Privacy Notice

1. Who we are

Too Lazy To Garden is operated by Andrew Culp, an individual sole proprietor trading as Too Lazy To Garden. We are the data controller for the personal data described here, which means we decide what data is collected and why. You can contact us about privacy through the in-app support options, by email at support@toolazytogarden.com, or by phone at (888) 355-8005.

2. What we collect and why

• Account data (email address, display name, sign-in identifiers from Google if you use Google sign-in) — to create and secure your account. Legal basis: performance of our contract with you.
• Garden content (journal entries, plantings, harvests, costs, photos, plot layouts, notes, voice memos, sensor readings) — to provide the core features you're using. Legal basis: contract.
• AI feature inputs (photos and text you submit to plant/pest diagnosis, the garden coach, recipe suggestions, seed-packet scanning, transcription) — to generate the result you asked for. Legal basis: contract.
• Community content (posts, questions, answers, swap listings, shared layouts, public profile) — to run the community features. This content is visible to other users. Legal basis: contract.
• Location-ish data you enter (ZIP code, growing zone) — to give you frost dates, weather, and regional planting timing. Legal basis: contract.
• Usage and device data (pages used, feature usage counts, IP address, browser/device type, error logs) — to keep the Service secure, prevent abuse, enforce plan limits, and fix bugs. Legal basis: legitimate interests in running a secure, working service.
• Support messages — to answer you. Legal basis: legitimate interests.
• Push notification tokens, if you enable reminders — to deliver the notifications you asked for. Legal basis: consent (you can turn them off any time).
• Subscription status (plan, renewal date, subscription identifiers from Paddle) — to unlock paid features and comply with tax and accounting obligations. Legal basis: contract and legal obligation.

Card and billing details are collected and processed by Paddle at checkout, not by us. We never see your full card number.

3. Who we share data with

• Merchant of Record: Paddle.com, which sells the subscription, handles payments, invoicing, subscription management, sales tax compliance, and buyer support.
• Service providers / subprocessors: our hosting, database, authentication, file storage, error-monitoring, and AI model providers, who process data on our instructions to deliver the features described above.
• Other users: only the content you deliberately publish to community areas and your public profile.
• Professional advisers (legal, accounting) where necessary.
• Authorities where we are legally required to disclose.

We do not sell your personal data.

4. International transfers

Our providers may process data in the United States and other countries. Where data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

5. How long we keep it

• Account and garden content: while your account is active, and up to 90 days after you delete it.
• AI inputs and outputs: kept with the related record; transient prompts are not retained long-term.
• Security and error logs: typically up to 12 months.
• Transaction and tax records: retained by Paddle and by us as required by law (usually 7 years).

When data is no longer needed, we delete or anonymise it.

6. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and — if you're in the UK/EEA — complain to your local supervisory authority. California residents may also request details of data collected and disclosed and are protected against discrimination for exercising these rights.

Contact us through in-app support to exercise any of these. We respond within one month. Most of your garden data can also be exported or printed directly in the app.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls so users can only read their own records, hashed credentials handled by our authentication provider, and restricted administrative access. No system is perfectly secure, so please use a strong, unique password.

8. Children

The Service is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.

9. Cookies and similar technologies

We use essential cookies and browser storage only — to keep you signed in, remember preferences (such as your zone and units), and secure the checkout flow. We do not use advertising cookies. Paddle sets its own cookies during checkout to process your payment and prevent fraud. You can clear or block cookies in your browser settings, but sign-in will stop working if you block essential ones.

10. Changes

We'll update this notice as the Service changes and revise the date at the top. Material changes will be highlighted in the app.