GardenRuler ("we", "us") publishes gardening guides and plant profiles and runs a garden-tracking app at gardenruler.com. This page explains what information we collect, why, and what choices you have. It's written in plain language rather than dense legal text; if anything is unclear, write to us and we'll clarify it.
Information you give us
Creating an account. We ask for your name, email address and a password. The password is stored as a one-way hash; we can't read it back.
Two-factor authentication. If you turn on two-factor authentication in Settings, we store a secret key and a set of one-time recovery codes so we can verify your sign-ins.
Your garden data. Anything you enter into the tracker — gardens, beds, plantings, tasks, and any custom plants you add — is stored so the app can show it back to you. We don't read or use it for anything beyond running the app.
The contact form. When you write to us, we store your name, email address, message, and the IP address the message was sent from, so we can reply and guard against abuse.
Billing. If you subscribe to a paid plan, payment is handled entirely by Stripe. We never see or store your full card number; we only keep the card type, its last four digits, and your subscription status, so your account reflects the right plan.
Information collected automatically
Sessions. Signing in sets a session cookie so the app knows it's you between page loads. Session data lives on our server, not just in the cookie, and expires after about two hours of inactivity. We also record the date and IP address of your most recent sign-in, visible only to site administrators, mainly to spot suspicious account activity.
Visit log. Loading any page records a basic entry against your IP address: your browser's user-agent string, a running count of visits, and when you were first and most recently seen. If you're signed in, that entry is linked to your account. This is a simple, first-party traffic log, visible only to site administrators, and nothing is shared with a third party for it.
Spam protection. The contact form is protected by Cloudflare Turnstile, which checks that a submission is coming from a person rather than a bot. Turnstile processes technical details such as your IP address and browser characteristics to make that judgment. This is governed by Cloudflare's Turnstile privacy addendum.
Fonts. Page text is set in typefaces loaded from Bunny Fonts, a font host that doesn't log visitor data or use cookies. Loading a page still makes a direct request to their servers.
We don't run any advertising trackers or third-party analytics services on the site, so none of this is collected for advertising purposes.
How we use your information
- To run your account: signing you in, remembering your garden data, and showing you the right plan.
- To reply to messages sent through the contact form.
- To process payments and manage subscriptions, through Stripe.
- To keep the site working and secure — for example, spotting abuse of the contact form or a compromised account.
- To send account-related email, such as confirming your address or a password reset. We don't send marketing email.
Who we share it with
We don't sell your information, and we don't share it beyond what's needed to run the site. That's currently: Stripe (payments), Cloudflare (spam protection on the contact form), our email delivery provider (sending account and contact emails), and Bunny Fonts (serving web fonts). Each only receives what it needs to do its job.
Keeping and deleting your data
You can delete your account at any time from Settings. That permanently removes your account and everything tied to it — gardens, beds, plantings, tasks and custom plants — and can't be undone.
A few things fall outside that deletion. Billing records are kept by us and by Stripe for accounting purposes even after an account is deleted, as most tax and financial record-keeping rules require. A message you sent through the contact form isn't linked to your account, so deleting your account doesn't delete it separately — contact us if you'd like a specific message removed. And your visit-log entry keeps existing against your IP address, just no longer linked to the account you deleted.
Children
GardenRuler isn't directed at children, and we don't knowingly collect information from anyone under 13.
Your choices
You can review and update your account details from Settings at any time, and delete your account whenever you like. For anything else — a question about what we hold, or a request to correct or remove specific data — contact us and we'll sort it out directly.
Changes to this policy
If this policy changes in a meaningful way, we'll update the date at the top of this page. We encourage checking back occasionally if you're curious.
Contact
Questions about this policy can go to info@gardenruler.com or through our contact page.