1. Who We Are
Sagely Sprout ("we," "our," or "us") is an AI-powered garden planning service operated from Arizona, United States. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and application at sagelysprout.com.
By using Sagely Sprout, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our service.
2. Information We Collect
Account Information: When you create an account, we collect your email address and a password (stored as a secure hash — we never see your raw password).
Garden Data: We store the garden plans, plant selections, notes, events, seed inventories, yard layouts, and other content you create within the app. This data is tied to your account.
Usage Data: We may collect information about how you use the app, including features accessed, AI features used, and session duration. This helps us improve the product.
Guest Data: If you use the app as a guest (without an account), your garden data is stored only in your browser's local storage and is not transmitted to our servers — with one exception: if you enable push reminders as a guest, an anonymous push subscription and a log of the reminders sent to it are stored on our servers so we can deliver them. Guest data persists across browser sessions on the same device until you clear your browser data or create an account.
3. How We Use Your Information
- To provide, maintain, and improve the Sagely Sprout service
- To generate AI-powered garden plans and recommendations using your location and preferences
- To send transactional emails (account confirmation, password reset) — we do not send marketing emails without your explicit consent
- To process subscription payments (via our payment processor)
- To enforce our Terms of Service and protect against abuse
- To analyze aggregate usage patterns to improve features (no individual tracking)
Regional Growing Insights (optional). If you opt in, we pool your logged growing outcomes — the crop, variety, planting and harvest dates, the result (yield band or failure type), your USDA zone, and a coarse region derived from the first three digits of your ZIP code — with those of other participating gardeners to produce anonymized regional insights, such as variety leaderboards and planting-timing comparisons. These insights never include your name, email address, photos, journal notes, or precise location, and we only publish a regional insight when at least 30 outcomes exist for that region and crop, so no individual garden is identifiable. Sharing is off by default and requires an account. You can turn it off at any time in Settings; doing so permanently deletes your previously shared outcomes from the regional pool. Deleting your account does the same automatically.
4. Third-Party Services
We use the following third-party services to operate Sagely Sprout. By using our service, you acknowledge that your data may be processed by these providers in accordance with their own privacy policies:
Supabase (Database & Authentication): If you create an account, your account information and garden data are stored in Supabase's PostgreSQL database, hosted on AWS infrastructure. Supabase is SOC 2 Type 2 compliant. Guest users' data is never sent to Supabase. Learn more at supabase.com/privacy.
Google Gemini AI: When you use AI-powered features (plan generation, pest diagnosis, harvest recipes, etc.), your garden preferences and inputs are sent to Google's Gemini API to generate responses. We do not send your email or account details to Google. Google may retain submitted data per their API terms. Learn more at ai.google.dev/terms.
Vercel (Hosting): Our application is hosted on Vercel's infrastructure. Vercel may log standard server access data (IP address, browser type, request timestamps). Learn more at vercel.com/legal/privacy-policy.
Analytics (optional, consent-gated): Only if you accept the analytics cookie banner, anonymous usage measurement runs via Google Analytics, PostHog, and our own first-party measurement (which sends named product events like "plan generated" or "harvest logged" to our own servers under a random device identifier). All are off by default and off when you decline, and none ever receive your email, account details, or your saved gardens, layouts, or journal entries (events carry only coarse facts, like the name of a plant you logged a harvest for). We also note how you first arrived (for example, a search engine or a link) in your browser's local storage when you land; that note leaves your device only as part of consented analytics events, never otherwise. Controls and details are in our Cookie Policy.
PostHog (optional, consent-gated): Our product-analytics processor. Only if you accept the analytics banner, PostHog receives the same anonymous, named product events as our first-party measurement, under the same random device identifier. It runs cookielessly (browser local storage only), stores data in its US cloud, and never receives your email, account details, or garden contents. Declining or revoking consent stops it entirely and clears its identifiers (a single opt-out marker remains so it stays off). Learn more at posthog.com/privacy.
Crash reporting (Sentry): When something in the app breaks, we send a technical crash report to Sentry (our error-monitoring processor) so we can fix it. These reports are collected under legitimate interest, are aggressively scrubbed before leaving your browser — no email, no account identifier, no message content — and Sentry is configured not to store IP addresses. They contain the technical state of the app at the moment of the error and nothing else.
We do not sell your data to any third party. We do not use advertising networks or behavioral tracking.
5. Data Storage & Security
Your data is stored in a secure PostgreSQL database with Row Level Security (RLS) enforced — this means database-level policies prevent any user from accessing another user's data, even in the event of an application bug.
All data is transmitted over HTTPS. Passwords are never stored in plain text. Authentication tokens are stored in your browser's local storage and expire automatically.
While we take reasonable security measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.
6. Data Retention
We retain your account data and garden plans for as long as your account is active. If you delete your account yourself from Settings → Account & privacy, your personal data is deleted immediately, in the same operation. If you instead request deletion by emailing us, we will complete it within 30 days. In either case, the exceptions in "Your Rights" below apply: payment records our payment processor must retain by law, and anonymous usage counters with no account link.
Guest data stored in local storage remains only on your device until you clear your browser data or sign up for an account. The only guest data on our servers is the anonymous push subscription and its send log if you enabled reminders — "Delete my data from this device" in Settings removes both.
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
Export: Download your garden and activity data — gardens, journal entries, harvest history, seed bank, badges, and notification preferences — as a single JSON file, any time, from Settings → Account & privacy. Works for guest data on your device too. Your account profile and billing records are not part of the file: deleting your account removes them, and you can email us for a copy at any time.
Deletion: Delete your account from the same place. Deletion is immediate and permanent: your gardens, journal, photos, badges, notification settings, push subscriptions, and login are all purged in the same operation, and any active subscription is cancelled immediately with no further charges.
What deletion cannot remove: Stripe retains payment records as required by financial-records law — we cannot delete those. Anonymous usage counters (which carry no account link and only irreversibly hashed network identifiers) are retained for capacity planning.
Guest data lives in your browser and never on our servers (except an anonymous push subscription and its send log if you enabled reminders); "Delete my data from this device" in Settings removes all of it, including that subscription and its log.
The planting-calendar email list is separate from app accounts: subscribing there does not create an account, deleting your account does not unsubscribe you there, and every calendar email carries its own one-click unsubscribe.
To exercise any of these rights, contact us at privacy@sagelysprout.com. We will respond within 30 days.
California Residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.
EEA/UK Residents (GDPR): Our legal bases for processing are: performance of a contract, for the core gardening service you signed up for; your consent, for the optional analytics described in our Cookie Policy; and legitimate interest, for the aggressively-scrubbed crash reports described above. You have the right to lodge a complaint with your local data protection authority.
8. Children's Privacy
Sagely Sprout is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date and, where appropriate, by sending an email notification. Your continued use of the service after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have questions about this Privacy Policy or how we handle your data, please contact us at:
Email: privacy@sagelysprout.com
Mailing Address: Sagely Sprout, Arizona, United States