Privacy Policy

1. Who we are

The Cottage Garden Companion is a garden planning service operated by eQuill Labs ("we", "us"). This policy covers cottagegardencompanion.com and everything you do while signed in to it. It is written to be read, not to be survived — if a sentence here is unclear, ask us and we will fix the sentence.

For the purposes of the UK and EU General Data Protection Regulation, eQuill Labs is the data controller for the information described below. Under California law we are a "business", not a data broker.

2. What we collect

What you give us

• Your account. The name you sign up with, your email address, and your password. Passwords are stored only as a salted one-way hash — we cannot read yours, and neither can anyone who takes a copy of the database.
• Your gardens. The garden's name, the place label and approximate latitude and longitude of the weather station you pick, the country, hardiness zone, frost dates, and your unit preferences. The coordinates are the station's, not a live location from your device — we never ask your browser for your location.
• Your plans. Every bed, path, structure, plant and label you draw, and the revision history of that drawing.
• Your journal and tasks. Whatever you write in an entry — free text, dates, tags and due dates — plus any Ask the Garden conversation you choose to save there. Nothing from that assistant is kept unless you save it yourself.
• Your varieties. The cultivars you add and any notes you attach to them.
• Your preferences. Which notifications are switched on for your account and how far ahead they look.
• Messages you write to a friend. Plain text, kept for as long as either of you keeps the conversation. They are never emailed to either of you, never shown to anyone but the two of you, and never used to advertise or to train anything. We do not read them in the ordinary course; see the terms for the one occasion we might. What a friend sees of your gardening is not stored anywhere as a separate thing — it is worked out from your plans and journal, listed above, at the moment they look.
• Notes you send us. If you use the feedback form, we store what you wrote, which sort of note you picked, and the address of the page you were on when you opened it. That last one is one of our own page addresses, kept because “it goes wrong when I do this” is worth far more with the page attached; it is not your browsing history, and no page outside this site is recorded. A note is read by us and answered on your own noticeboard, never emailed to you, never shown to another gardener, and never used to advertise anything.

What the service records as it runs

• Sessions. When you sign in we store a session record containing the IP address and browser user-agent string it was created from, so that you can be shown where your account is signed in and so we can end a session that should not exist.
• Server logs. The web server records requests — timestamp, path, status code, IP address — as every web server does. These are used for debugging and abuse prevention and are not joined to your account.
• A notice ledger. A row per notice actually sent to you, whether it went by email or was pinned to your noticeboard (which kind, which month, task or date), so a retried job cannot tell you the same thing twice. It holds no message content.
• Hands of cards you win. Winning a hand of Plant solitaire records the deal it was played from, when it was won, how many moves it took, how long your browser said it took, the hand's score as our own replay of your moves works it out, and whether it was the win that earned that day's bonus question. Hands you start, abandon or lose are not recorded anywhere: they are your own business and they stay in your browser. Since these figures are what the weekly board on your Friends page is made of, your friends see them; see section 6.
• Billing status. Whether your subscription is trialing, active or lapsed, when the current period ends, and the identifiers Stripe uses for you. Not your card.
• Invitations you send. If you invite somebody, we store the email address you typed, any note you wrote to go with it, when it was sent, and whether they made an account. That address belongs to your friend rather than to you, so it is worth saying plainly what happens to it: we send them exactly one letter, naming you as the sender, and we never write to them again unless they make an account of their own. It is not added to a mailing list, not used to advertise to them, and not shared with anybody. Either of you can ask us to delete the record. If the address turns out to belong to somebody who already gardens here, no letter is sent and nothing is stored — we send them a friend request from you instead, which they can refuse without you being told, and which tells them only your name and that you have their address.

What we deliberately do not collect

• No analytics, product telemetry, session recording or heatmaps.
• No advertising pixels, conversion tags or third-party marketing scripts.
• No device fingerprinting, and no cross-site tracking.
• No card numbers, expiry dates or security codes — those go straight to Stripe.
• No contact list, calendar, photo library or precise device location.

3. Why we use it

The fourth row has earned a sentence of its own, because it is the only thing on this page that begins switched on. A new account opens with every notification running — the sowing digest, the task reminders, the daily summary of what is waiting, and the occasional note about the app itself — on the view that a garden planner which never speaks up is not much of a companion. None of it is a condition of anything. Every one of those letters says in its own fine print why it arrived and carries a link straight to Account → Notifications, where switching one off is a single click and takes effect from that moment. You will never have to write to us to be left in peace, and an account made before this became the custom keeps the quieter settings it has always had. Mail about the account itself — signing in, confirming your address, and notices about your trial or your billing — carries no such link, because there is no switch behind it: it is sent whatever your notification settings say.

We do not use your data for automated decision-making that produces legal effects, and we do not profile you. We do not use anything you write or draw to train machine-learning models, ours or anyone else's. If that ever changes it will be an opt-in you are asked for, not a line quietly added to this page.

4. Cookies and local storage

The app sets no advertising or analytics cookies, which is why you have never seen a consent banner here. What it does set:

• A session cookie, written when you sign in and cleared when you sign out. It is signed, so it cannot be forged, and it is what keeps you signed in between pages. Strictly necessary — block it and you cannot sign in.
• Short-lived security cookies used by the sign-in flow to tie a request back to the browser that started it.
• An administrator session cookie, set only for us, only on the staff console.

A handful of small things are kept in your browser's local storage. None of them is a cookie, none of them is ever sent to our server, and clearing your browser data forgets all of them.

• gp-theme, your light or dark choice.
• gp.patience.v1, how you like Plant solitaire set up and how many hands you have started on this device.
• gp-small-screen-note, a single yes recording that you have read the note about small screens, so that it does not say it twice.
• infocard-collapsed-sections, which sections of a plant, pest or malady card you have folded away, so that they are still folded next time you open one.
• plantcard-print-prefs and plantcard-print-grayscale, with a matching pair each for the bestiary and apothecary cards: what you last chose in the print dialog for a card of that kind.

Three more are kept in session storage, which your browser empties by itself when you close the tab. They exist so that a reload, or a trip out to sign up and back, does not lose what you were in the middle of: ask-the-garden, the conversation currently on screen; gp:folio-filter, a filter carried from your likes and dislikes into one of the books and read exactly once; and cgc:invite-friend-request, an invitation you had started writing.

The app also uses a service worker, which keeps its own pages, styles, lettering and icons in your browser's cache so that a thin signal opens quickly and a dropped one still gets you a page from us rather than a browser error. That cache holds our files and nothing of yours: no plot, no journal, no seed tin, no conversation with Ask the Garden. Clearing your browser data removes it, and your browser's site settings can remove it and the worker together.

5. Who else sees it

We do not sell, rent, trade or share your personal information for money or for anyone's advertising — not in the ordinary sense, and not in the broader statutory senses California's CPRA gives to "sell" and "share". We have never done so and have no plans to.

These are the only companies that process any of it on our behalf:

Beyond that list, we will disclose personal information only where:

• The law compels us. A valid subpoena, warrant or court order. We will tell you it happened unless we are legally forbidden from doing so.
• Safety requires it — to investigate fraud or a threat to someone's physical safety.
• The service changes hands. If eQuill Labs is ever sold or merged, your data may transfer with it. You will be told before that happens, and this policy binds whoever takes over until they publish their own and give you a chance to leave.

Within eQuill Labs, access is limited to the people who run the service, through a staff console that requires its own separate credentials and writes an audit record of every administrative action taken.

6. Sharing you choose

• Share links. Publishing a plan mints an unlisted link. Anyone holding that link can view that one plan read-only without signing in, and search engines may index it if you post it publicly. It shows the plan, the garden's name and its frost dates — never your email, your journal or your other gardens. Revoking the link kills it immediately.
• Invitations. Inviting somebody tells them your name and the address on your account, because a letter from a stranger with no sender is worse for them than one with a name on it. It tells them nothing else: not your gardens, not your plans, not what you grow.
• Friends. Becoming friends with another gardener is mutual: one of you asks, the other accepts, and nothing is shared until then. A friend sees the gardens you switch on and the plots in them, plus your recent garden activity — what you sowed, planted out, picked and cleared. They also see how you have done at Plant solitaire this week, on a board that lists you and your friends together: how many hands you won since Monday, your best hand's score, your quickest, your fewest moves and how many days you played on. Nothing else about a hand travels, and a week in which you won nothing puts your name on the board with no figures beside it. They never see your journal notes, your address or coordinates, your email address, your subscription, or any garden you have not switched on. Every garden has its own switch, and turning one off removes it from their side at once.
• Exports and printing. A backup file or a printed sheet leaves our hands entirely. What happens to it afterwards is up to you.

7. Where it lives

The application and its database run on a single rented server in the United States, as do all 5 companies listed above. If you are in the United Kingdom, the European Economic Area or Switzerland, using the service means your information is transferred to and stored in the US, which your regulator does not treat as offering equivalent protection by default. That transfer is necessary to perform the contract you asked us to perform; where a transfer is instead made on our behalf by a processor, that processor's own Standard Contractual Clauses apply. You are entitled to ask us for details, and entitled to decide the trade is not worth it and close your account.

8. How long we keep it

• While your account is open, we keep what you put in it. A lapsed subscription changes nothing: your gardens stay readable, printable and exportable, and we do not delete them to pressure you into paying.
• When you close your account — from the account page, confirmed by a link emailed to you — your user record and nearly everything hanging off it is deleted immediately: gardens, plans, journal entries, varieties, preferences, notifications, sessions, your handle, your friendships, any notes you sent us through the feedback form, and the email ledger. This is a real deletion, not a flag. There is one exception, and it is deliberate: messages you have sent stay in your friends’ conversations, with your name removed. They are as much your friend's record of a conversation as they are yours, and deleting your account is not a stronger claim over somebody else's record than unfriending them is. When both gardeners in a conversation have gone, the conversation goes with them.
• Backups. Nightly database archives are kept for 14 days and then destroyed, so a copy of deleted data can survive in a backup for up to 14 days. We do not restore a backup to resurrect a closed account.
• Payment records. Stripe keeps its own record of transactions for as long as tax and anti-fraud law requires it to, independently of us. Closing your account here does not erase Stripe's books, and cannot.
• Server logs roll over on a short cycle and are not archived.

9. Your rights

Wherever you live, you can:

• Get a copy. Account → Your data exports every garden, plan, journal entry and variety as one JSON file, at any time, with no request to us at all.
• Correct it. Your name, email and password change from Account.
• Delete it. Account → close your account, as described above.
• Take it elsewhere. That export is machine-readable and yours to import anywhere.
• Switch off any optional email, and withdraw any consent it rested on, from Account → Notifications, without affecting anything else.

If the UK or EU GDPR applies to you, you additionally have the rights to restrict or object to processing, to have inaccurate data rectified, and to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office). We would much rather you gave us a chance to put it right first.

If you are a California resident, you have the rights to know what we collect and why, to obtain a copy, to correct it, to delete it, to opt out of sale or sharing (there is nothing to opt out of — we do neither), and to limit the use of sensitive personal information (we collect none). We will never discriminate against you for exercising any of them.

To exercise anything the app cannot do for you, write to equilllabs+cottage-garden-companion@gmail.com. We answer within 30 days, and will ask you to write from the address on the account so that we are not handing your garden to a stranger. An authorised agent may act for you with written proof.

10. How we look after it

• Everything travels over HTTPS; the site refuses plain HTTP.
• Passwords are salted and hashed with a deliberately slow algorithm — never stored readable.
• Session cookies are signed with a secret held only on the server.
• The database is not exposed to the internet: it is reachable only by the application process on the same machine.
• The staff console sits behind separate credentials from any user account and records an audit trail of what was done and by whom.
• Backups are taken nightly and pruned on the schedule described above.

No service can promise perfect security, and we will not pretend otherwise. If we ever discover a breach affecting your personal data, we will tell affected gardeners by email — and any regulator we must notify — without undue delay, along with what we know and what we are doing about it. If you think you have found a vulnerability, please write to equilllabs+cottage-garden-companion@gmail.com before disclosing it publicly; we will not pursue anyone who reports a genuine problem in good faith.

11. Children's privacy

The service is not directed at children under 13, and we do not knowingly collect personal information from them. In the EEA and the UK, where the digital age of consent is 16 (or lower where a member state has set it so), anyone below it needs a parent or guardian to hold the account. If you believe a child has signed up, write to us and we will delete the account.

12. Changes to this policy

We will update this page when the service changes — a new sub-processor, a new kind of data, a new feature that shares something. The "last updated" date at the top always reflects the last real change. If a change materially reduces your privacy, we will tell you by email or an in-app notice before it takes effect, so that you can export and leave if you disagree.

13. How to reach us

eQuill Labs, operator of The Cottage Garden Companion — equilllabs+cottage-garden-companion@gmail.com. A person reads it, and a postal address for formal notices is available on request.

See also the Terms of Service, which govern your account itself.