Legal

Privacy notice

This explains what Plot collects, why it is allowed to, who else touches it, how long it is kept and how to make it go away. It describes what the software actually does, not what a template says it might.

Last updated: 25 September 2026. Version: 1.7.

Data controller: Edward Harden, a sole trader trading as Plot.
Postal address: 61 Albert Bridge Road, London SW11 4QA, United Kingdom
Contact for anything on this page: hello@plotapp.uk
ICO registration number: ZB052852
Terms of service: the rest of the agreement

Plot is a one-person business and is not required to appoint a Data Protection Officer. Questions go to the address above and are answered by the person who wrote the software.

1. The short version

Plot works out when to sow, plant and prune where you live. To do that without an account it needs nothing from you at all — not even a postcode, if you would rather just browse. If you make an account so your plan follows you between devices, Plot stores your email address and the plan you built. If you switch frost warnings on, it also stores what your browser needs to receive a notification, and your postcode area. That is essentially the whole list.

Nothing is ever sold, and there is no advertising inside Plot itself — no banners, no sponsored plants, no promoted anything. Plot does count how many people visit each page apart from the planner, using a service that sets no cookie, stores nothing on your device, and cannot tell one visitor from another. Your data is not a business model here; the paid tier is.

Plot offers separate, optional choices for Meta and Google advertising measurement. Meta can measure public-page visits and account events. Google receives only an ad-click identifier, the time of a verified web trial or payment, a deduplication reference and, for a payment, its actual value and currency. Google receives no email address or garden plan through this integration. Neither choice adds a third-party script to the planner. Each service requires your own positive choice; an earlier Meta choice is not permission for Google. Saying no changes nothing about Plot. Section 5 explains the choices and withdrawal.

2. What Plot deliberately does not do

These are commitments about the code, not aspirations. Anyone can open the browser developer tools on any page of this site and check every one of them.

Not present in Plot

No analytics that can identify you. No Google Analytics, no Plausible, no Fathom, no PostHog, no Mixpanel, no Hotjar, no Microsoft Clarity. Plot counts page views with Cloudflare Web Analytics, which sets no cookie, keeps no state on your device, and does not fingerprint you or follow you between visits. It reports totals only — page views, which pages, which site referred you, your country and your device type. There is no record of an individual visit and nothing in it that points back to a person.
Nothing at all on the planner. Page views are counted on the landing page, on this notice, the terms and the account deletion page, and on the growing guides. Both the page counter and the Meta measurement described in section 5 are deliberately absent from the planner. Your plan is held in the address bar after the #, and although that part of a web address is never sent to a server in an ordinary request, any script in the page can read it, so the planner gets no third-party script of any kind — not an analytics beacon, and not an advertising pixel. Open the developer tools on the planner and you will find neither. This is the one commitment in this list that the advertising change did not touch, and it is the one that matters most.
No advertising inside Plot. You will never see an advert, a sponsored plant, a promoted product or an affiliate link in the planner or the guides. Plot advertises itself elsewhere — that is the change in version 1.4 — but it does not sell your attention to anyone else, and nothing in the product is placed there because somebody paid for it.
No cookies unless you agree to them. Plot sets no cookie for advertising, analytics or profiling unless you have said yes to the banner. If you say no, or simply ignore it, no such cookie is set and no advertising script is ever loaded. The page counting described above sets no cookie either way. See section 5 for everything Plot puts on your device and how to change your mind.
No tracking you around the rest of the web. Plot has never had, and does not have, a way to see what you do on other websites. With your consent, Meta learns that you visited Plot; Plot does not learn anything from Meta about where else you have been, and no data is bought in to enrich what is here.
No selling. Plot does not sell your email or garden plan. Optional advertising measurement shares only the data described in section 5 with the service you choose. Meta and Google have their own privacy terms; measurement consent is not a requirement for using Plot.
No profiling by Plot. Plot does not build a behavioural profile of you, score you, or infer anything about you beyond the growing zone your postcode falls in. Meta does profile people — that is Meta's business, not something Plot can switch off — which is exactly why you are asked first rather than told afterwards.
No marketing email. Plot emails you only to confirm your address, reset your password, or about something that has actually happened to your account, such as your free trial ending in three days and then ending. There is no newsletter.
No marketing notifications. If you turn frost warnings on, the only notification Plot will ever send you is a frost warning for your own area. Not offers, not reminders to come back, not news about the app. There is no way for us to send you anything else, because the sender only knows how to describe a cold night. You can turn them off in the same place you turned them on, and doing so deletes the subscription rather than flagging it.
No third-party fonts. The two typefaces are served from plotapp.uk itself, so your browser never contacts Google Fonts, Fontshare or any other font host, and your IP address is not revealed to them.
No card details. Plot never sees a card number. On the website they go to Stripe; in the iPhone and Android apps the payment happens inside Apple's or Google's own systems, which Plot cannot see into at all.

3. You can use Plot without giving us anything

The planner, both plant libraries and the monthly job list work with no account. In that mode your plan lives in the page address and in your browser's own storage, and it is never sent anywhere. Onboarding offers a Just let me look around link at every step, so you are never forced to type a postcode to see what the thing does.

An account buys you three specific things: your plan saved and synced across devices, a calendar feed you can subscribe to, and weather warnings for your area. If you do not want those, you never have to identify yourself.

4. What we collect, and why we are allowed to

Under UK GDPR every use of personal data needs a lawful basis. Here is each category, in full, with its basis.

What	Why	Lawful basis
Email address	Identifies your account, lets you sign in, receives confirmation and password-reset links.	Performance of a contract — Article 6(1)(b)
Password	Proves it is you. Stored only as a salted hash by our authentication provider. Nobody at Plot can read, recover or see your password, which is why a forgotten one has to be reset rather than looked up.	Performance of a contract — Article 6(1)(b)
Your plan — postcode, the beds and containers you describe with their sizes, the plants you pick, quantities, the dates you record planting, any name you give the plot, and which yearly jobs you have ticked off	This is the product. It is stored as one document per account so it can be returned to you on another device.	Performance of a contract — Article 6(1)(b)
Postcode	The outward code, such as SW11, selects regional planning dates and growing windows. You can optionally enter a full garden postcode for a closer forecast location. Plot sends that postcode to Postcodes.io to obtain its centre coordinates. The full postcode and coordinates are saved in this device's browser cache, separately from your plan, and are not included in shared plan links, calendar exports or account plan sync. Open-Meteo receives the coordinates, not the postcode text. With only a partial postcode, Plot uses an approximate postcode-area or growing-zone centre. Postcode locations are not individual-garden measurements.	Performance of a contract — Article 6(1)(b)
Calendar feed token	A random string that lets a calendar app fetch your dates without signing in. It functions as a password for that feed: anyone holding it can read your plan's dates, so treat it accordingly. You can regenerate it at any time, which immediately breaks the old one.	Performance of a contract — Article 6(1)(b)
Account timestamps — when you signed up, confirmed your address, and last signed in	Running the trial clock, and spotting abuse.	Contract — Article 6(1)(b); and legitimate interests — Article 6(1)(f)
Payment records — the email address used to pay, the payment processor's reference, the amount and the date. For an App Store subscription this reference is Apple's original transaction identifier, which identifies the subscription rather than you, and Plot stores no Apple ID, name or card data.	Granting access you have paid for, answering "have I paid?", refunds, and tax records.	Contract — Article 6(1)(b); and legal obligation — Article 6(1)(c)
Technical logs — IP address, timestamp, which page or endpoint was requested, browser user-agent	Produced automatically by the hosting and database providers. Used for keeping the service up, rate-limiting, and investigating abuse. Not used to build any picture of you.	Legitimate interests — Article 6(1)(f)
Frost warning subscription — only if you turn frost warnings on. Your browser's push delivery address and encryption keys, or your iOS push device token; your postcode area and selected forecast coordinates; timezone, warning level, and the date and severity of the last warning sent.	Sending the notification, choosing the forecast and avoiding duplicate warnings. If you enter a full postcode, the stored coordinates represent that postcode's centre and can indicate your local area; they are not anonymous. We do not store the full postcode text in the alert record. Updating your location updates alerts for that device when online. Enter an outward code to switch back to approximate coordinates. Turning warnings off deletes the subscription record, but does not remove your device's saved weather location.	Performance of a contract — Article 6(1)(b)
Page counts — which page was loaded, the site that referred you, your country and device type, and your IP address at the moment of the request	Knowing how many people arrive and which pages they open, so effort goes where it is useful. Collected by Cloudflare Web Analytics in aggregate. No cookie is set, nothing is stored on your device, your IP address is not retained to recognise you on a later visit, and the totals cannot be traced back to a person.	Legitimate interests — Article 6(1)(f)
Advert measurement in your browser — a Meta cookie identifying your browser, the Plot page you were on, and your IP address and browser type at the moment of the request. Only if you agree to the banner.	Working out which of Plot's adverts on Facebook and Instagram actually bring people here, so the advertising budget of a one-person business is not spent blind. Sent to Meta. This does not happen in the planner, or in the iPhone or Android apps, or at all if you decline.	Consent — Article 6(1)(a), and regulation 6 of PECR for the cookie itself. Withdrawable at any time in section 5.
Advert measurement from our server — that an account was created, a trial started or a subscription was paid for, together with a one-way scrambled (SHA-256 hashed) form of your email address and the identifier from the advert you clicked. Only if you agreed to the banner before making the account.	The same question as the row above, answered accurately. Meta can match a hashed email to an advert click without Plot handing over a readable address, and because it comes from the server it is not defeated by an ad blocker or by iPhone tracking settings, so the numbers a spending decision rests on are real. Sent to Meta. Not sent for anyone who declined, and not sent for anyone who signed up before this notice took effect.	Consent — Article 6(1)(a). Withdrawable at any time in section 5.

On payments. Subscriptions are live, and there are three routes, none of which shows Plot a card number.

On this website the payment is handled by Stripe. Plot is told only that a payment succeeded, the amount, and a reference.
In the iPhone and iPad app Apple takes the payment. The app receives a signed receipt from Apple, and Plot's server checks it with Apple to answer one question: is this subscription currently active? What is kept is the resulting yes-or-no, the expiry date, and Apple's transaction identifier for the subscription. Plot is never given your Apple ID, your name, your card, or anything else you bought.
In the Google Play app Google takes the payment, and the same applies: a purchase token is checked with Google, and only the answer and the expiry date are kept.

This is worth stating plainly because it runs the other way from what people expect: buying through Apple or Google means Plot learns less about you than buying on the website, not more, because the store stands between us and never passes on who you are.

Where we rely on legitimate interests, the interest is keeping a small service running and not letting it be abused. We have weighed that against your interests and consider it proportionate, because the data involved is the ordinary technical record any web server produces and it is not used to target or profile you. You can object — see section 11.

5. What is stored on your own device

Plot is an installable web app, so it keeps things locally to work offline and to avoid signing you out every time it updates. Everything in the list below is strictly necessary to provide the service you asked for, none of it is a tracking cookie, and none of it needs your consent for that reason. The page counting in section 2 adds nothing to this list — it writes nothing to your device at all. The advert measurement described further down does, which is why it is asked about separately.

Your plan, so closing the tab or losing signal does not lose your work.
Your sign-in session, so you stay signed in. Deliberately preserved across app updates.
Small interface preferences, such as light or dark mode and whether a panel is open.
The last weather forecast, so an update while offline does not blank it.
Your optional full weather postcode and coordinates, in a separate device-local cache. Enter and save just an outward code in setup to remove this precise setting, or clear this site's data. It is not synced to other devices. Previously cached forecasts may retain their coordinate keys until site data is cleared.
Your entitlement record, plus a record of the furthest-forward clock reading seen, which stops the trial being extended by winding a device's clock back.
Cached app files, plant data and fonts, so Plot opens instantly and works with no connection.

Clearing your browser's site data for plotapp.uk removes all of it. If you are not signed in, that also permanently deletes any plan you have not exported or bookmarked, because there is no copy anywhere else.

Cookies, and the advertising question

Plot spent its first year with no cookie banner, and said so on this page, because it had nothing to ask about: the page counter sets nothing and stores nothing, so the law that governs cookies simply did not apply. That has changed, and rather than quietly delete the old sentence, here is what happened and why.

Plot is one person with a small advertising budget, competing against apps owned by companies with marketing departments. Advertising on Facebook and Instagram is how a UK gardening app reaches UK gardeners at a price that works. But an advert you cannot measure is a guess, and guessing with a budget this size means wasting money that would otherwise go into the product. Measuring it means letting Meta know that a click on one of its adverts led to somebody arriving here, and that requires your permission first. So you are asked.

If you say yes

Meta's measurement script loads on the public pages of this site — the landing page, the guides, the terms, and this notice. It sets a cookie called _fbp, which identifies your browser to Meta, and reads _fbc, which records which advert you clicked.
Meta is told which of those pages you looked at. If you go on to create an account, start a trial or subscribe, Plot's server tells Meta that this happened, along with a scrambled version of your email address so Meta can match it to the advert click. Plot never sends your address in a readable form.
No Meta script runs in the planner. With your permission, Plot's server can report a confirmed account or an actual trial when you sign in there, but it does not send your garden plan, postcode, or private planner URL to Meta.

If you say no, or ignore the banner

Meta's script is never loaded and no Meta cookie is set. Not deferred, not loaded-but-idle — the request to Meta is never made at all.
No new permission is inferred. If you previously opted in when creating your account in another browser, that saved account choice can still allow server-side measurement until it expires or you withdraw it.
Plot works exactly the same. Every feature, the same price, the same trial. Declining costs you nothing, and there is no second banner asking again in a fortnight.

Advertising identifiers are not saved before you opt in. Meta attribution is saved only with your Meta choice; Google click attribution is saved only with your Google choice. Notes collected by the previous pre-consent implementation are discarded, not imported. A choice lasts at most 90 days. Without a valid opt-in, neither service receives a conversion through this setup. When you create an account after choosing Meta, Plot saves that choice and its attribution with the account, so opening your confirmation email in another browser does not lose them. Account and trial events are reported only after email confirmation, using the actual recorded event time and a duplicate-prevention ID.

Google Ads: a separate choice

When you choose Google Ads, Plot saves the Google click identifier from the current link (gclid, gbraid or wbraid) in your browser for up to 90 days. If you sign in, it is linked to your account with the consent time. Plot's server queues a trial only from the recorded trial start after email confirmation, and a purchase only from a verified live Stripe payment. Page views, button clicks, test payments and native-app receipts are not Google conversions.

Once daily, Plot's authorised automation service (Perplexity Computer, using the connected Supabase and Google Ads services) checks current consent again and sends eligible events to Google. The payload is the click identifier, event time, an opaque deduplication ID, and payment value and currency where relevant. It includes consent for measurement and declines ad personalisation. No Google browser tag, Customer Match list, email, IP address, postcode, complete page URL or garden-plan fragment is included in this upload. This processing relies on your consent. See Google's privacy policy and Perplexity's privacy policy for their processing and international-transfer information.

The iPhone and Android apps contain none of this. There is no Meta pixel in either build, and there is no banner in them, because there is nothing to consent to.

Changing your mind. The button below immediately withdraws both choices in this browser and opens the choices again. It removes advertising identifiers locally and asks Plot's server to remove queued Google events and withdraw matching Meta permission, even if you are signed out. Random, revocation-only keys are retained solely to deliver that withdrawal; they cannot access your account or grant permission. If you are offline, server withdrawal retries when a connection is available. Previously sent data, or an upload already in flight, cannot be recalled by this button. Clearing site data alone cannot notify our server; use this control first, or contact us to withdraw for your account.

Google identifiers expire after at most 90 days and are removed by the daily cleanup. Withdrawn, unsent Google events are deleted. A minimal sent-event ledger is retained for 180 days to prevent duplicates and then deleted; it does not contain the click identifier. Google controls retention of data already received. Deleting your Plot account also removes Plot's Google consent, revocation keys and event ledger.

6. Who else processes your data

Plot is one person, so it stands on other people's infrastructure. Everyone in the table below except the advertising platforms is a processor: they act on our instructions under a contract and are not free to use your data for their own ends.

Meta is the exception, and it is a real one. When you consent to advert measurement, Meta does not act purely on our instructions — it also uses that data for its own purposes, so in law the two of us are joint controllers for it under Article 26. In practice that means Plot decides to send the measurement and asks you first, while what Meta then does with it is governed by Meta's own privacy policy and its business tools terms, which Plot cannot alter. This is the single most important thing to understand before agreeing: declining is a genuine choice, and it is why you are asked rather than told. Everything else on this page describes a processor doing only what Plot has instructed.

Who	What they do	What they see	Where
Supabase	Database, accounts and authentication	Your email address, password hash, plan document, feed token, entitlement record, and connection logs	Hosted in London, United Kingdom (AWS eu-west-2)
Resend	Sends the confirmation, password-reset and trial-ending emails	Your email address and the contents of those emails	United States, with delivery infrastructure in Ireland (Amazon SES eu-west-1)
Porkbun	Domain registration, DNS and static file hosting	Web server logs, including IP addresses	United States
Cloudflare	Counts page views	The page address, the referring site, your country and device type, and your IP address at the moment of the request. No cookie, no storage on your device, and no identifier that survives between visits	United States
Meta — joint controller, not a processor; only if you consent	Measures whether Plot's adverts on Facebook and Instagram work	Which public Plot pages you opened, the `_fbp` cookie identifying your browser, the identifier of the advert you clicked, and your IP address and browser type. With valid permission: that a confirmed account was created, a real trial started or a subscription was paid for, plus a SHA-256 hashed form of your email address, never a readable one. No garden plan, postcode or private planner URL is sent to Meta. No Meta script runs in the planner or the mobile apps	United States and Ireland
Google, with authorised delivery through Perplexity Computer	Consent-based Google Ads conversion measurement; no Customer Match or remarketing list	An ad-click ID, event time, opaque deduplication reference, and actual purchase amount and currency where applicable. No email address or garden plan. Perplexity Computer accesses the eligible measurement queue to deliver it.	May involve processing outside the UK, including the United States; see the linked privacy policies
Stripe	Payments made on this website.	Your name, email address, card details and billing country. Plot receives only a confirmation that payment succeeded, the amount, and a reference — never the card number.	United States and Ireland
Apple	Subscriptions bought in the iPhone or iPad app, and the scheduling of sowing reminders on the device.	Everything about the purchase: your Apple ID, your payment method and your billing country. Plot is sent none of it. In the other direction, Plot's server sends Apple the signed receipt in order to ask whether the subscription is active. Sowing reminders are built and scheduled on the iPhone itself and are not sent to Apple or to us.	United States and Ireland
Google	Subscriptions bought in the Android app, and distribution of that app.	Everything about the purchase, including your Google account and payment method. Plot is sent a purchase token only, which it checks with Google to ask whether the subscription is active.	United States and Ireland
Your browser’s push service — whichever one it is, generally Google for Chrome and Edge, Mozilla for Firefox, Apple for Safari	Delivers frost warnings to your device. Only if you turn them on.	That a notification was sent to your device, its size and when. Not what it says: the message is encrypted before it leaves us, with keys your browser generated, and the push service cannot read it. Your email address is never sent. Which browser is involved, and therefore which company, is decided by your device and not by Plot.	United States, generally
Open-Meteo	Weather forecast for your area	Your selected forecast coordinates: the centre of your optional full postcode, or a broader approximate location if you have not supplied one. Direct browser requests also reveal your IP address. No account identifier, email address or postcode text is sent.	European Union
Postcodes.io	Looks up coordinates when you submit an optional full postcode.	The full postcode you enter and your IP address. Plot omits browser credentials and the referring page URL from this request. No Plot account identifier, email or garden plan is sent. You can avoid this lookup by entering only an outward code.	External postcode-lookup service; see the provider's published privacy information.

Beyond these, data is disclosed only where the law requires it — for example a valid request from a court, the police or a regulator — or to establish or defend a legal claim. If Plot were ever sold or transferred, account data would move with it and you would be told before that happened, in time to delete your account first.

7. Sending data outside the UK

Your account and your plan are stored in London and stay in the UK. Some things do leave it:

Email. Resend is a United States company and states that it stores customer data in the US. Its data processing addendum incorporates the Standard Contractual Clauses, which is the transfer mechanism relied on here. What crosses the border is your email address and the text of a confirmation or reset message.
Hosting, payments and page counting. Porkbun, Stripe, Cloudflare, Apple and Google are US companies. The transfer mechanism is the Standard Contractual Clauses together with the UK International Data Transfer Addendum in their respective terms.
Advert measurement, if you consent to it. Meta Platforms Ireland is the contracting party and data reaches Meta Platforms, Inc. in the United States. The transfer mechanism is the Standard Contractual Clauses and the UK Addendum incorporated in Meta's business tools terms, and Meta additionally relies on the UK Extension to the EU–US Data Privacy Framework. If you would rather your data did not make that journey, decline the banner or withdraw in section 5 — nothing is sent and nothing crosses any border.
Frost warnings, if you turn them on. A notification is handed to the push service your own browser chose, which for most browsers is operated from the United States. Two things are worth being straight about. First, Plot has no contract with that service and no say in which one it is — it is part of your browser, and the relationship is between you and its maker. Second, it barely matters: the message is encrypted end to end before it is handed over, so what crosses the border is an address issued by that same service and a block of ciphertext it cannot read.

8. How long we keep things

Your account and plan: until you delete the account. Plot does not expire dormant accounts, because a garden plan is worth more after three years than after three weeks.
Financial records: six years after the end of the relevant tax year, which is what HMRC requires of a UK business. This obligation outlives your account, so a payment record is kept even after deletion — stripped of identifying data as described in section 9.
Technical logs: retained by our hosting and database providers according to their own retention periods, typically a matter of days to a few weeks. Plot keeps no separate copy.
Emails we send you: delivery records are retained briefly by Resend for troubleshooting bounces, then discarded.
Frost warning subscription: until you turn warnings off, delete the account, or the subscription stops working — which happens by itself if you clear the browser’s data or remove the app. A subscription the push service reports as dead is deleted the next evening we try to use it, without waiting to be asked.
Page counts: held by Cloudflare as aggregate totals, according to its own retention period. Plot keeps no separate copy. Because there is no identifier in this data, there is nothing in it to delete on request — no row belongs to any one person.
Advert measurement, if you consented: the note in your own browser recording which advert brought you here expires after 90 days by itself, and clearing your site data removes it sooner. What Meta keeps is governed by Meta's own retention practice rather than by Plot, which is a consequence of Meta being a joint controller rather than a processor. If you want it gone from Meta's side, withdrawing consent here stops anything further being sent, and Meta's own settings and privacy contacts are where a deletion request has to go. Plot's own record is limited to the consent flag on your account and the campaign note, both of which are deleted with the account.

9. Deleting your account

There is a delete button inside the account panel. It is not a request form that reaches a human — it runs immediately, and it is irreversible.

Deleting removes your sign-in credentials, your saved plan, your calendar feed token and any frost warning subscription. Any payment record is retained in the stripped form described above: the payment email address is erased, leaving only non-identifying fields — amount, date and the processor's reference — so the books still reconcile without the row pointing at a person. This is required by our tax obligations and is the one thing deletion cannot remove.

Your plan will still exist in your own browser's storage, and in any link you have shared or bookmarked, because those are copies you hold. Clear your site data to remove them.

10. Security

Everything travels over HTTPS. Plot is served only over an encrypted connection.
Passwords are salted and hashed by the authentication provider. They are never stored in a readable form and cannot be retrieved by anyone, including us.
Passwords must be at least eight characters, and the sign-up form shows you how strong yours is.
Database access is governed by row-level security, so a signed-in account can read and write only its own plan. This is enforced by the database itself rather than by the app being careful, and it has been tested by signing in as one account and attempting to read and modify another's row.
The key that ships in the browser is a publishable key, which is designed to be public and grants no privileged access. Row-level security, not the secrecy of that key, is what protects the data.
Sign-in attempts are rate limited. Confirmation and reset links are single-use and expire.
Your calendar feed token is the password to that feed. If you have shared a feed URL and want it dead, regenerate the token.

11. Your rights

Under UK GDPR you can ask us to:

Give you a copy of the personal data we hold about you (right of access).
Correct anything inaccurate (rectification). Your plan is editable by you at any time.
Delete it (erasure). Use the delete button, or email us, subject to the tax-record exception in section 9.
Restrict what we do with it while a dispute about accuracy or lawfulness is resolved.
Hand it over in a portable form (portability). Plot exports your plan as a link that contains the whole plan, so you can take it out yourself without asking.
Object to processing based on legitimate interests.

Email hello@plotapp.uk. We will respond within one month, and we will not charge you. If we need to confirm you are the account holder we will do it by emailing the address on the account, and nothing else.

12. Children

Plot is a tool for people who look after a garden, and accounts are intended for adults. We do not knowingly create accounts for children under 16, and nothing in Plot is designed to appeal to children or to encourage them to hand over data. Anyone of any age can use the planner without an account, which involves no personal data at all. If you believe a child has created an account, email us and it will be deleted.

13. Automated decisions

Plot makes no automated decisions that have a legal or similarly significant effect on you, and does no profiling in that sense. It does calculate things from your postcode — frost dates, sowing windows, whether a plant is too tender for your area — but that is arithmetic on regional averages, applied to the garden you described, not a judgement about you.

14. Data breaches

If personal data is lost, exposed or accessed without authorisation and it poses a risk to you, we will report it to the Information Commissioner's Office within 72 hours of becoming aware, and tell you directly, without delay, where the risk to you is high. We will say what happened and what to do about it, rather than issue a reassurance.

15. Complaints

Please raise it with us first at hello@plotapp.uk — most things are a misunderstanding or a bug, and both are fixable.

You also have the right to complain directly to the UK's data protection regulator, and you do not need our permission or involvement to do so:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

16. Changes to this notice

When this notice changes, the date and version at the top change with it. If a change materially affects what happens to your data — a new processor, a new purpose, a longer retention period — we will email account holders before it takes effect rather than quietly republishing the page.