Your garden is personal.

Last updated: September 5, 2026

Who is responsible

The Lorekeeper's Leaf is a family-run product based in the United States. This policy covers the public website, Web Companion, Android app, account and Family Garden services, plant-identification tools, and Lorekeeper's Assistant. Privacy, access, correction, and deletion requests can be sent to lorekeepersleaf@gmail.com.

Information we handle

What we handle depends on the features you use. It can include:

• account and profile details, such as an email address, account identifier, sign-in provider, household role, and family invitations;
• plant names, locations, care schedules and events, journal entries, photos, health notes, propagations, lineage, reminders, and Plant Passports;
• device or browser preferences, app and sync versions, bounded request counters, and limited security, error, and reliability information; and
• messages and files you intentionally send when asking for support.

Where information comes from

Most information comes directly from you when you create an account, add a plant, upload a file or photo, record care, request plant identification or health guidance, use Lorekeeper's Assistant, join a Family Garden, or contact support. We also receive account and calendar information from a connected provider when you choose that connection, and shared records from other members of a garden you join.

Why we use it

We use information to authenticate accounts; save, synchronize, recover, import, and export records; provide reminders, Family Garden sharing, and plant guidance; answer support requests; prevent abuse; keep the service reliable; and meet legal obligations. Depending on where you live, the legal basis may be performing our agreement with you, your consent, our legitimate interests in operating and securing the service, or a legal requirement. You may withdraw consent for an optional feature, although the feature may then stop working.

Payments and membership status

The website does not collect payment-card details. If you choose The Botanist, Google Play processes the purchase and manages the checkout experience. We use the limited purchase and entitlement information needed to verify which membership features should be available, such as the membership tier, verification result, and access period. We do not use membership information to build advertising profiles.

Google Play controls the payment method, localized price, purchase receipt, cancellation, and restore flow. Cancel a future renewal through Google Play. Deleting your Lorekeeper's Leaf account removes the account and garden data covered by a verified deletion request; it does not automatically cancel a Google Play membership.

Photos, camera, microphone, files, and calendar

The app or browser asks for an action or permission before using the camera, photo library, microphone, files, or calendar. A plant photo is stored with a garden record only when you choose to add or save it. Speech-to-text may be handled by the device or platform that supplies it. Calendar information is shared with a calendar provider only when you choose a calendar action or connection. A local-only garden can remain on the device or browser until you choose account sync or family sharing.

AI features and OpenAI

When you intentionally request plant identification or health guidance, or use Lorekeeper's Assistant, the text, images, and relevant garden context needed for that request are sent to OpenAI. The provider key stays on the server, and the service applies authentication, file checks, bounded request controls, and rate limits. Requests are sent with store: false, which tells the API not to retain the response as application state. OpenAI may still process or temporarily retain limited request data for security and abuse prevention under its API data controls. A result may become part of a plant or health record when you choose to save it. Results are suggestions with uncertainty, not diagnoses.

Service providers and storage locations

We use a small set of providers to run the product:

• Supabase provides authentication and account-backed or shared-garden services, including database, realtime, storage, and server functions used by those features.
• Cloudflare and Sites infrastructure deliver and protect the website and Web Companion. Cloudflare D1 stores compatible Web Companion garden and service state, and Cloudflare R2 stores web-uploaded media. Access controls separate accounts and shared gardens.
• OpenAI processes an AI feature request, including plant identification, health guidance, or Lorekeeper's Assistant, only when you choose that feature.
• Google processes information when you choose Google sign-in or a Google Calendar connection or action.

Providers process information under their own service and privacy terms and may use subprocessors.

Browser storage, cookies, and sessions

The Web Companion uses browser local storage or session storage for the garden cache, unsynced work, appearance, recent views, family-sync configuration, household-role cache, and whether sign-in should be remembered. It uses necessary, protected cookies to keep an account session, a pending family invitation, or a shared-media session working. These tools are functional rather than advertising cookies. Clearing them can sign you out, cancel a pending invitation handoff, or remove device-only or not-yet-synchronized work, so export important local records first.

Family sharing and public records

People with access to the same Family Garden can see records allowed by their role. Anyone who receives a working invitation may be able to request access, so protect it and revoke or replace access when needed.

A Plant Passport becomes public only when you deliberately publish it. Public output is designed to exclude private locations, private notes, household members, and photos that were not approved for publishing. Review a passport before sharing its link. We may also disclose limited information when required by law, to protect people or the service, or as part of an organizational transfer subject to appropriate safeguards.

How long information is kept

Account and garden records are kept while needed to provide an active account, local garden, Family Garden, or feature you use. A protected pending-invitation handoff expires after no more than 30 days and may end sooner when it is accepted, canceled, revoked, expired, or already used. Device-only and browser-cached records remain until you remove them, clear the app or browser data, or replace them with a synchronized copy.

Lorekeeper's Assistant does not provide a separate saved conversation history. When you prepare a record change, we keep the pending action details needed to confirm and complete it safely. Action receipts are retained to prevent duplicate changes, support retries and Undo, and record the outcome. Changes you confirm become part of your garden records. Provider handling follows the API data controls described above.

After a verified deletion request, we remove the requested data from active connected systems and allow routine backup copies to expire, unless a limited record must be retained for security, fraud prevention, a dispute, or law. Provider logs and backups may not disappear immediately. We keep such exceptions only for the reason and time that require them. An export or a copy shared with another person remains under that recipient's control.

Security

We use encrypted connections, authentication, household-role checks, server-side provider credentials, private media controls, database access policies, request limits, and audit or reliability records appropriate to the feature. No internet service can promise absolute security. Protect your password and invitation links, keep devices updated, and tell us promptly if you suspect unauthorized access.

Your choices and rights

You can correct garden records, export a garden, remove or leave household access, limit optional device permissions, sign out, and request account deletion. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to appeal a denied privacy request. We may need to verify your identity and the requested garden or account before acting.

International processing and children

Our providers may process information in the United States and other countries using their contractual and legal safeguards. The product is not directed to children under 13. A parent or guardian should manage any household account used by a younger family member and should not ask a child to submit sensitive information.

Changes and contact

We may update this policy when the product or its providers change. We will update the date above and give reasonable notice of a material change through the service, website, or account email when practical. Questions, privacy requests, and security reports can be sent to lorekeepersleaf@gmail.com.