Privacy

This page explains what data Family Greenhouse collects, why, and what you can do about it. We’ve deliberately written it as plain text rather than a template — if anything is unclear, email hello@familygreenhouse.net and we’ll fix the wording.

What we collect

To run the app, we collect:

• Account info — email, password (hashed), and display name. Your password is only ever held by AWS Cognito. Your email and display name are stored in Cognito and also copied onto your membership record in our database, so the app can show who is in a household and reach you about it.
• Plant + task data — every plant, task, and completion you record, along with photos you upload. Stored in AWS DynamoDB and S3 in a US region (us-east-1). Photos are resized, and their location and other camera details are removed, on your device before they are uploaded. In the iPhone and Android apps the camera and your photo library are opened only when you tap to add a photo, and only the one photo you pick is used.
• Optional household location — only if you set one. Used to fetch local weather for climate-aware care tips. We store the city name and the geocoded coordinates we got back from the geocoder; we do not request precise device geolocation.
• Optional phone number — only if you opt in to SMS reminders, and only after you verify it. Turning SMS reminders back off stops the messages but keeps the number on file; clear the field in notification settings to remove it.
• Notification credentials — a browser push subscription, or in the iPhone and Android apps a push token (a device identifier Apple or Google issues to the app on your phone), only when you explicitly turn notifications on. We use it only to deliver Family Greenhouse notifications to that browser or phone: never for advertising, analytics or cross-app tracking. It is deleted when you turn notifications off there, when you sign out on that phone, when you leave the household it was set up under, and with your account.
• Care-assistant conversations — the prompts you send, the assistant responses, and any plant/task context needed to answer. Conversation rows expire after 30 days. If you report a response, we retain the flagged response, your selected reason, and optional details for up to 90 days so we can investigate it.
• Caretaker seat details — only if your household hands a helper a caretaker seat. We store the name your household types for them, which is the attribution shown on everything that seat does, and the notes and photos they add. Each seat runs for a window you choose, at most 180 days, and its credential is deleted a few days after the window ends; the dated visit records it produced stay with the household so it can see what was done.
• Household audit log — a record, visible only to the household’s admins, of changes to the household itself: members joining, leaving, being removed or changing role; invitations; sitter links, wall display links, caretaker seats, plant tags and cutting links being created or turned off; API keys (their last four characters and permissions, never the key); plan changes and failed or recovered payments as Stripe reports them; and restores and deletions from the trash. Each entry says when it happened and who did it, shown by display name. The stored entry holds a code derived from the member’s account id rather than the id itself, so once someone leaves or deletes their account they appear only as a former member. Entries never hold a link, code or key, an email address, card details or plant notes, and are deleted after 30 days.

To understand service reliability and feature use, we also collect:

• A small set of typed product events — sign-up started and completed, household created, plant added, task completed, a plan limit reached, the billing screen opened, checkout started, and the like. Each carries only fixed-vocabulary properties (a plan name, a count bucket, a route family), never anything you typed. Your verified session supplies a pseudonymous account id and household id server-side; the event body cannot supply identity. These events include no general page views, clicks, keystrokes, form contents, or session recordings — their one page-level event is opening the billing screen; page views on the website are counted separately, by Google Analytics, as described next. The full event list is in our repo at docs/analytics.md.
• Sanitized browser error summaries and LCP, CLS, and INP performance measurements with an anonymous session UUID, normalized route, and release id. These go to our own API, not to a vendor. On this rail we do not send stack traces, query strings, account ids, email, phone, tokens, or plant and household names — the error name and message are both restricted to a fixed list of values, so free text cannot ride along.
• Website analytics (Google Analytics 4) — only on this website in a browser, never in the iOS or Android app. Each page you open is recorded as a page view: its address, with sharing-link codes, invite codes and record ids replaced by placeholders and every query parameter removed except campaign tags (utm_*); its title, or a generic one for any page whose address carried an id; and the site that sent you, reduced to its domain. Google Analytics adds what it collects on every visit: browser, device type, screen size, language, and an approximate location (country, region and city) that Google derives from your IP address — Google states that Google Analytics 4 does not log or store the IP address itself. Where its automatic measurement is on, it may also note when you scroll to the end of a page, follow a link to another site, download a file, or start or submit a form — never what you type. It also records four steps toward a paid plan: a click on the sign-up button or the “See how it works” link on the home page, an account being created, a new household starting its free trial, and a paid plan being bought. The purchase carries the plan, how often it is billed, its price in US dollars, and an order number made by hashing the payment reference, so no Stripe identifier reaches Google. None of this is linked to your Family Greenhouse account: we never send Google your account id, email, name, household, or anything you type. To tell visits apart it sets two cookies on familygreenhouse.net, _ga and _ga_L2JN3PQ75P, which hold a random identifier and the current session; each lasts up to two years after your latest visit. For visitors in the European Economic Area, the United Kingdom and Switzerland we tell Google Analytics not to set or read those cookies, and it sends the same page views without them.

You can switch this off. On the website, Opt out of analytics at the bottom of the home page and of the site’s public pages turns it off in that browser, with or without an account; in the app, Settings → Preferences → Product analytics is the same switch, in the browser and in the iOS app alike. Either way the choice is remembered on that device until you choose Opt back in. In a browser you can also send the Global Privacy Control signal (Sec-GPC: 1) or Do Not Track (DNT: 1). Any of these stops every product event — none is sent to PostHog or to us, and nothing is queued or stored for later — and keeps Google Analytics off: with any of them on, the website does not load it at all, and switching off mid-visit stops it sending anything further and deletes its cookies. We treat Global Privacy Control as a valid opt-out request under California privacy law. The two signals are browser features the iOS app cannot send, which is why the switch exists; the apps never load Google Analytics in any case. Google also publishes a Google Analytics Opt-out Browser Add-on. Do Not Track also switches off the error and performance measurements above; the other controls leave those on, because they identify no one.

Who else sees your data

The third parties involved in running the service:

• AWS — hosts our database, file storage, authentication, email, SMS, and serverless functions. Bound by their Data Privacy commitments.
• Amazon Bedrock (only when you use the care assistant or plant health analysis) — processes your prompt and the relevant plant-care context to generate a response. We use Bedrock through our AWS account; reported responses are reviewed by us, not sent back to the model as training data by Family Greenhouse.
• Stripe (only if your household buys or manages a paid plan) — runs checkout, the billing portal, plan changes, and cancellations. Stripe receives your email address and your household’s opaque id so it can create and match the customer record. We never see or store a card number. On your household’s billing record we store the Stripe customer and subscription ids, the plan, its status, the current period end, whether a cancellation is already scheduled for the end of that period, any tier the household bought outright with a one-time payment, and the date the household first used a free trial.
• Plant.id (optional, only if you use plant identification) — receives the plant photo you upload for identification.
• Perenual (optional, only when species enrichment is enabled) — receives only species names (a public botanical fact, not your data).
• OpenWeatherMap (optional, only when you set a household location) — receives your saved city name and the coordinates we got back from geocoding.
• PostHog (product analytics) — receives the product events listed above, keyed by your pseudonymous account id (a random UUID, never your email) and your household’s UUID, with the app version and the time of the event. They go straight from your browser to PostHog’s US cloud (us.i.posthog.com), where PostHog processes them on our behalf as a service provider. We do not load PostHog’s script, place any PostHog cookie or identifier on your device, or use session recording, and every event asks PostHog not to derive a location from your IP address. PostHog stores the events in the United States and keeps them for the retention period of our PostHog plan — currently one year — after which they are deleted. Deleting your account does not by itself remove these events; email support@familygreenhouse.net and we will delete them from PostHog as well.
• Google (Google Analytics 4, on the website only) — receives the page views, visit details and steps toward a paid plan described above directly from your browser: the script comes from www.googletagmanager.com and the measurements go to google-analytics.com. We use it to count visits, see which pages people find, and see which visits lead to an account or a purchase, and Google processes the data on our behalf. Its advertising features are off: Google signals and ad personalization are disabled, and the advertising consent settings (ad_storage, ad_user_data, ad_personalization) are set to denied for every visitor. Google keeps the event-level data for 14 months and then deletes it; totals already counted into reports are not removed on that schedule. Google may process the data outside your country, including in the United States. Because it is not linked to your account, deleting your account does not delete it.
• Push delivery services (only if you turn on push notifications) — a browser notification is handed to whichever service your browser nominates, such as Google, Apple, Mozilla, or Microsoft; in the apps, iPhone notifications go through Apple Push Notification service and Android notifications through Google Firebase Cloud Messaging. They receive the push token and the notification’s title and text (for example, which plants are due) and deliver it to your device.
• Sentry (optional error monitoring, and switched off on this service today) — the app and the API can each be configured with a Sentry key. When one is set, crash reports go to Sentry, and unlike the measurements described above those reports do include stack traces and browsing breadcrumbs. No Sentry key is configured on the hosted service, so no crash data is sent to Sentry today.

We do not sell your data. We do not run ad networks. We do not share your plant care data with anyone outside the household members you’ve invited, except through a sharing tool you deliberately set up: a sitter link, a caretaker seat, a wall display link, a printed plant tag, or a shared cutting link.

Household sharing

When you join a household (yours or someone else’s), the other members can see the plants, tasks, completions, and activity in that household. They can see your display name and which tasks you’ve completed. They cannot see your email, phone number, or notification preferences.

Sitter links

A household member can create a temporary sitter link without creating an account for the sitter. Anyone who has that link can see due care tasks, plant names, each plant’s current space, and its short placement note, and can mark those tasks complete during the coverage window you selected. On a plan that includes the Away Kit, the same link also opens a care brief, which adds three things per plant — the short house rule you wrote for it, its entry in our verified pet-toxicity list, and its latest photo, as an address that stops working when the link does — and lets the sitter send a photo back to a plant’s timeline. Sitter links do not expose your saved household location, plant or task private notes, or household member identity and contact details. The link is a bearer credential, so only send it to someone you trust. It expires after at most 90 days and a household member can revoke it sooner. We do not ask for or store the sitter’s identity.

Wall displays and caretaker seats

Two other links show household data to someone who has no account. Unlike a sitter link, which any member can create, both of these are issued and revoked by a household admin, and in both cases the link itself is the credential. A wall display link shows the household’s due and overdue tasks on a screen you mount — plant names, each plant’s current space, its short placement note — and can mark those tasks complete. It does not expire, so treat it as live until someone revokes it; what it completes is recorded as the display rather than as a person. A caretaker seat is the named version, for a helper you are paying: it shows the same task list for a window of at most 180 days, greets them by the name your household typed, and lets them complete tasks, add a note, and add a photo to a plant’s timeline, all attributed to that name. Neither link exposes your saved household location, plant or task private notes, household member identity or contact details, your billing, or your settings.

Your rights

• Export. From Settings → Account → Download my data you can take a CSV of the plants and tasks in your current household, or a full JSON export covering every household you belong to plus your account details and notification settings. Photos and the completion history are not part of either file today.
• Delete. The Delete account button in Settings wipes your login and notification credentials and removes you from every household you’re a member of. It is also available from the setup screen before you create or join a household. If you are the only admin of a household that still has other members, deletion is refused until you promote someone else, so the household is not left without an admin. Shared care facts such as a past completion may remain useful to other members, but your name and account id on those records are replaced with “Former member.” See our account-deletion instructions for the web request path.
• Access / correction. Email support@familygreenhouse.net and we’ll respond within 30 days. We’re a small team; this is the same person you’d talk to about any other support issue.

Children

The service is not intended for users under 13. We don’t knowingly collect data from anyone in that age range. If you’re a parent and you think your child created an account, email support@familygreenhouse.net and we’ll delete the account.

Changes

When we update this policy we bump the effective date at the top, and the full revision history is public in our repository. We do not show an in-app banner today.