytics is enabled) — receives the events listed above with your pseudonymous account and household ids.
• Push delivery services (only if you turn on push notifications) — a browser or device push notification is handed to whichever service your browser or phone nominates, such as Google, Apple, Mozilla, or Microsoft. They deliver the message to your device.
• Sentry (optional error monitoring, and switched off on this service today) — the app and the API can each be configured with a Sentry key. When one is set, crash reports go to Sentry, and unlike the measurements described above those reports do include stack traces and browsing breadcrumbs. No Sentry key is configured on the hosted service, so no crash data is sent to Sentry today.
• Google Tag Manager (optional, and switched off on this service today) — the app can be configured with a Tag Manager container id. When one is set, signing in loads Google Tag Manager from googletagmanager.com and the same lifecycle events, your pseudonymous account id, and your household id are pushed to it; Tag Manager then forwards them to whatever destinations that container is configured for, and can collect further data of its own once loaded. No container id is configured on the hosted service, so nothing is sent to Google today.

We do not sell your data. We do not run ad networks. Except for a sitter link you deliberately create, we do not share your plant care data with anyone outside the household members you’ve invited.

Household sharing

When you join a household (yours or someone else’s), the other members can see the plants, tasks, completions, and activity in that household. They can see your display name and which tasks you’ve completed. They cannot see your email, phone number, or notification preferences.

Sitter links

A household member can create a temporary sitter link without creating an account for the sitter. Anyone who has that link can see due care tasks, plant names, each plant’s current space, and its short placement note, and can mark those tasks complete during the coverage window you selected. Sitter links do not expose your saved household location, plant or task private notes, or household member identity and contact details. The link is a bearer credential, so only send it to someone you trust. It expires after at most 90 days and a household member can revoke it sooner. We do not ask for or store the sitter’s identity.

Your rights

• Export. From Settings → Account → Download my data you can take a CSV of the plants and tasks in your current household, or a full JSON export covering every household you belong to plus your account details and notification settings. Photos and the completion history are not part of either file today.
• Delete. The Delete account button in Settings wipes your login and notification credentials and removes you from every household you’re a member of. It is also available from the setup screen before you create or join a household. If you are the only admin of a household that still has other members, deletion is refused until you promote someone else, so the household is not left without an admin. Shared care facts such as a past completion may remain useful to other members, but your name and account id on those records are replaced with “Former member.” See our account-deletion instructions for the web request path.
• Access / correction. Email support@familygreenhouse.net and we’ll respond within 30 days. We’re a small team; this is the same person you’d talk to about any other support issue.

Children

The service is not intended for users under 13. We don’t knowingly collect data from anyone in that age range. If you’re a parent and you think your child created an account, email support@familygreenhouse.net and we’ll delete the account.

Changes

When we update this policy, we’ll bump the effective date at the top and (for material changes) show a one-time banner in the app. The full revision history lives in our repo.