Privacy Policy

Who we are

Grow a Tree (growatree.uk) is operated by [OPERATOR NAME] (“we”, “us”). For the UK GDPR and the Data Protection Act 2018, [OPERATOR NAME] is the controller of the personal data described in this policy.

You can contact us about your data at contact@growatree.uk.

The data we collect

We keep the service small, and we only collect what we need to run an account and a tree.

• Account data. Your email address, a secure password hash held by our authentication provider, the time your account was created, and the status of email confirmation.
• Tree progress. How many times you have watered, your current streak, your longest streak, the date of your last watering, and the growth stage worked out from that record.
• Security check. When you sign up, log in, or reset a password, Cloudflare Turnstile receives a token and technical details of the request, which can include your IP address, so we can tell automated sign-ups from people.
• Messages you send us. If you email contact@growatree.uk, we keep what you write so we can reply and, where needed, act on a privacy request.

We do not ask for your name, payment card, location, or contacts. We do not use advertising cookies or third-party analytics. We do not sell personal data.

Why we use it, and the lawful basis

We use personal data for these reasons:

• To provide the service you asked for (UK GDPR Article 6(1)(b)): creating your account, confirming your email, letting you log in, watering your tree, showing your stats, changing your email or password, exporting your data, and deleting your account.
• To keep the service secure (Article 6(1)(f), legitimate interests): checking Turnstile tokens, protecting accounts, and preventing abuse. You can object to processing based on legitimate interests by emailing us. We will stop unless we have a compelling reason to continue.
• To meet a legal duty (Article 6(1)(c)), if we are required to keep or disclose a limited record, for example to respond to a lawful request.

We do not use your data for marketing, profiling, or automated decisions that have a legal effect on you.

Who processes data for us

We use the following processors. They handle personal data only so we can run Grow a Tree, under contracts that require them to protect it.

• Supabase stores the database and runs authentication, including your email address, password hash, and tree progress.
• Vercel hosts the website and serves pages. Requests pass through its infrastructure, which can include IP addresses and standard request logs needed to deliver the site.
• Cloudflare provides Turnstile, the “I’m not a robot” check on sign-up, log in, and password reset. It processes the check token and related request data for that purpose only. We do not use Cloudflare for advertising or analytics.

International transfers

We are established in the United Kingdom. Supabase, Vercel, and Cloudflare may process personal data in the United Kingdom, the European Economic Area, the United States, and other countries where they operate.

Where personal data leaves the UK, we rely on an appropriate safeguard. That is typically the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or a UK adequacy regulation, depending on the processor and the destination. You can ask us for a summary of the safeguard that applies.

How long we keep it

We keep your account and tree data for as long as your account is open. When you delete your account, we delete the user record, which removes your profile and your tree. You can also ask us to delete the account by email.

Encrypted backups held by our processors may keep a residual copy until the ordinary backup cycle overwrites it. We do not use those backups to restore a deleted account unless we must do so to meet a legal duty.

Emails you send to contact@growatree.uk are kept for as long as we need them to handle your request and for a short period afterwards in case you follow up, and then deleted.

Cookies

We use only strictly necessary cookies that keep you logged in. We do not use analytics or advertising cookies, so we do not show a cookie consent banner. Details are in the Cookie Policy.

Your rights

Under the UK GDPR you can ask us to:

• Access the personal data we hold about you. Account settings shows your email and your tree, and “Download my data” gives you a JSON copy.
• Rectify inaccurate data. You can change your email in account settings. Email us if something else needs correcting.
• Erase your data. Delete your account in settings, or email us and we will delete it.
• Restrict or object to certain processing, and to ask us to stop processing based on legitimate interests.
• Port the data you provided. The JSON download is there for that.
• Withdraw any consent, where we rely on consent. The service itself is provided under the contract basis above, not under consent.

To use a right, open account settings while logged in, or email contact@growatree.uk from the address on the account if you can. We may need to confirm it is you before we act. We aim to reply within one month.

You can complain to the Information Commissioner’s Office (ICO), the UK regulator for personal data. The ICO’s site is ico.org.uk/make-a-complaint. We would like the chance to put things right first, but you do not have to contact us before you contact the ICO.

Children

Grow a Tree is not directed at children under 13. We do not knowingly create accounts for children under 13. If you believe we have, email contact@growatree.uk and we will delete the account.

Security

Pages are served over HTTPS. Passwords are not stored in our own database. Supabase Auth stores a hash, and we pass the password to it only to create the account, log you in, or change the password. Access to tree rows is limited to the signed-in user, and watering is checked on the server.

Changes to this policy

If we change this policy, we will update the date at the top and publish the new version on this page. Where a change is significant, we will also email the address on your account.