Privacy Policy

aimanac (“the app”, “we”) is a garden-planning assistant operated by Dariusz Gugała (two71), ul. Maszynistów 19, 55-003 Wrocław, Poland (Tax ID / NIP: 8961368047). We are the controller of your personal data. You can reach us at admin@aimanac.garden.

For paid subscriptions, Paddle.com Market Ltd acts as our Merchant of Record and payment reseller and is an independent controller for the payment and tax data it handles (see “Who we share it with” and “Payments”).

Account: your email address, a securely hashed password, and an optional display name.

Sign-in provider (optional): if you sign in with Google or Facebook, we receive your email address, name and the provider's user ID to create and identify your account.

Your garden: the beds, plantings, seasons, tasks, harvest journal, wishlist and favourites you create in the app.

Location (optional): if you set your garden's location on the map, we store its coordinates and time zone. This drives weather, frost warnings and sowing windows. You can change or clear it any time in Settings.

Photos (optional): if you use photo diagnosis, the image you take is uploaded so it can be analysed, and the result is saved to your journal.

Assistant chats (optional): messages you send to the in-app assistant, so it can answer and keep your conversation.

Notifications (optional): if you turn on morning reminders, your browser's push subscription (an endpoint URL and encryption keys) so we can deliver them.

Subscription & billing: if you buy a paid plan, Paddle processes the payment and gives us a customer and subscription record — your email, country, the plan, billing status, renewal date and transaction identifiers, and for the invoice the card brand and last four digits. We never receive or store your full card number.

Technical: a session cookie to keep you signed in, plus basic server logs (IP address, timestamps) needed to run and secure the service.

To run your account and show your garden.

To generate your daily brief, tasks, companion suggestions, frost/weather warnings and photo diagnoses.

To provide, bill and renew paid subscriptions, and to send account emails (verification, password reset, receipts, renewal and cancellation notices).

To send the morning reminders you opted into.

To keep the service secure and diagnose problems.

We process your data on these GDPR bases:

Performance of a contract (Art. 6(1)(b)) — running your account and providing the free and paid service, including billing and renewals.

Consent (Art. 6(1)(a)) — optional processing you switch on: garden location, push reminders, and (where you opt in) marketing emails. You can withdraw consent at any time. The paid AI features (chat, brief, diagnosis) run on the contract basis above, not on consent.

Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, and basic privacy-respecting analytics.

Legal obligation (Art. 6(1)(c)) — keeping invoices and tax records for the period required by law.

We use a small number of processors and partners to make features work, and share only what each needs:

Payments (Paddle.com Market Ltd) — our Merchant of Record. Paddle runs the checkout, takes payment, issues your invoice and handles tax. Paddle is an independent controller for that data; see Paddle's privacy policy.

Sign-in providers (Google, Facebook) — only if you choose social sign-in; they confirm your identity to us.

Email provider (Resend) — sends account emails such as verification, password reset, receipts and reminders.

AI provider (e.g. Anthropic or OpenAI) — receives your brief/diagnosis/chat prompts to generate a response.

Weather (Open-Meteo) — receives your coordinates to return a forecast.

Map imagery (e.g. Mapbox) — used to show the satellite backdrop when you draw your garden.

Plant-identification API — only if photo diagnosis with a specialist provider is enabled; receives the photo.

Push delivery (your browser's push service, e.g. Google/Mozilla) — delivers notifications.

Hosting — the app runs on rented servers (Hetzner, EU). We do not sell your data or use it for advertising.

Some processors (for example the AI provider and, potentially, the email provider) are located outside the European Economic Area, including in the United States. Where data leaves the EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses to protect it. Contact us for details.

We use a single essential cookie (an HttpOnly session cookie) to keep you logged in. We do not use advertising or third-party tracking cookies. When you open the Paddle checkout or sign in with Google/Facebook, those providers may set their own cookies as part of that flow.

We keep your account data while your account is active. Delete a planting, photo or the whole account and the associated data is removed. We keep invoices and other records required by tax law for the statutory period (in Poland, generally five years). Server logs are kept only as long as needed for security and operations.

Under the GDPR you can access, correct, export or delete your data, and object to or restrict certain processing, and withdraw consent at any time. Much of this you can do in-app (Settings → export / delete); for anything else, contact us at admin@aimanac.garden and we'll help. You may also complain to your data-protection authority (in Poland: UODO).

Passwords are hashed (never stored in plain text), traffic is served over HTTPS, and each account's data is isolated from every other account. No system is perfectly secure, but we take reasonable measures to protect your data.

The app isn't directed at children under 16, and we don't knowingly collect their data.

We'll update this page when the app changes and revise the date above. Significant changes will be highlighted in the app.

Questions or requests: admin@aimanac.garden.