Privacy Policy
What you write is yours. This policy explains, in plain language, what data Quiet Garden keeps, what it is used for, who it is shared with, and what you can do with it.
Last updated:
In short
- We store what you write so we can show it to you and so your garden can grow. Nothing else.
- Your reflections are never used to train AI models, ours or anyone else’s.
- No person reads your reflections.
- We don’t sell your data or share it for advertising. There are no ads, we use no third-party analytics SDKs, and we don’t track you across apps or websites.
- You can export everything, or delete your account and all its content, from Settings whenever you like.
Who is responsible
The controller of your data is Gonzalo Escudero (tax ID, CUIL, 20-40388835-5). Write to contact@quietgarden.app with any question about this policy or your data.
What data we keep
Your account
After the welcome, the app asks you for an account to keep your garden. You can sign in with Apple, with Google, or with a one-time code we email you. We receive:
- Your account email. If you sign in with Apple and choose to hide your email, we receive Apple’s private relay address, not your real email.
- A user identifier from the provider you signed in with (Apple, Google or email).
- If you sign in with Apple, a token kept only on our server and used only to revoke “Sign in with Apple” access when you delete your account.
What you write and what is generated
- The text of each reflection and, if you choose one, the feeling you arrive with.
- The other way to see it that the AI generates for each reflection.
- Your mark on that response (“helpful” / “not helpful”), if you use it.
- The level of each reflection’s safety classification (none, review or risk). See “Safety” below.
- If you have Premium and let the AI remember past reflections: the weekly note and monthly letter the AI writes from what you wrote in that period (it never uses entries marked as risk).
Your garden, purchases and settings
- The state of your garden: plants, seeds, decor, water and the cards you kept.
- Your settings: time zone, language, daily reminder, whether the AI may remember past reflections, and your chosen season.
- If you buy Premium: which product, its status (trial, active, expired) and the transaction identifiers the store and RevenueCat send us. We never see or store your payment details.
- The dates and times things happen (for example, when you saved a reflection or when a plant grows).
Usage and errors, with nothing you wrote
- Simple usage events, in our own database (for example, “a reflection was saved”, “a moment was opened”). A closed list of fields, enforced by the database, keeps any of your text out of them.
- If the app fails on your phone, the file and line of code where it happened and what kind of failure it was. Never the message or what you were writing.
- The cost of each AI call, to keep spending in check. Without the text.
What stays only on your phone
- A reflection written offline, encrypted, until it is sent.
- The home-screen widget picture: your garden as you left it, with none of your text.
- Your sound preferences and reminders, which are scheduled on the phone.
Garden postcards are made on your phone and leave it only if you choose to share them. They never include what you wrote.
What you write may include sensitive information, for example about how you feel or about your health. We use it only to provide the service described here, and you decide what to write. We don’t use your location: the season comes from your time zone.
Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Showing you your reflections, history and garden, and keeping them across devices. | Providing the service you asked for (contract). |
| Generating another way to see each reflection and, with Premium, the notes and letters. | Contract, and your explicit consent for the sensitive data you choose to write. |
| Classifying each reflection to detect signs of risk and show you help resources. | Your explicit consent and protecting your vital interests. |
| Working out water and growth from your time zone; processing Premium. | Contract. |
| Usage events, errors and costs, with no text, to improve the app and keep it secure. | Legitimate interest. |
| Signing you in, keeping your account secure and deleting it when you ask. | Contract and legal obligations. |
We don’t use your data for advertising, build profiles for third parties, or sell it. The safety classification is automated, but it makes no decision with legal or similarly significant effects on you: it only decides whether the app shows you help resources.
Who it is shared with
We use a few providers, who process data on our behalf and only as needed:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and server functions. Everything described above is stored there. | United States |
| OpenAI | Generates the other way to see it, the notes and letters and the seed suggestion, and runs the safety classification. It receives the reflection text through its API. If you let the AI remember past reflections, it also receives some earlier ones as context. | United States |
| RevenueCat | Validates Premium purchases with Apple and Google. It receives a random identifier for your account and the purchase details, never your email or what you write. | United States |
| Apple and Google | Sign-in (if you choose them) and charging for purchases, which they do under their own policies. | Per provider |
| Vercel | Hosts this website. Like any server, it logs technical visit data (such as the IP address) for security. | Global |
Under OpenAI’s API data policy, data sent through the API is not used to train its models. OpenAI may keep it for up to 30 days to detect abuse, and then deletes it.
Because these providers operate outside your country, your data is transferred internationally. We do this with providers that offer contractual safeguards for such transfers (for example, the European Union’s standard contractual clauses). We would share data with an authority only if a valid law or order required it.
Safety
Data travels encrypted (HTTPS) and is stored encrypted on our provider’s servers. Each person can reach only their own data, enforced by the database itself.
Each reflection is classified automatically to detect signs of risk, so the app can show you crisis resources when appropriate (for example, 988 in the United States; in Argentina, 135 (AMBA) or 0800-345-1435). It is an automated system; no person reads what you wrote.
Quiet Garden is not an emergency service. If you are in danger or thinking of harming yourself, call your local emergency services or a helpline.
How long we keep it
For as long as you have an account. When you delete it, everything is deleted from our database at once: reflections, garden, usage events and errors. Our provider’s automatic backups roll over by themselves within days. We revoke “Sign in with Apple” access if you used it. Whatever OpenAI received is governed by its API data policy, described above. Purchase records the law requires to be kept are held by Apple, Google and RevenueCat.
Your rights
At any time, you can:
- Export all your data from Settings → Export my data.
- Delete your account and everything in it from Settings → Delete everything. It is immediate and cannot be undone. If you can’t get into the app, follow the steps to delete your account.
- Ask us for access, correction or objection, or withdraw your consent, by writing to contact@quietgarden.app. We reply within the time the law sets.
If you live in Argentina
You have the rights of access, rectification, updating and deletion under Personal Data Protection Law 25.326. You may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown. The Agency for Access to Public Information (AAIP), as the supervisory authority of Law 25.326, handles complaints from anyone whose rights are affected by a breach of data protection rules.
If you live in the European Union or the United Kingdom
You have the right of access, rectification, erasure, portability, objection and restriction of processing. Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before. You can also complain to your country’s data protection authority.
If you live in California or another US state
You can learn what personal information we hold, ask us to delete or correct it, and not be discriminated against for using these rights. We do not sell or “share” your personal information (in the sense of targeted advertising), and we don’t use your sensitive information to infer characteristics about you.
Minimum age
Quiet Garden is not meant for children. You must be at least 13 to use it, or the age your country requires to consent on your own (for example, 16 in parts of Europe). If you believe a minor has given us data, write to us and we will delete it.
Cookies and this site
This website uses no cookies and no analytics or advertising tools. The app uses no third-party analytics or advertising SDKs, and does not ask permission to track you.
Changes
If we change this policy in an important way, we will tell you in the app before the change takes effect. The date of the last update is at the top.
Contact
Gonzalo Escudero · contact@quietgarden.app. See also the support page.