Privacy Policy

1. Controller

The controller for data processing within the meaning of the GDPR is:

Robert Gürgens
Software- und IT-Dienstleistungen
Suhler Straße 17
12629 Berlin
Germany

Email: dpo@gartenkern.de

We are not legally required to appoint a data protection officer. The address above reaches the controller directly.

2. General principles

We process personal data of our users only to the extent necessary to provide a functional platform and to fulfil our contractual and legal obligations (data minimisation, Art. 5 GDPR).

Legal bases

• Art. 6 (1)(a) GDPR: consent, where you grant it separately for individual features
• Art. 6 (1)(b) GDPR: performance of a contract (account, platform use)
• Art. 6 (1)(c) GDPR: legal obligation (accounting, taxes)
• Art. 6 (1)(f) GDPR: legitimate interests (security, abuse detection)

You may withdraw consent at any time with effect for the future (Art. 7 (3) GDPR). The lawfulness of processing carried out before withdrawal remains unaffected.

3. What data we process

Gartenbörse: revealing contact details

The contact details of a listing are not shown on the public page. Signed-in interested parties reveal them deliberately, and we record every reveal: the account doing it, the channel revealed (phone, email, messenger, exact location), the timestamp and the IP address.

We do this because bulk harvesting of phone numbers would be invisible without those entries. From them we compute two daily budgets, one per account and one per IP address. Once a budget is exhausted we refuse further reveals and note that in the security logs described in section 8. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest matches that of the providers whose number would otherwise end up in somebody else's data collection.

The provider does not learn who revealed their details. We disclose neither your account nor your IP address nor the timestamp to them. Should we one day show them a number, such as how often their phone number was viewed, it stays a number with no person behind it.

Gartenbörse: the platform enquiry

If you want to write to a provider without disclosing your email address, the platform enquiry is the way. Your message then sits with us, and the provider receives it in the Gartenbörse inbox and, depending on their notification settings, also by email. Your display name goes along, your address does not: the reply travels back through the platform.

You will find the provider's reply in the Gartenbörse inbox under “Messages”. The conversation continues there, in both directions. Both sides see the whole thread, but for each message at most the display name of the person who wrote it; email address and phone number stay hidden. So that we can mark new messages as unread, we keep track of when each side last opened the thread. The other side does not see that time. If one side ends the conversation, we store which side did so and when. As long as it stays ended, nobody can reply there; if the provider side ended it, the listing also takes no new inquiry from that person. The other side learns of a new enquiry or reply by email, as a notification in Gartenkern and by push, depending on what they have chosen in their notification settings.

If you report a conversation, moderation reads its history to decide on the report.

If you block a garden account, from a Gartenbörse conversation or on a swap board enquiry, we store which garden account blocked and who in it did so, which garden account is blocked and, where the conversation knows them, the person behind it, plus the source and the time. As long as the block stands, neither side can send the other a new enquiry or a reply in the Gartenbörse, nor a new enquiry on the swap board; the provider can still accept, decline or complete a swap board enquiry made before. Retrieving the contact details returns none to the blocked side. We do not notify the blocked side; to them the conversation looks ended. We keep the person so that they cannot get around the block with another garden account (Art. 6 (1)(f) GDPR). Under Settings, Garden you see whom you have blocked and lift a block there. Support sees the blocks of a garden account when helping you.

The message stays on file after delivery, and it does so for a second purpose: should a listing be removed as fraudulent, warning the interested parties retrospectively is the most effective protection, and for that we need the list of who enquired (Art. 6 (1)(f) GDPR).

How long the entries from both subsections remain is set out in section 8.

Gartenbörse: videos

You upload a video for a listing to us in parts. We convert it on our own server into a format every browser can play: smaller, with a lower file size and without the file's metadata, that is without recording location, device and time. In substance, picture and sound stay as you recorded them. We delete the original file you uploaded as soon as the conversion has finished or failed. If an upload stops and you do not resume it, we delete the parts received after 24 hours. We do not use any outside service for the conversion. From the video we create a preview image, which we store and delete together with the video. As with every listing, a person on our team looks at every video before it is published; after that it is publicly available with the listing.

Other people in a video. If other people can be recognised in a video or their voice can be heard, we process their data as well. The legal basis for this is our legitimate interest in publishing listings as the provider is responsible for them (Art. 6 (1)(f) GDPR); we cannot notify people we do not know individually (Art. 14 (5)(b) GDPR). Under our terms (clause A-8) a video may only show other people or let them be heard with their consent, and conversations involving other people do not belong in its sound. If we notice anything like that during the review, we do not approve the video. If you recognise yourself in a published video, you can object to the publication (Art. 21 GDPR): report it to us via "Report content" or at abuse@gartenkern.de. We review it and remove the video if it shows you or lets you be heard without your consent.

We delete videos together with the listing's images, see section 8. A video you remove yourself is deleted straight away.

Swap board

On the swap board you swap, give away and sell, and only between garden accounts that have connected with each other. It is only available when you are signed in. A listing is seen by your own garden account and by the garden accounts it is connected with; visitors without an account and search engines do not see it. A connection only applies once the other side accepts it, and either side can block it. Payment does not go through Gartenkern: a price is information in the listing, and you arrange the hand-over with the other side.

The enquiry. When you enquire about a listing, your message is stored with us. Only your garden account and the provider's can see it; we do not pass on your email address. The provider accepts, rejects or completes the enquiry. We send no email or push notification about it: the provider sees new enquiries when they open the swap board.

Terms of business. Before a nursery or another business offers or looks for something commercially, it stores its terms of business: name, address, email address, optionally a phone number, its own terms and its own privacy notice. We generate the withdrawal notice from the name and contact details. Every change creates a new version; the old one is kept. A listing carries the version that applied when it was created. When you enquire about such a listing, we store with your enquiry a copy of that version, the listing's details and your message. It records the terms under which you enquired. Once the business accepts the enquiry, both sides can download a contract confirmation as a PDF from it; we generate it anew on every download and do not store it. The business itself sees its terms of business. As long as a listing under that version is active or reserved, the garden accounts connected with the business see them too, so you can read them before you enquire. Garden accounts that enquired under that version keep seeing them afterwards. Which account created a version is seen only by the business.

Who is responsible for what. We process this data to provide the swap board to you (Art. 6 (1)(b) GDPR). A swap or purchase is concluded between you and the other side, not with us. What a provider learns from an enquiry and uses to complete it, they process as a controller in their own right. The business itself is responsible for its details in the terms of business and for its privacy notice.

How long the entries are kept is set out in section 8.

News, tips and offers

We write to you about three topics: product news, getting-started tips (short guides for your first weeks, including features from our plans) and offers and promotions (promo codes and offers for Gartenkern plans).

By email and push only with your consent. When you sign up, one tick covers all three topics by email; in your settings you choose separately for each topic and channel. Your consent is voluntary and not part of the contract: your account works the same without it. The legal basis is Art. 6 (1)(a) GDPR. For email, the double opt-in described below applies. For push, the switch in your settings is your consent; the notification permission in your browser or phone alone is not enough for us. We record every time you switch it on or off as proof.

We only email you once you have confirmed (double opt-in). When you switch on the first of these topics by email, we first send a single email: the request to confirm your subscription via a link. The confirmation covers all three topics. Only when you click that link do we add you to the list. If you do not confirm, you receive no email on these topics. The link is valid for seven days; after that it expires and you can subscribe again if you want to. We send a new confirmation email no earlier than five minutes after the last one.

What we record. Our database holds only a check value of the confirmation link, never the link itself. Separately from that we keep the proof Art. 7 (1) GDPR requires: your email address, what the consent covered (for email and for push per topic, that is marketing_email and marketing_push with the topic), whether you granted or withdrew it, by which route (registration, settings, unsubscribe link) and the timestamp. When you click the confirmation link, your IP address and browser identifier are added, because that click is precisely what shows the subscription came from the mailbox in question. For the tick box during registration we store no IP address: our sign-in service does not pass it through on that route, and a wrong address would be worthless as proof.

Sending. These emails go out through the same provider that delivers our other email (Proton AG, see Section 7). We do not use a separate newsletter service with open or click tracking.

Withdrawal. You can withdraw at any time, without giving reasons: via the unsubscribe link at the end of every email or via the switches per topic in your settings. We then send you nothing more on that topic and by that route. If you change your account's email address, the confirmation lapses by itself: you receive emails on these topics again only once you have confirmed the new address too. How long the proof of consent and withdrawal is kept is set out in Section 8.

Offers for our own plans without a tick. When you sign up, we reserve the right to use your email address for offers for our own plans even without a tick, as long as you do not object (section 7(3) UWG). We don't currently make use of this: without a confirmed consent you get no promotional email. If that changes, it will say so here first. An objection you make now, we record.

In the app, also without consent. When you're signed in, we also show tips and offers as a notice at the top of the page or in your notifications (bell). We pick some of them to suit your account, using the characteristics from section 5, such as “no garden created yet” or “checkout abandoned”. The legal basis is our legitimate interest in showing you help at the right time and offers for our own plans (Art. 6(1)(f) GDPR, recital 47). We'll send you our assessment on request. You can switch off each topic for the app and object at any time, using the switch “No hints or offers tailored to me” in your settings or by emailing dpo@gartenkern.de. Your objection applies without further review (Art. 21(2) and (3) GDPR): we then stop selecting you for any group, on any channel, and delete the characteristics of your account and your answer to the why question (section 5). Next to every selected notice, “Why am I seeing this?” leads to this switch.

At most one promotional message a week. Across all channels, we send or show you at most one message with tips or offers in seven days. Emails and push notifications about this only arrive between 9 am and 8 pm in your time zone, and push also not during your own quiet hours. While a support request of yours is open, we don't send you any.

Comparison group. To know whether a message makes a difference, a random share of the selected accounts doesn't get it, usually one in ten. We record who received a message and who was in the comparison group, and compare both groups on whether they, for example, redeemed a promo code, took out a subscription or kept using Gartenkern. This list is kept for 24 months after the campaign ends, after which only aggregated figures remain. If your account is deleted earlier, your entry goes with it. It is included in your data export.

No tracking of whether you open or click an email. Our emails contain no tracking pixel, and links go straight to our site, not through a click counter. A link carries at most the campaign's identifier, never one for you; all we see from it is the number of visits from that campaign (section 5).

Support access: who on our team sees your data

For support, moderation and keeping the platform safe, our team has an admin area where it can see your account and your garden accounts. A threshold applies there.

• Visible without a further step is how your account is set up and what we handle with you, for example: email address, display name, plan, subscription and payments, the members of your garden accounts with their role, the names of your gardens and areas, the garden plan, the species and varieties you grow, counts (such as how many plantings, journal entries and photos there are), the subjects of your requests, the emails we sent you, without their text, and security and consent records with IP address.
• Visible only after a separate step is your content: journal entries, notes, photos, your profile picture and the text of the emails we sent you. In your file we show only content you created yourself, not that of other members of your garden accounts. Whoever opens it picks one of four reasons: a support request you made yourself (with ticket number), reviewing a report, a legal request, or tracking down a bug.
• Visible directly is what cannot be handled without reading it: reported content, for whoever reviews the report; what you send us yourself, such as a support request with attachments or your message when joining the waitlist; and what you submit for review, that is a listing on the garden exchange including contact details before it is published, and a new profile picture while it awaits review. In each case this covers only that content, not the rest of your account.

Team members who only answer support requests see, next to your request, your name, your email address, the names of your garden accounts, plan, subscription and counts. To match a request to your account, they can search accounts by name or email address. Your content and the full overview of your account are visible to admins only. Nobody on our team signs in as you.

The same threshold applies to the AI assistant our admins use for support and administration (Anthropic, section 7). It reads your content only with one of the four reasons, and each such access appears in the access log like any other, there with the identifier of its task instead of a name. It does not see your photos or your profile picture.

We record these accesses in an access log: when, which part, who and, for content, for what reason. The log contains no content and no search terms. If the log is disrupted, the admin area keeps working; an access during that time may then be missing from the log.

We base access for your support request on Art. 6 (1)(b) GDPR: without looking at your account we cannot answer your request or provide the service as agreed. The same applies to tracking down a bug you reported to us; if we track down a bug on our own initiative, we base this on Art. 6 (1)(f) GDPR, our legitimate interest being a service that works without errors for everyone. We base moderation and security on Art. 6 (1)(f) GDPR; our legitimate interest is a platform free of abuse and unlawful content. We answer a legal request on the basis of the obligation concerned, your own access request for example under Art. 6 (1)(c) GDPR. We keep the access log under Art. 6 (1)(f) GDPR; our legitimate interest is being able to check and prove that we only access your data when needed.

Signing in with Google or Facebook

Instead of an email address and password, you can register and sign in with your Google account (Google Ireland Limited) or your Facebook account (Meta Platforms Ireland Limited). This is optional; signing in with your email address is always open to you.

What happens. Only when you click the Google or Facebook button does your browser take you to the provider. Before that, our pages load nothing from Google or Facebook. At the provider you sign in and approve which details it passes on to us. In doing so, it learns that you want to sign in to Gartenkern. What Google or Meta collect themselves in the process, for example your IP address and details about your device, they process as independent controllers under their own privacy notices (Google, Meta). Both may also process this data in the USA.

What we receive and store. Once you approve, our sign-in service fetches from the provider: an ID under which the provider knows you, your email address and whether the provider has confirmed it, your name and other details of your public profile such as the address of your profile picture. We take your email address and name into your account, the profile picture we do not. We store the ID so we recognise you the next time you sign in. Our sign-in service also keeps the sign-in credentials (tokens) the provider issues when you register or connect the account, encrypted on our server in Germany. For Google, these credentials also contain the profile details fetched, including the address of your profile picture. We do not use these credentials to fetch data from the provider later. We do not pass content from your garden or details about your use to Google or Meta.

The legal basis is Art. 6 (1)(b) GDPR: you choose this route yourself to use your account.

Disconnecting and deletion. In your settings under "Sign-in & security" you can disconnect the provider at any time, as long as another way to sign in remains, such as your password or another provider. We then delete the ID and sign-in credentials of that provider. If you delete your account, we delete them along with all other account data. You withdraw Gartenkern's access at the provider itself in your Google or Facebook account.

The Android app

Getting the app through Google Play. You download the app from Google Play. Google (Google Ireland Limited) processes your Google Play account, the download and the updates as an independent controller under its own privacy policy. From Google Play we only receive aggregated figures, for example on installs and crashes, without any link to you as a person.

In the app you use the same account as on the web, and everything else in this policy applies to your content as well. What the app does on top:

• Signing in. You sign in with your email address and password, or with Google or Facebook. For that the app opens your browser, and the section "Signing in with Google or Facebook" above applies. You create a new account on the web.
• Session on your device. After you sign in, the app stores a sign-in credential on your device in encrypted form. The Android keystore holds the key; where the device has no usable keystore, the key sits in the app's protected storage area. The credential is excluded from backups and from transfer to a new device. When you sign out, the app deletes it. Without it you would have to sign in every time you start the app, so storing it is technically necessary (Section 25 (2) no. 2 TDDDG).
• Signing in on a new device. After you sign in, the app creates a device key through Android’s Credential Manager. Android keeps the private part on your device. If you have backup in your Google Account and a screen lock set up, it goes into that backup with end-to-end encryption; otherwise it stays on the device and only moves with a direct transfer to a new device. With your account we store the public part, the key ID, the device name (for example “Pixel 8”) and when the key was created and last used. An account has at most ten such keys; when an eleventh is added, we delete the one that has gone unused the longest. When you open the app for the first time on a new device, it signs you in with the key, and we create a device session for that (device name, when it was created and last used, ending after 30 days). If your account has a second factor, you sign in yourself once on the new device. You see your device sessions in the app under Settings › “Devices after a phone change” and can end them there. When you sign out, the app deletes the key on the device and with us. If you change your password or a sign-in factor, recover your account, or it is locked or deleted, we delete all keys and end all device sessions. Creating and deleting the key and signing in with it are recorded in the security logs from section 8. The legal basis is Art. 6(1)(b) GDPR (providing your account).
• Permissions. The app needs internet access and the network status. It asks you before it sends notifications and before it uses the camera. It does not access your location, contacts or photo library.
• Photos. You take a photo with the camera in the app or pick one through the Android photo picker. The camera only runs while you have it open to take a picture, and an image leaves your device only once you tap “Use photo”. From the photo picker the app only sees the images you select there and needs no access to your media library. A photo from the in-app camera is saved again before uploading, without metadata such as the location it was taken. When you upload, our server removes the metadata of every image, see the table above. For plant and label recognition the photo also goes to the AI services from Section 7.
• Notifications. Only once you agree does the app register with Firebase Cloud Messaging and send us the identifier under which Google reaches your device, together with the device model and Android version. What Google receives is described in Section 7 under "Notifications in the Android app". You can see your devices in your settings and remove them there. If you turn notifications off or sign out, the app deletes the identifier with us and with Google.
• Crash reports. If the app crashes or stops responding, it sends a report to our self-hosted GlitchTip on our server in Germany. The report contains the place in the program where it happened, the device model, Android version, language, time zone, memory and battery level, and the app's last steps (such as moving to the background or switching to mobile data). It does not contain your IP address, screenshots or an identifier of your account, your device or this installation. We do not send what you type or your content; only if the error message itself contains a piece of text, for example from a response of our server, can it appear in the report. Before sending, we remove identifiers and sign-in credentials from addresses. We need the reports to find errors and keep the app stable (Art. 6 (1)(f) GDPR), and we delete them after 90 days.
• Audience measurement. When you switch screens in the app, it reports this to our audience measurement from Section 5: which screen it is, without the identifiers of your gardens or plantings, that the visit comes from the app, and whether you are signed in. If you open a Gartenbörse listing, the app reports the listing's public address instead of the screen, just as a visit on the web does. When it shows you the hint for a feature your plan does not include or whose allowance is used up, it reports that too: which feature it is and where. It does not send your sign-in credential with it. Everything else is in Section 5.
• Help and feedback. If you write to us from the app, the screen, window size, colour scheme, device model and Android version are sent with your message, but no browser identifier.
• Version number. Every request from the app to our server carries the app's version number. We only store it with a request through help and feedback, so that we can match an error to the right version.
• Plans. You do not book or pay for anything in the app. Plans are only available on the web; the app processes no payment data.
• Deleting your account. You can do this in the app under Settings › Data & privacy › "Delete account", or without the app on the delete account page. You can also export your data in the app.

4. Cookies

We use strictly necessary cookies only:

• ory_kratos_session: login session (essential, up to 30 days, ends when you sign out)
• csrf_token_…: cross-site request forgery protection (essential)
• NEXT_LOCALE: selected language (essential)
• theme: light or dark preference (essential)
• gartenkern_invite_token: validation of your invite code during the closed beta (essential, HttpOnly, expires after 2 hours)
• ory_kratos_continuity: carries a process you started across a redirect and back, for example when signing in with Google or Facebook or when signing in again before a change under "Sign-in & security" (essential)

We set no cookie for measurement or advertising and embed no third-party advertising scripts. A cookie consent banner is therefore not required under § 25 (2) TDDDG. Commission links on public pages are unaffected: they are ordinary links and set no cookie on our side (see the commission links section). Even when you are signed in, our measurement reads no cookie (section 5). Our emails, too, contain no tracking pixel and no links routed through a click counter.

5. Audience measurement

We want to know which pages are read and whether what we offer lands. For that we use no Google Analytics and no other outside service, but our own measurement on our server in Nuremberg. It sets no cookie and stores nothing on your device. It also reads nothing from your device, even when you are signed in.

For a page view we store:

• the page you opened, in coarsened form. /gardens/8f2c… becomes /gardens/{id}; the identifier itself is discarded.
• the language of the page (de or en)
• the referring site, but only its address without additions: google.com/search?q=… becomes google.com. A search term never reaches us.
• browser family (e.g. "Chrome"), operating-system family (e.g. "Android") and device class (phone, tablet, desktop)
• the country, where the local GeoLite2 database provides it. Deliberately only the country, no city, no region.
• the campaign label from our own links (utm_source, utm_medium, utm_campaign), if the link carries one. We store it in lower case and only if it consists of a to z, 0 to 9, -, _ and . and is at most 64 characters long. Anything else is discarded.
• whether the view is probably automated. Today that means your browser sent no preferred language.
• whether the view comes from the browser or from our app
• a pseudonym valid for one day (see below)
• whether you are signed in, as a plain yes or no. We do not store your account with a page view. The measurement takes the yes or no from the page or app you already opened while signed in; there is no separate access for it.

We do not store your IP address in the measurements. For the measurement it only goes into the calculation of the pseudonym and into the country lookup and is discarded afterwards. For the server log files see section 8.

How the pseudonym works. From your IP address, your browser identifier and a secret random value that changes every day we compute a checksum. It lets us tell that two views on the same day likely came from the same person. Once that day's random value is deleted (after two days at the latest), the checksum cannot be traced back to a person, and the next day the same person yields a different one. We do not link page views to your account, not across days either, whether you are signed in or not.

We also count certain events, such as "a garden was created for the first time" or "a subscription was taken out". The contents of your garden, your journal entries or your photos are not transmitted. Some events are reported by your browser or the app itself, such as a click on "Upgrade" or that a locked section was shown. We store those like a page view: with the name of the event, the device class, the pseudonym, the yes or no "signed in" and, where it applies, the lock concerned, but without your account.

If you are signed in, a page view still carries no link to your account: your browser does not send the sign-in cookie from section 4 with the measurement, and the app sends it no session token. We only know your account where you use Gartenkern anyway. When you create a garden or start the checkout for a subscription, for example, we record that event together with your account and the garden account you are working in. For that we use the request you send for the action itself, not a separate access to your device. Some events concern you without coming from your browser, such as your registration, a subscription starting or ending as reported by the payment provider, a paid listing in the Gartenbörse or someone opening a garden you shared. We store those with your garden account too and, where they are about you yourself, with your account. Whoever opens your shared garden is not part of that event. Through the account these events can be linked to each other across several days. That shows us where people get stuck in Gartenkern or run into errors. These records are deleted after 90 days as well. If your account is deleted before then (section 8), the link to your account and to your own garden accounts goes with it.

Characteristics of your account. To understand how Gartenkern is used, once a day we compute a short list of characteristics for every account:

• the day you last used Gartenkern while signed in (this includes the app fetching something in the background) and the day you last did something: planted or ended a planting, harvested, recorded a loss, wrote in your journal or a note, completed a task (it counts for the person it is assigned to), uploaded a photo, created a bed, a garden feature or a garden. For these two we store only the day, no time.
• a classification derived from that: new, active, dormant, lost or returning, plus the day you came back after a break
• the day the first planting was created in your garden account (if you are looking for a garden: the day you published your first request on the garden exchange) and which goal you picked during setup
• the plan of your garden account, the state of its subscription and whether it is in a trial
• how many gardens, plantings, journal entries and photos your garden account has, as a number only
• which limits of its plan your garden account has currently used up (such as the number of gardens or of messages in the AI chat), as the name of the limit only
• the day you last started a payment and the day a payment was last abandoned in your garden account
• up to five plant families with the most current plantings in your garden account, by their botanical name (e.g. Solanaceae, the nightshades)
• where you came from when you registered, recorded once at registration and never changed afterwards, if a link took you straight there: the campaign tag from our link and the address of the referring page without anything added, both as described above for audience measurement. Our own pages do not count as an origin. We pass these details to our sign-in service in the address and the form while you register and store nothing on your device for it.

The row holding the characteristics also carries technical timestamps: when it was created, last changed and last computed. From the days on which something was done (first point) we also count, per calendar week (ISO 8601, Monday to Sunday), how many accounts did something in that week. This number contains nothing about individual accounts and is kept.

We do not include the contents of your garden, texts from your journal, your photos, your conversations with the AI or your location. The characteristics serve to find obstacles, to sort accounts into stages such as “dormant”, and to choose whom we show or send a hint or offer (section 3, “News, tips and offers”). By email and push, this only happens if you've consented there. That is profiling within the meaning of Art. 4 (4) GDPR. We make no decision with legal effect about you from it (section 9): features, your access and regular prices don't depend on it; a promo code is an offer you can use or not (section 9). Only our administrators can see the characteristics, also through the AI assistant that reads on their behalf (Anthropic, section 7). Beyond that we do not pass them on and do not sell them.

Legal basis for the characteristics is our legitimate interest in improving Gartenkern and running it economically (Art. 6 (1)(f) GDPR). We will send you our balancing of interests on request. The characteristics exist as long as your account does and are deleted with it. They are included in your data export in the settings. You can object at any time (Art. 21 GDPR), using the switch “No hints or offers tailored to me” in your settings or by emailing dpo@gartenkern.de. Because the selection serves direct marketing, your objection applies without further review (Art. 21 (2)). After that we delete the characteristics of your account and your answer to the why question (below), compute no new characteristics and include it in no group. We keep only a note that and when you objected, so that nothing is computed again; it goes with your account as well.

The why question. Between the third and the fourteenth day after you sign up, we ask you once, on your overview on the web and under “Today” in the app, what is holding you back, as long as you have not really got started yet. You pick a reason from a fixed list and can add a text if you like, up to 500 characters. You can also dismiss the question. We store, once per account, the reason or that you dismissed the question, your text, whether we asked you as a gardening or a searching account, your garden account and the time. We evaluate the reasons summed up across all accounts. Our administrators, also through the AI assistant (section 7), see your answer with your text only under the same threshold as your content (section 3, “Support access”): with a reason, and every such access is recorded in the access log.

Legal basis is, as for the characteristics, our legitimate interest in improving Gartenkern (Art. 6 (1)(f) GDPR). Your answer is included in your data export and is deleted with your account. You can object at any time, with the same switch as above or by emailing dpo@gartenkern.de. We then delete your answer including your text and do not ask you while the objection applies. If you withdraw it within the fourteen days, the question may come once more.

Search terms without a matching result. When you submit a search on our search page or in the magazine and we have nothing matching (the page then shows nothing or only something loosely similar), we keep the search term. It tells us which magazine article or which plant in the encyclopedia is missing. We store only the term in lower case, the language of the page (de or en), whether the search was on the search page or in the magazine, a counter and the time of the first and the last search. No IP address, no pseudonym value, no link to your account. Two searches therefore cannot be recognised as belonging together. Input that looks like personal data (email addresses, phone numbers, long digit sequences, whole sentences) is not stored at all. Neither are searches with matching results, nor the suggestions shown while you type. After 90 days without another search we delete the term.

Legal basis is our legitimate interest in data-minimising audience measurement (Art. 6 (1)(f) GDPR). For the link to your account, our legitimate interest is finding and fixing obstacles and errors in Gartenkern. Our measurement neither stores nor reads anything on your device, whether you are signed in or not. § 25 (1) TDDDG therefore does not apply and no consent is required.

Retention: individual measurements, including those linked to your account, are deleted after 90 days. What remains are aggregate numbers (e.g. "1,200 views of the pricing page in May") that no longer relate to a person.

Country lookup uses the GeoLite2 database by MaxMind (CC BY-SA 4.0). It sits locally on our server; no query is sent to MaxMind.

6. Commission links

Public pages occasionally carry links to partner shops. If you buy something there, we receive a commission. The price does not change for you. Every such link is labelled as advertising; the transparency page lists the programmes we use.

What happens on our side. The link first goes to our own redirect address under gartenkern.de/go/. There we increment a daily counter per offer and page area, that is, a number of the form "offer X, 14 August, magazine: 12 clicks". We store no IP address, no cookie, no identifier and no history in the process. The number cannot be attributed to a person, not even by us.

How often an offer was shown. Where several equivalent partners are available for the same spot, the offer shown changes from one page view to the next. A click count only means something once we know how often the offer was on screen. Your browser therefore tells our server which offers a page is showing and which page that is. We use this to increment a second daily counter of the form "offer X, 14 August, magazine: 340 views". This counter, too, holds no IP address, no cookie, no identifier and no history, and nothing is stored on or read from your device. Mass reports are held back by the same per-connection limit that applies to every request to our server. It keeps the IP address in memory only and does not store it.

We do not pass on a referring address. The redirect sends the header Referrer-Policy: no-referrer, so your browser does not tell the partner which article you were reading before you clicked. If the link runs through the affiliate network Awin, we ourselves add up to three fixed values to the target address, so that we and Awin can see which article leads to purchases: the offer, the area of the site (such as the magazine) and the path of the page the link was on, for example /blog/tomaten-anbauen. These describe our content, not you: no IP address, no identifier, no account. According to our check, Awin does not pass them on to the shop.

What happens at the partner. After the redirect you are on the partner's site, where their privacy policy applies. Affiliate programmes generally set their own cookie or a comparable identifier on their own domain in order to attribute a later purchase to the referral. That happens under the partner's responsibility, not ours: we are neither their processor nor a joint controller with them. We receive no personal data about you from there, only settlement totals.

Why there is no consent banner for this. § 25 (1) TDDDG requires consent where information is stored on your device or read from it. Clicking a commission link does neither, and neither does counting the views. The partner's identifier is set on the partner's own site after you have opened it, and therefore outside our reach. When you click a commission link, your browser sends the cookies from section 4 along, as with every request to our pages; the redirect does not read them and does not pass them on. The report of the offers shown sends no cookie at all.

Because neither counter can be attributed to a person, no personal data within the meaning of Art. 4 (1) GDPR is processed. The technical access logs of the redirect and of the view report are treated like all others (see the retention section).

7. Processors and external services

Mistral La Plateforme (servers in the EU, France) processes on our behalf:

• Plant photos for disease diagnosis
• Photos for plant and label recognition, only as a fallback when Anthropic or OpenRouter (see below) do not answer
• AI chat requests with journal context, only if you use the AI chat
• Season summaries about your garden, only if you generate them
• Receipts you upload to the expense book
• Meter reading photos you upload to meter tracking

Mistral processes this content solely for inference and deletes it from audit logs within 30 days, as contractually assured. No training use takes place. We store neither the original image nor raw Mistral responses long term; only the structured result (recognised plant, extracted receipt item, answer text) enters your garden.

Reported answers from the AI chat: If you report an answer from the AI chat, we read that answer and your question right before it to review the report and improve the chat; we do not see the rest of the conversation, and we do not pass either of them on to an AI model. If you delete the conversation or your account, we no longer see the question and answer either; your note on the report is deleted with your account.

For public data without personal reference (general plant knowledge enrichment in our plant knowledge base, DE/EN translations of plant content and blog articles) we additionally use Anthropic, PBC and OpenRouter, Inc. (both USA, under EU standard contractual clauses per Art. 46 GDPR). Three features you trigger yourself also send your details there, each without any details of your account: plant recognition sends the photo to Anthropic, label recognition sends the photo to Anthropic or OpenRouter (both photos without metadata), and enriching a seed entry sends its variety and vendor. For these features, the two never process your journal entries, AI chat requests, or photos for disease diagnosis; the router refuses those routes technically. The next paragraph covers our administrators' tools.

Administration and support tools: Our administrators also use an AI assistant from Anthropic, PBC for support and administration. It reads details from our administration on their behalf, and only for a task an administrator gives it or schedules: your account and garden account with plan, subscription and open invoices, your support requests and our replies, your email history without the text of the emails, reports and moderation cases, our internal notes on your account, the characteristics of your account (section 5), and the security logs and consent records with IP address. Of your content it first sees only how many entries, notes and photos there are. It reads the beginning of your journal entries and notes, your answer to the why question (section 5) and the text of the emails we sent you (including messages others wrote to you through the garden exchange) only under the same threshold as our team (section 3, "Support access"): with one of the four reasons, for a support request only with its ticket number, and each such access appears in the access log. It does not read your photos, your profile picture, your conversations with the AI or the location of your garden.

On an administrator's instruction it can also act: reply to you in support, organise cases, adjust your plan or subscription, or block your address for further emails. We log each of these actions. It cannot change your role, delete your account, end a subscription with the payment provider or record your objection to the characteristics; only a person does that. It does not decide anything about you from the characteristics either (section 9). Anthropic processes these details as our processor (Art. 28 GDPR, USA, under EU standard contractual clauses per Art. 46 GDPR) and does not use them to train its models.

A detailed sub-processor list with models and architecture guarantees is available on request at dpo@gartenkern.de.

When you take out a paid subscription, the payment provider you choose (Stripe Payments Europe, Ltd., Ireland, or PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) processes your payment data, for example payment method and billing address. PayPal acts as an independent controller in this respect. We ourselves store no complete payment data, only the provider's reference IDs and the subscription status.

External services your browser contacts directly

For some features, your browser contacts external services directly; for technical reasons your IP address is transmitted. Unless stated otherwise below, these services are not processors but independent recipients. The legal basis is our legitimate interest in providing the respective feature (Art. 6 (1)(f) GDPR):

The aerial view on the location map: The location map first shows the OpenFreeMap base map. Only when you switch to "aerial" does your browser fetch image tiles from an official surveying service. As long as the base map is showing, no request goes out to them at all. And when one does, it goes to the single service responsible for the centre of the visible map section, never to the whole list.

What is transmitted is your IP address, the requested map section (the coordinates of the individual image tile, that is, the area you are currently looking at), the time of the request and the details your browser sends with every image request, such as its user agent. The legal basis is Art. 6 (1)(f) GDPR; without an aerial view a plot of land is hard to find again on a map. These services are public bodies and therefore independent controllers: how they keep their server logs, and for how long, is up to them. For Austria the City of Vienna runs basemap.at, a joint project of the Austrian states. Switzerland is not an EU member state, but the EU Commission has found that it ensures an adequate level of data protection, and that adequacy decision (Art. 45 GDPR) is what the transfer rests on when you look at an area in Switzerland.

Which service is queried depends on the federal state, and outside Germany on the country:

All sixteen federal states are covered, plus Austria and Switzerland. If your garden sits anywhere else, the base map stays in place and no service is contacted. Which state a point belongs to is decided along the state borders from the administrative areas published by the Federal Agency for Cartography and Geodesy, and for Austria and Switzerland along the national borders from the open mapping project Natural Earth. Those borders sit as a file inside our application and are not fetched at runtime: neither the agency nor Natural Earth learns anything about your use of the map.

The address search on the location map: When you type an address into the location form, your browser asks the Photon geocoder for suggestions from the second character onwards. What is transmitted is your input verbatim, the language of your interface, your IP address and, if a point has already been set for the garden, its coordinates as a proximity hint for better matches. If you create a garden with a postal code, that postal code goes out once along the same path so the map can place the garden roughly. If you type nothing and give no postal code, no request goes out; you can also set the point directly on the map without searching.

Photon is an open geocoder built on OpenStreetMap data. The public instance at photon.komoot.io is operated by komoot GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany. There is no separate privacy policy and no separate terms of use for that instance, and komoot does not publicly state where its servers are located. We therefore cannot assure you that your search input stays inside the EU. The legal basis is Art. 6 (1)(f) GDPR; we plan to run the geocoder ourselves in the medium term.

The bot check on the open forms: Forms you can submit without an account (report content, suggest a correction, enquiry for educational institutions, contact form) are protected against automated submissions by Cloudflare Turnstile. The widget loads from challenges.cloudflare.com when the form opens; what is transmitted is your IP address, technical details of your browser and the result of the check. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, USA, which acts as a processor for us in this respect; the transfer to the USA relies on the EU standard contractual clauses under Art. 46 GDPR. The legal basis is our legitimate interest in keeping these forms open without an account while not losing them to spam (Art. 6 (1)(f) GDPR).

Services our server contacts

Some features are fetched not by your browser but by our server. Your IP address does not go out in that case, but the details the respective feature needs do. The processors from the table above (Mistral, Anthropic, OpenRouter, Stripe, PayPal, Proton) are likewise contacted by our server; they are listed there because they process on our behalf. The AI assistant for administration is not contacted by our server but by an administrator; it reads through our administration interface, and IP addresses from our logs can reach Anthropic that way (see above).

The backdrop in the garden editor: The layout editor can show an aerial image of your garden behind the drawing surfaces. Our server fetches that image from the same official service that also serves the location map; which one it is follows from the centre of your garden's map section, along the same state borders as above. What is transmitted is the map section of your garden, but not your IP address and no reference to your account. We store the image in our object storage; your browser then loads it from us, not from the service. For Switzerland the same adequacy decision applies as above. If your garden lies outside Germany, Austria and Switzerland, no request goes out, and the editor tells you so. The legal basis is Art. 6 (1)(f) GDPR.

Weather data for frost warnings and the garden journal: For the frost warning, the watering recommendation and the weather we attach to your journal entries, our server queries Open-Meteo. What is transmitted is the coordinates of your garden and the period requested, not your IP address and no reference to your account. The weather tile on the dashboard, by contrast, queries Open-Meteo directly from your browser (see above). The legal basis is Art. 6 (1)(f) GDPR.

Push notifications: If you enable notifications, your browser registers a subscription with its own push service and hands us its address. When a notification is due, our server calls that address, that is, a service run by Mozilla, Google or Apple depending on the browser. The content is encrypted for the push service (RFC 8291); it sees the address of the subscription and the time, not the text of the message. In the Android app, Firebase Cloud Messaging (Google Ireland Limited) delivers the notification; Google can read its title, short text and the link to the content in the app. We store only a technical push subscription, which you can revoke at any time in your settings.

Other recipients

Calendar subscription: If you set up a calendar subscription in your settings, you receive a secret address that you can add to a calendar app of your choice. That app's provider (for example Google, Apple or Microsoft) then fetches the address on its own, regularly, and in doing so receives the titles, descriptions, locations and times of your garden dates as well as the IP address of the fetching server. Where that server is located is up to the respective provider; with Google and Microsoft, processing outside the EU is likely. The subscription is read-only, no data flows back to us from the calendar app. You can create a new address or withdraw it entirely in your settings at any time; it stops working immediately afterwards.

Notifications in the Android app: If you turn on notifications in the Android app, Firebase Cloud Messaging by Google Ireland Limited delivers them. Google receives a technical identifier of the app on your device, the time, and the title, short text, the link to the content in the app (for example the address of a task with its identifier) and a keyword under which the app groups similar notifications. Google may also process this data outside the EU, in particular in the US; the transfer is based on the EU standard contractual clauses under Art. 46 GDPR. You can turn the notifications off at any time in your settings.

Error telemetry: We record technical errors through a self-hosted GlitchTip on our server in Germany. There is no external recipient here; no data is passed to third parties. IP addresses are not stored by default. The crash reports of the Android app go there too (Section 3, "The Android app").

8. Retention

We keep the access log files of our web servers, which contain your IP address, for no longer than 15 days. After that we delete them automatically. In the cache server in front of them we additionally truncate your IP address as it is written, dropping its last block so that only the subnet remains.

We do not combine these access log files with your account. Separately from them we record security relevant events such as sign-ins, failed sign-in attempts and permission changes. These security logs contain your IP address and, where known, the reference to your account; we need them to detect and evidence attacks (Art. 6 (1)(f) GDPR). We keep them for 90 days and delete them automatically afterwards, including events that cannot be attributed to any account. For the protective measures themselves, see section 13.

We treat the access log from section 3 ("Support access") like the security logs: we keep it for 90 days and delete it automatically afterwards, even if you delete your account before then.

Cancellation declarations submitted through the cancellation page are retained as evidence, even when they cannot be matched to a contract. § 312k (3) and (4) of the German Civil Code require us to document and confirm the receipt of a cancellation. Without that record, neither you nor we could show, in a dispute, when a cancellation was received.

Gartenbörse. 90 days after its runtime ends we hard delete the content of a listing: the description, every image and video, the provider's contact details and the exact location. What stays is the title, the postal code and town, the approximate location and the price details; otherwise the payment record would point at a nameless row. Anyone who wants those gone too deletes the listing in their account; it then falls in full. That period covers the two cases in which the listing is still needed after it ended: you publish it again, or its content is disputed. We keep a saved search from section 3 until you delete it in Settings or your account is deleted; unsubscribing from its email does not delete it. An entry on your list of saved listings goes when you remove it, when your account is deleted or when the listing is deleted in full. We keep a block until someone in the blocking garden account lifts it or that garden account is deleted; if the blocked garden account or the blocked person is deleted, the reference to them goes.

We keep the order data behind it (amount, runtime, payment reference and, with a listing voucher, the discount and where the voucher came from) as an accounting record for at least eight years; § 147 (3) of the German Fiscal Code, in the version in force since 01/01/2025, requires that. It is blocked from further use. A listing voucher that was never used is deleted twelve months after it expired, at the latest with the garden account; of a voucher that was used, the discount and its origin remain only as part of that record.

A platform enquiry from section 3 is deleted, together with all replies and the read status, 90 days after the end of the listing it went to. The clock starts at the end of the listing, not on the day of the enquiry: a message sent shortly before expiry should not outlive one sent on the first day. For the same reason, a late reply does not extend the period.

We clear the contact reveal log from section 3 in two stages. It is read for the two daily budgets only, that is over a window of 24 hours. We therefore delete your IP address from the entry after seven days; seven rather than one, so that an abuse case still under investigation can be resolved. The rest of the entry (account, channel, timestamp) is removed after 90 days in full, as is every entry belonging to a listing that gets deleted.

Swap board. There is no fixed period for listings, enquiries, connections and terms of business: they stay until they are deleted. A listing stays until the provider deletes it or their garden account is deleted. Once deleted, it disappears from the swap board at once and nobody can enquire about it any more. If it has no enquiries, we delete it completely. If it has enquiries, we keep its details for as long as there are enquiries about it, so that both sides can still retrieve their enquiries, the copy of the terms of business and the contract confirmation. Once the last enquiry is gone, we delete the listing completely as well. With the provider's garden account go the listing and all enquiries about it, including the copy. An enquiry also goes with the garden account it came from. A connection stays, even when blocked, until one of the two garden accounts is deleted. A version of the terms of business stays until the business deletes it or its garden account is deleted. As long as a listing or an enquiry refers to it, it cannot be deleted, because it is the proof of the terms under which someone enquired. Once you have confirmed the deletion of your account by email, others no longer see the listings of the garden accounts you own. If your account is deleted while an enquiry of yours sits in someone else's garden account, we remove your message, including from the copy, and the link to your account. The state and times of the enquiry and the copy of the terms of business stay there as the provider's record.

You can delete your account at any time in Settings (the "Danger" section). After you confirm by email, your account rests for 30 days; during that time you can cancel the deletion by signing in and choosing "Cancel the deletion". After that, we delete your account and your own garden accounts for good. What you entered in other people's garden accounts stays there, without your name. We instruct our payment provider Stripe to delete your customer record; payments and invoices stay there, subject to Stripe's own retention duties. What remains in our own backups after a deletion is set out in section 11.

If you don't confirm your email address after signing up, we delete the account after seven days on our own, without sending anything further to that address. Until then you can confirm the address at any time; afterwards you can sign up again with the same address.

Sign-in processes. When you sign in, sign up, confirm your email address, reset your password or change something under "Sign-in & security", our sign-in service opens a process for it. It stores the web address (URL) the process was started with, including its parameters, for example the page you return to afterwards, a campaign tag from the link you came through or a plant and a postal code for your setup, and what you entered into the form, such as your email address. If you sign in with an account at another provider (section 3), it also holds the details that provider sends us, and we keep the process for your return from the provider. A process expires after one hour at the latest; we delete it automatically seven days after it expires. The same period applies to your sign-in sessions including the IP address and browser identifier stored with them: we delete a session seven days after its expiry date (at most 30 days after you sign in, section 4), even if you signed out earlier. Deletion runs hourly, so it happens no later than one hour after the period ends.

Accounting records are retained for eight years; § 147 (3) AO and § 257 (4) of the German Commercial Code require that for records of this kind. They are blocked from further use during that time.

At the end of the eight years the two kinds of record end differently. The record of a deleted subscription account is deleted outright. For a listing order we strip the personal reference from the row instead: the account, the garden account and the pointer to the listing drop out, while the amount, the runtime and the payment reference stay. The reason for the difference is that the tax retention period can be extended for as long as a transaction may still be examined; a record that can no longer be traced to anyone can safely sit out that time.

Email suppression list: If you have objected to receiving notification emails, or if you reported one of our emails as spam, we keep your email address on a suppression list. We store only the address, the reason for the entry and where it came from, and the timestamps. That entry survives the deletion of your account, and it has no expiry date. An objection does not expire; deleting the entry automatically after a few months would silently revoke it, and we would then contact you again by mistake. The legal basis is GDPR Art. 6 (1)(f). Our legitimate interest is to honour your objection under GDPR Art. 21 (3) permanently. Entries that rest solely on an address being technically undeliverable (a bounce) are deleted together with the account. You can ask us to delete your suppression entry at any time at dpo@gartenkern.de; notification emails can reach you again afterwards.

Undeliverable emails: If an email from us does not arrive, the recipient's mail server tells us so. From that notice we store your email address and the reason for the rejection, so that we stop writing to an address that no longer accepts mail (GDPR Art. 6 (1)(f)). We delete it after 90 days; a notice we have to check by hand is deleted once we have checked it.

Newsletter. We keep the proof of consent and withdrawal (Section 3) for as long as we have to be able to produce it: Art. 7 (1) GDPR requires us to demonstrate a consent, and a withdrawal only takes lasting effect if it too stays on record. These entries are technically locked against later modification and against deletion. If you delete your account they lose their personal reference: email address, account reference, IP address and browser identifier fall away, while the fact of the consent and its timestamp remain.

Separate from that is the confirmation status itself, that is whether and when you clicked the link. It is attached directly to your account and is removed when the account is deleted. If you withdraw, we remove the confirmation and any open link straight away; what stays is the time of the last request, so that subscribing again respects the five-minute cool-down. A subscription you never confirmed leads to no mail being sent.

Individual audience-measurement records (Section 5), including those linked to your account, are deleted after 90 days, the daily random value after two days. Aggregate numbers without a personal reference are kept.

We keep the characteristics of your account (section 5) until your account is deleted and delete them with it. If you object, we delete them at once when you flip the switch, or without undue delay once we have handled your email; the note of your objection stays until your account is deleted. The same applies to your answer to the why question: it stays until your account is deleted and goes at once with your objection.

Campaigns. We delete the list of who received a campaign and who was in the comparison group (section 3) 24 months after the campaign ends; aggregated figures without reference to a person remain. Your entry is removed immediately with your account. The same applies to selected notices in the app: we delete the list of whom we showed a notice and who was in the comparison group 24 months after it ends.

We keep support requests for three years from the day we closed the case; after that we delete it along with its messages and your sender address. If the request concerns a commercial transaction, such as an invoice or a cancellation, the six-year retention period under § 257 (1) no. 2 and (4) of the German Commercial Code applies instead; that period starts at the end of the calendar year. When you write to us by email, technical delivery data such as the address of the sending mail server is created as well. We delete that after 90 days, regardless of how long the case itself remains open. Images you attach to a request are stored in the same place and for the same period as the request itself. We remove the EXIF data before storing them and check them against already blocked content using a technical fingerprint.

For anonymously submitted corrections, funding enquiries and contact requests, we delete your IP address from the case after 30 days; the rest of its content remains until the retention period above ends.

9. No automated decision-making

The characteristics from section 5 are profiling. We also use them to choose whom we show or send a hint or offer (section 3). We make no automated decision from them that has legal effect on you or similarly significantly affects you (Art. 22 GDPR): features, your access and regular prices don't depend on them. The platform's AI features (plant recognition, chat, summaries) produce suggestions, not legally binding decisions about you.

If you receive a promo code this way, your price is personalised as a result. We tell you so before you pay (Art. 246a § 1(1) no. 6 EGBGB). You can always choose the regular price.

10. Your rights (GDPR Art. 15 to 22)

You have the right at any time to:

• Access (Art. 15) to what we store about you: your content as a data export in Settings, the full information on request at dpo@gartenkern.de. On request this includes when, and for what reason, someone on our team, or the AI assistant on their behalf, accessed your data. Because we delete the access log after 90 days, this information covers the last 90 days.
• Rectification (Art. 16), directly in your account profile
• Erasure (Art. 17, "right to be forgotten"), in Settings under "Danger", or on request at dpo@gartenkern.de
• Restriction of processing (Art. 18), on request by email
• Data portability (Art. 20), as a data export in Settings, in a structured, commonly used format
• Object (Art. 21) to processing based on Art. 6 (1)(f) GDPR
• Lodge a complaint with a supervisory authority (Art. 77)

Send these requests and any other data protection questions to dpo@gartenkern.de. We respond without undue delay and at the latest within one month. Where a request is particularly complex, that period may be extended by up to two further months; we will tell you within the first month if that happens (GDPR Art. 12 (3)).

The supervisory authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59 to 61, 10555 Berlin, Germany
https://www.datenschutz-berlin.de/

You may also contact the supervisory authority of your habitual residence.

11. Backups and deletion periods

We back up the service's data every night, including the database holding your account and the images and videos you upload. The backups are stored encrypted with Hetzner Online GmbH in Germany (section 7). Only we hold the key; Hetzner cannot read the backups.

We need the backups to be able to restore the service after a technical failure or a loss of data (Art. 32 (1)(c) GDPR). The legal basis is our legitimate interest in being able to restore it (Art. 6 (1)(f) GDPR).

Retention. We keep the backups of the last 7 days, plus one from each of the last 4 weeks and one from each of the last 12 months. Older ones are deleted automatically, and once a month we clear out whatever remains of them in storage; data from a backup is kept for up to 13 months, no longer. We keep the monthly ones because some damage to data only shows after weeks, and then only an older state helps.

Deleted data. Whatever we delete, whether at your request or because a period from section 8 has expired, is not contained in any later backup. It remains in the earlier ones until they are deleted automatically and completely after 13 months at the latest.

Restoring. If we have to restore the service from a backup, we first delete again every account that was deleted after that backup was taken, and everything deleted since then at your request under Art. 17 GDPR (section 10). Only then does the service resume operation. Individual items you deleted yourself since then, such as a photo, may reappear; please delete them again. Periods from section 8 that have expired in the meantime are enforced again by the service itself once it is running.

12. Minimum age

The platform is open to persons aged 16 and over (Art. 8 GDPR). Anyone younger may use the service only with the consent of a legal guardian.

13. Security (GDPR Art. 32)

We take technical and organisational measures that reflect the state of the art: encrypted transport for all connections, passwords stored only as a secure hash and never in plain text, EXIF stripping on image uploads, strict separation between the data of different garden accounts, and a permission check on every access.

We do not list the individual mechanisms here. They evolve with the state of the art, and publishing them would make an attacker's work easier. We provide information on reasoned request.

14. Data breach notification

In the event of a personal data breach we notify the competent supervisory authority within 72 hours of becoming aware of it (GDPR Art. 33). Where the breach is likely to result in a high risk to your rights and freedoms, we also notify you without undue delay (GDPR Art. 34).