Legal

Privacy notice

This explains what Plot collects, why it is allowed to, who else touches it, how long it is kept and how to make it go away. It describes what the software actually does, not what a template says it might.

1. The short version

Plot works out when to sow, plant and prune where you live. To do that without an account it needs nothing from you at all — not even a postcode, if you would rather just browse. If you make an account so your plan follows you between devices, Plot stores your email address and the plan you built. That is essentially the whole list.

There is no analytics, no advertising, no tracking, and nothing is sold or shared for marketing. Your data is not a business model here; the paid tier is.

2. What Plot deliberately does not do

These are commitments about the code, not aspirations. Anyone can open the browser developer tools on any page of this site and check every one of them.

3. You can use Plot without giving us anything

The planner, both plant libraries and the monthly job list work with no account. In that mode your plan lives in the page address and in your browser's own storage, and it is never sent anywhere. Onboarding offers a Just let me look around link at every step, so you are never forced to type a postcode to see what the thing does.

An account buys you three specific things: your plan saved and synced across devices, a calendar feed you can subscribe to, and weather warnings for your area. If you do not want those, you never have to identify yourself.

4. What we collect, and why we are allowed to

Under UK GDPR every use of personal data needs a lawful basis. Here is each category, in full, with its basis.

What	Why	Lawful basis
Email address	Identifies your account, lets you sign in, receives confirmation and password-reset links.	Performance of a contract — Article 6(1)(b)
Password	Proves it is you. Stored only as a salted hash by our authentication provider. Nobody at Plot can read, recover or see your password, which is why a forgotten one has to be reset rather than looked up.	Performance of a contract — Article 6(1)(b)
Your plan — postcode, the beds and containers you describe with their sizes, the plants you pick, quantities, the dates you record planting, any name you give the plot, and which yearly jobs you have ticked off	This is the product. It is stored as one document per account so it can be returned to you on another device.	Performance of a contract — Article 6(1)(b)
Postcode	Sets your frost dates and growing windows. For the forecast, Plot converts it to the approximate centre of your postcode area — the outward part, such as SW11 — and asks the weather service about that. Your full postcode is not sent to the weather service, and no identifier of you goes with the request.	Performance of a contract — Article 6(1)(b)
Calendar feed token	A random string that lets a calendar app fetch your dates without signing in. It functions as a password for that feed: anyone holding it can read your plan's dates, so treat it accordingly. You can regenerate it at any time, which immediately breaks the old one.	Performance of a contract — Article 6(1)(b)
Account timestamps — when you signed up, confirmed your address, and last signed in	Running the trial clock, and spotting abuse.	Contract — Article 6(1)(b); and legitimate interests — Article 6(1)(f)
Payment records — the email address used to pay, the payment processor's reference, the amount and the date. Not currently in use: see the note below.	Granting access you have paid for, answering "have I paid?", refunds, and tax records.	Contract — Article 6(1)(b); and legal obligation — Article 6(1)(c)
Technical logs — IP address, timestamp, which page or endpoint was requested, browser user-agent	Produced automatically by the hosting and database providers. Used for keeping the service up, rate-limiting, and investigating abuse. Not used to build any picture of you.	Legitimate interests — Article 6(1)(f)

On payments. At the date above, Plot cannot take money. No checkout is reachable from any page, and the payment provider is connected only in test mode, which cannot move real funds. The row above describes what will be stored once real payments are switched on, and this notice will be dated again when that happens.

Where we rely on legitimate interests, the interest is keeping a small service running and not letting it be abused. We have weighed that against your interests and consider it proportionate, because the data involved is the ordinary technical record any web server produces and it is not used to target or profile you. You can object — see section 11.

5. What is stored on your own device

Plot is an installable web app, so it keeps things locally to work offline and to avoid signing you out every time it updates. None of this is a tracking cookie, and all of it is strictly necessary to provide the service you asked for, which is why no consent banner appears.

• Your plan, so closing the tab or losing signal does not lose your work.
• Your sign-in session, so you stay signed in. Deliberately preserved across app updates.
• Small interface preferences, such as light or dark mode and whether a panel is open.
• The last weather forecast, so an update while offline does not blank it.
• Your entitlement record, plus a record of the furthest-forward clock reading seen, which stops the trial being extended by winding a device's clock back.
• Cached app files, plant data and fonts, so Plot opens instantly and works with no connection.

Clearing your browser's site data for plotapp.uk removes all of it. If you are not signed in, that also permanently deletes any plan you have not exported or bookmarked, because there is no copy anywhere else.

6. Who else processes your data

Plot is one person, so it stands on other people's infrastructure. Each of these is a processor acting on our instructions under a contract, not a party free to use your data for its own ends.

Who	What they do	What they see	Where
Supabase	Database, accounts and authentication	Your email address, password hash, plan document, feed token, entitlement record, and connection logs	Hosted in London, United Kingdom (AWS eu-west-2)
Resend	Sends the confirmation and password-reset emails	Your email address and the contents of those emails	United States, with delivery infrastructure in Ireland (Amazon SES eu-west-1)
Porkbun	Domain registration, DNS and static file hosting	Web server logs, including IP addresses	United States
Stripe	Payments. Not active at the date of this notice.	Your name, email address, card details and billing country. Plot receives only a confirmation that payment succeeded, the amount, and a reference — never the card number.	United States and Ireland
Open-Meteo	Weather forecast for your area	The approximate coordinates of your postcode area and your IP address. No account identifier, email address or full postcode is sent.	European Union
Google Fonts and Fontshare	Serve the two typefaces the site uses	Your IP address and browser details, because your browser fetches the font files directly from them	United States (Google); India (Fontshare)

Beyond these, data is disclosed only where the law requires it — for example a valid request from a court, the police or a regulator — or to establish or defend a legal claim. If Plot were ever sold or transferred, account data would move with it and you would be told before that happened, in time to delete your account first.

7. Sending data outside the UK

Your account and your plan are stored in London and stay in the UK. Three things do leave it:

• Email. Resend is a United States company and states that it stores customer data in the US. Its data processing addendum incorporates the Standard Contractual Clauses, which is the transfer mechanism relied on here. What crosses the border is your email address and the text of a confirmation or reset message.
• Hosting and payments. Porkbun and Stripe are US companies. The transfer mechanism is the Standard Contractual Clauses together with the UK International Data Transfer Addendum in their respective terms.
• Fonts. Requesting the two typefaces reveals your IP address to Google in the US and to Fontshare in India. Nothing about your account, your plan or your postcode is included, and the request happens whether or not you have an account.

8. How long we keep things

• Your account and plan: until you delete the account. Plot does not expire dormant accounts, because a garden plan is worth more after three years than after three weeks.
• Financial records: six years after the end of the relevant tax year, which is what HMRC requires of a UK business. This obligation outlives your account, so a payment record is kept even after deletion — stripped of identifying data as described in section 9.
• Technical logs: retained by our hosting and database providers according to their own retention periods, typically a matter of days to a few weeks. Plot keeps no separate copy.
• Emails we send you: delivery records are retained briefly by Resend for troubleshooting bounces, then discarded.

9. Deleting your account

There is a delete button inside the account panel. It is not a request form that reaches a human — it runs immediately, and it is irreversible.

Deleting removes your sign-in credentials, your saved plan and your calendar feed token. Any payment record is retained in the stripped form described above: the payment email address is erased, leaving only non-identifying fields — amount, date and the processor's reference — so the books still reconcile without the row pointing at a person. This is required by our tax obligations and is the one thing deletion cannot remove.

Your plan will still exist in your own browser's storage, and in any link you have shared or bookmarked, because those are copies you hold. Clear your site data to remove them.

10. Security

• Everything travels over HTTPS. Plot is served only over an encrypted connection.
• Passwords are salted and hashed by the authentication provider. They are never stored in a readable form and cannot be retrieved by anyone, including us.
• Passwords must be at least eight characters, and the sign-up form shows you how strong yours is.
• Database access is governed by row-level security, so a signed-in account can read and write only its own plan. This is enforced by the database itself rather than by the app being careful, and it has been tested by signing in as one account and attempting to read and modify another's row.
• The key that ships in the browser is a publishable key, which is designed to be public and grants no privileged access. Row-level security, not the secrecy of that key, is what protects the data.
• Sign-in attempts are rate limited. Confirmation and reset links are single-use and expire.
• Your calendar feed token is the password to that feed. If you have shared a feed URL and want it dead, regenerate the token.

11. Your rights

Under UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (right of access).
• Correct anything inaccurate (rectification). Your plan is editable by you at any time.
• Delete it (erasure). Use the delete button, or email us, subject to the tax-record exception in section 9.
• Restrict what we do with it while a dispute about accuracy or lawfulness is resolved.
• Hand it over in a portable form (portability). Plot exports your plan as a link that contains the whole plan, so you can take it out yourself without asking.
• Object to processing based on legitimate interests.

Email hello@plotapp.uk. We will respond within one month, and we will not charge you. If we need to confirm you are the account holder we will do it by emailing the address on the account, and nothing else.

12. Children

Plot is a tool for people who look after a garden, and accounts are intended for adults. We do not knowingly create accounts for children under 16, and nothing in Plot is designed to appeal to children or to encourage them to hand over data. Anyone of any age can use the planner without an account, which involves no personal data at all. If you believe a child has created an account, email us and it will be deleted.

13. Automated decisions

Plot makes no automated decisions that have a legal or similarly significant effect on you, and does no profiling in that sense. It does calculate things from your postcode — frost dates, sowing windows, whether a plant is too tender for your area — but that is arithmetic on regional averages, applied to the garden you described, not a judgement about you.

14. Data breaches

If personal data is lost, exposed or accessed without authorisation and it poses a risk to you, we will report it to the Information Commissioner's Office within 72 hours of becoming aware, and tell you directly, without delay, where the risk to you is high. We will say what happened and what to do about it, rather than issue a reassurance.

15. Complaints

Please raise it with us first at hello@plotapp.uk — most things are a misunderstanding or a bug, and both are fixable.

You also have the right to complain directly to the UK's data protection regulator, and you do not need our permission or involvement to do so:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• ico.org.uk/make-a-complaint

16. Changes to this notice

When this notice changes, the date and version at the top change with it. If a change materially affects what happens to your data — a new processor, a new purpose, a longer retention period — we will email account holders before it takes effect rather than quietly republishing the page.