Privacy Policy

Loamhand is a garden planner. To plan a garden we need to know a little about you and a lot about your plants. This page says what we collect, which outside services receive any of it, how long we keep it, and what you can do about it. It is written from what the code actually does, service by service.

Who is responsible

Loamhand LLC, 418 Broadway, Suite 10974, Albany NY 12207, is the controller of the personal data this policy describes, and where notices to us by post should go.

What we collect

Everything below is stored because a feature needs it.

• Email address — to sign you in, verify the account, reset your password, and deliver garden invites and membership changes.
• Password hash — a salted Argon2id hash of your password, never the password itself.
• Display name and region label, if you set them — shown to the people you share gardens with instead of your email address.
• Your gardens — names, plots (bed type, dimensions, soil type), plantings, care logs, harvests, measurements, soil tests, notes, reminders you write, and your own plants if you add any.
• A garden's location — the coordinates of the place you search for, pin, or share, and the place name you choose. Location is how weather, hardiness zones and frost dates work. It can be as precise as your garden or as rough as a town; you choose.
• Your device's location, only when you ask. During setup, "Use my location" asks your browser for your current position once. If you allow it, those coordinates become the garden's location. We do not track your location, and nothing asks for it again unless you press the button.
• Photos you upload, with their captions, size and the date you give — see "Photos" below.
• Sensor readings, only if you connect sensors — what each one measured and when, with the connection, devices and channels behind them. See "Sensors" below.
• Membership records — which accounts belong to which gardens, with what role, who tends which bed, and the invites between them. An invite stores the address it was sent to.
• Your IP address — used for rate limiting on sign-in, sign-up and a few public forms, and written to server logs. It is not joined to your gardening data.
• Notification subscriptions, only if you turn notifications on — for each device, the push subscription its browser gives us (an address at the browser's push service and the keys that encrypt messages to it) and a label such as "Chrome on Android"; which alerts you want and your quiet hours, with the time zone they use; and a record of each notification we send, kept for 30 days.
• Acceptance of the Terms — the date you agreed to them and confirmed you are 13 or older.
• Your books, only if you turn on "I sell what I grow" — what you sold, on what date, for how much in the currency you chose, in what quantity and unit, which crop or bed it came from, and any note you add; and the costs you record, with their date, category, description, amount, note, and how you split each one between beds. You also name the outlets you sell through — a market, a farm stand, a shop — and choose a kind for each. An outlet's name is free text you type: we suggest nothing and look nothing up, so whatever you write there is stored exactly as you wrote it. We never ask who bought anything. There is no customer record, no buyer name, no address, no invoice and no payment information anywhere in Loamhand; we handle no money and see none of yours. Your books are yours alone — no other member of a garden you share can see them, whatever their role.

We do not collect your contacts, device identifiers, or anything from other apps, and we use no advertising trackers or third-party cookies. A US ZIP code you type to look up a hardiness zone is used for that lookup and not stored.

Who else receives it

Some features need an outside service. Each receives only what that feature needs, and no account information goes with any request. Location lookups, forecasts and email are requested by our server, so those services see our server's address, not yours; the analytics script, if enabled, runs in your browser.

• OpenStreetMap Nominatim (nominatim.openstreetmap.org) receives the place text you type when you search for a location (for example "Somerville, MA"). It also receives a garden's coordinates when we look up the postcode for its hardiness zone — the zone itself then comes from our own copy of USDA reference data, not a live lookup elsewhere. Results are © OpenStreetMap contributors.
• USGS Elevation Point Query Service (epqs.nationalmap.gov, a US government service) receives a garden's coordinates, when a US climate station is within reach, to find its elevation; that helps choose the station its frost dates come from.
• NOAA National Weather Service (api.weather.gov, a US government service) receives the coordinates of gardens inside its coverage area (the US, its territories and places close to them) to fetch a forecast.
• MET Norway (api.met.no, the Norwegian Meteorological Institute) receives the coordinates of gardens outside NOAA's coverage, rounded to four decimal places (about 11 metres), to fetch a forecast.
• Resend (api.resend.com) delivers our email: verification, password reset, garden invites, membership changes, the alerts and reminders you have turned on, and notices about your own account — that your password was changed, or that somebody asked to move your account to a different address. When you ask to change your address, the confirmation link goes to the new address and a notice goes to the old one; the notice names the new address only in part ("a***@example.com"). It sees the recipient address and the message. Resend also tells us back what happened to a message: that it bounced (the address does not exist, or the receiving server refused it) or that you marked it as spam. A permanent bounce puts the address on a list we do not send to again, and we record against your account that mail was stopped and why — never the address itself, which is already on the account. Marking a message as spam switches off everything you did not ask for, and leaves the address alone so a password reset can still reach you. A suppressed address is removed when your account is erased; one belonging to no account is deleted after a year.
• Web push services, only if you turn notifications on. Notifications travel through the push service of the company that makes your browser: Google (fcm.googleapis.com) for Chrome and most other browsers built on it, Apple (web.push.apple.com) for Safari and for Loamhand on an iPhone or iPad, Mozilla (updates.push.services.mozilla.com) for Firefox, and Microsoft (notify.windows.com) for Edge on Windows. Each message is encrypted end to end, so the service cannot read it: it sees only that a message went to a device, when, and how large it was. Your device decrypts it, and what it shows — your garden's name, for example — can appear on the lock screen. We store each device's push subscription and a label, and keep delivery records for 30 days. A device's subscription is removed when you turn notifications off, sign out on that device, or delete your account.
• Fly.io hosts the application, in the US.
• Cloudflare (cloudflare.com; its privacy policy) is the request proxy in front of the site and the API: a content delivery network and firewall that every request to Loamhand passes through. It sees what any web server sees — your network address, the page or API address requested, and your browser's normal request details — and the content of the request, because it decrypts and re-encrypts the connection on the way to our server. It filters abusive traffic and caches public files such as the site's scripts and images; it is not given your account. Our server reads the connecting address Cloudflare reports, for the rate limits described above. This is separate from Cloudflare R2 and Cloudflare Turnstile below.
• Porkbun (porkbun.com; its privacy policy) is where the loamhand.com domain is registered and where our mailboxes live. Mail you send to us — to support@, privacy@, legal@, security@ or [email protected] — is received there, and holds whatever you write: your address, your message and any attachment. It is not used to send you the app's own email, which goes through Resend above.
• Crunchy Bridge hosts the database — a managed PostgreSQL service — and so holds everything you record here. Backups are the provider's own.
• Cloudflare R2 will store the image files of photos you upload, in a private bucket. Nobody can reach a file directly: every photo is fetched through our server, which checks you are a member of its garden.
• Cloudflare Turnstile (challenges.cloudflare.com), only when sign-ups or password-reset requests are under pressure — more of them in an hour than real people send. Then, and only then, the sign-up or reset form loads Cloudflare's browser check, which decides whether the request comes from a browser or a script, usually without showing anything. Cloudflare receives the request's network address and what its check sees of the browser, never your email address, your password or anything about your account; our server sends it only the check's result token to verify. On a quiet day the form loads nothing from Cloudflare at all.
• Plausible Analytics (plausible.io), only if a deployment turns it on. It is cookieless and counts page views and a few product events such as "created a garden". It receives the address of the page you visited and your browser's normal request details, never your email, your garden's contents, or a cross-site identifier.
• Sentry (error reports), only if a deployment turns it on. When the server fails unexpectedly, or the app crashes in your browser, a report goes to Sentry with the error message and stack trace, the kind of page or request it happened on (a route such as "invites/[token]", never the address with its codes), the status, and, from the browser, your browser's user agent. Reports never include request bodies, cookies, your email, your photos or your garden's contents.

No one else. There are no data brokers, no ad networks, and no "partners".

Email you did not ask for

Every message that is not an answer to something you just did — the morning digest, a garden's notices, frost and heat alerts — carries a one-click unsubscribe. Your mail program may show its own "unsubscribe" button beside the sender; pressing it stops all of them at once. The message also carries two links: one that does the same thing, and one that opens a page where you choose which of them you want. Neither needs you to sign in — the link itself is what identifies the account.

Messages you ask for are never switched off this way, because each is the answer to something you did: confirming your address, resetting your password, changing the address on your account, a notice that your password changed, an invitation to a garden, or a change to your standing in one. Every message we send, including those, ends with our postal address.

An invitation is the one exception, because its recipient may hold no account at all and so has no settings to change it from. Every invitation carries its own "Don't want invitations from Loamhand? Stop them" link. It stops invitations to that address only — a password reset or a security notice still reaches it — and, like the others, needs no sign-in.

Photos

Before a photo leaves your device, the app shrinks it and saves it again as a new image. That strips its EXIF data, including any GPS position your camera recorded. The files are stored privately and shown only to members of the garden they belong to. When you delete a photo, or a garden is retired, the files stay in storage for 30 days in case it was a mistake; after that they are deleted. A short record that the photo existed — its date, size and caption — stays with the garden's history.

Sensors

If your plan includes sensors (Personal, or a garden on the Community plan) you can connect soil probes, weather stations and similar devices, most often through Home Assistant. Nothing here applies until you do.

• What is stored. For each device you connect: its name, model and manufacturer, and the identifier its maker gave it; for each thing it measures (a "channel"): what it measures, the unit, its name, any calibration or thresholds you set, and where you placed it; and for each reading: the value, the moment it was taken, and whether it looked implausible (kept, and marked). We store nothing about your network, your home or your other devices.
• How long. Raw readings are kept for 13 months and then deleted. From each day's readings we also keep a daily summary (lowest, highest and average value, and how many readings) for each channel, and we keep the summaries for as long as your account exists, so this June can be compared with last June.
• Who sees readings. Readings follow the bed. A sensor you place on a bed is seen by the people who can see that bed's records (its gardeners and helpers, and the garden's stewards), and a sensor you place on the whole garden by the garden's members. A sensor not yet placed anywhere is visible only to the person who connected it and to the garden's stewards. Other members of a shared garden never see readings from beds they have no part in.
• Device tokens. Connecting a device gives it a token. We store only a hash of it, never the token, so neither we nor a copy of our database can recover it, and the pairing code you use once to connect it is stored the same way and works for ten minutes. Revoking a connection in the garden's sensor settings disconnects that device at once; it cannot send anything more.
• Home Assistant. Home Assistant runs on your own hardware, under your control. It is not a service of ours and not one that receives your data from us: it pushes readings to us, and we never ask for, receive or store your Home Assistant address, login or access tokens. We never reach into it, and it sends only the readings you choose. The software that does the pushing is code you install on your own system, not a service we run. Nothing you connect is shared with any other company.
• Your rights. Your readings, daily summaries, devices and channels are in your export (a connection's token is never in it, since we do not hold it). Deleting your account deletes them with it, along with your connections, so the tokens stop working (see "How long we keep it").
• Your plan. Sensors come with the Personal plan, or with a garden on the Community plan. If you lose it, we stop accepting new readings and keep everything you already have: it stays visible and exportable, and nothing is deleted. Regaining it resumes where you left off.

The waitlist

You can join a waitlist from the home page, or from a stop the free plan puts in front of you when there is nothing larger to buy yet. Either way we store your email address, where you signed up and when. We use it only to write to you about the thing you joined for — wider zone and guidance coverage from the home page, a plan to move to from a plan stop — and we have not sent any waitlist email yet. To be removed, email [email protected] and we will delete it.

We never sell your data

This is one of the product's founding rules, not a marketing line. We will not sell, rent, or trade your personal information or your garden records to anyone, ever. If the company is ever acquired, this policy travels with your data and you will be told before anything changes.

How we use it

• To run the product: schedules, weather, reminders, shared gardens.
• To keep it working and secure: logs, rate limiting, abuse prevention.
• To email you about your account or gardens. We do not send marketing email without asking first.
• In aggregate, to understand which features get used. Aggregate means counts, never individuals.

How long we keep it

Your garden data is kept for as long as your account exists, because history across seasons is the point of the product. Loamhand records changes as an append-only history, so a correction adds a new entry rather than erasing the old one; that history is yours and is included in your export. New history entries record that a garden's location was set, not its coordinates, and an invite entry does not record the address it was sent to.

Account deletion. When you delete your account we immediately sign you out and stop all email. You leave every garden: the beds you tended and any helper access you had are released. Gardens where you were the only member are retired, not removed: they stop generating tasks and weather requests, and their records are kept. Your account stays recoverable for 30 days in case you change your mind or the request was not you: sign in again and you can restore it, with the gardens it retired and your places in other gardens. Beds you tended in shared gardens and helper access are not given back, and invites you had sent stay cancelled. We email you when an account is restored.

After 30 days the account is anonymised:

• your email address and password hash are replaced, and your display name and region label are deleted;
• your email address is removed from the history wherever it appears, and from invites you accepted;
• the coordinates and place name of any garden only you ever belonged to are removed, from the garden and its history;
• what was yours alone is deleted outright rather than kept: your books — every sale, cost and outlet — along with your sensor connections, devices and readings (the tokens stop working), your notification settings and devices, the reactions you left, the catalogue corrections you sent us, any add-ons on your account, and your address if it is on the waitlist. Deleting your books means deleting them: we keep no copy and cannot return them to you, so export first if you need them for your tax records (Terms §6);
• photo files in your retired gardens are deleted from storage (see "Photos").

What stays is the history itself: what was planted, cared for and harvested, notes and photo captions, and when. In gardens you shared, your entries stay with the garden so the other members' history is not destroyed by your departure, and they are shown as "Deleted account". Each entry still points at your old account's identifier, which no longer leads to anything about you.

Server logs, including IP addresses, are kept for no more than 30 days.

Your rights

• Export — download everything tied to your account as a JSON file from Settings, at any time, on any tier. It contains your account details; each garden you belong to with its plots, soil tests, plantings, care logs, harvests, measurements, photo details (not the image files themselves), tasks and history; every change you made; invites you sent; your membership history; your own plants; the reminders and repeat sowings you set up; the beds you tend and helper access you hold; the weather alerts you acknowledged; the garden journal and the reactions you left on it; the notifications queued for you; the catalogue corrections you reported; any add-ons on your account; the sensors you connected, with their readings and daily summaries; and your books, if you keep them — every sale, cost and outlet, with each cost's split between beds. Other members appear by display name and role only, never by email address.
• Delete — delete your account from Settings. No emails to support, no retention offers.
• Correct — change your data in the app. Because history is append-only you will see both the old and the new value; that is by design.
• Ask — email [email protected] with any question or request about your data. A person will answer.

Children

Loamhand is for people aged 13 and over. We do not knowingly collect information from anyone younger. If you believe a child under 13 has an account, email us and we will remove it.

Where this applies

Loamhand can be used from anywhere. The application is hosted in the US. This draft was written for US law and has not yet been reviewed for the protections of other regions (such as the GDPR in Europe or the Privacy Act in New Zealand); until it has, what it says above is what we do, and we will spell out regional rights here before we say we meet them.

Security

Passwords are hashed with Argon2id. Traffic is encrypted with TLS. Session tokens can be revoked everywhere at once from Settings. If we discover a breach affecting your data we will tell you promptly and plainly.

Found a security problem? Email [email protected]. We answer within a week, fix what you found, and do not pursue anyone who reports in good faith; the details are in security.txt.

Changes to this policy

When this policy changes in a way that matters, we will email account holders and show the date at the top of this page. Continuing to use Loamhand after the change means you accept the updated policy; if you do not, you can export and delete your account.

Earlier versions of this policy are kept, each with the date it took effect. Ask and we will send you the one that applied to you.

Questions: [email protected]. See also the Terms of Service.