TerraSprout Privacy Policy
Effective date: 24 September 2026
TerraSprout is a gardening app made and run by Dee Terry, doing business as TerraSprout. "We" and "us" in this policy mean Dee Terry. If you have a question about this policy or your information, email ayden@terryadvisors.com.
This policy lives at https://terrasprout.app/privacy.html, and the app links to it from More → How the numbers work.
The short version
- Your garden lives on your phone. The main app has no account and no sign-up.
- We do not sell your information, show ads, or track you across other apps or websites.
- A few features have to send something off your phone to work. They do so only when you use them, and this page lists every one.
- For children under 13, TerraSprout runs in child mode, and nothing personal leaves the phone.
What stays on your phone
Your garden, beds, plantings, notes, harvest records, seed inventory, photos and settings are stored on your device. We cannot see them. If you delete the app, they are deleted too, unless you have saved a backup.
What leaves your phone, and why
Weather
To work out your frost dates and forecast, the coordinates of your garden are sent to Open-Meteo, a weather data service. If you choose "Use my current location", your phone's position is also sent to BigDataCloud to look up the name of your town. If you search for a town instead, the words you type are sent to Open-Meteo's place search. In child mode, the coordinates sent for weather are rounded to about 11 km first.
AI help: photo checks, seed-packet reading and chat
When you ask the AI a question or send it a photo (of a plant, or of a seed packet so the app can fill in its details), the photo or question goes to the TerraSprout server with the garden details needed to answer it: your climate, the plant, its age and the recent weather. The server passes it to an AI provider, Anthropic (Claude), or OpenAI if Anthropic is unavailable, and sends the answer back.
The TerraSprout server does not save your photos or questions. Under their terms for business customers, Anthropic deletes what it receives within 30 days, and OpenAI keeps it for up to 30 days to watch for abuse. Neither uses it to train their AI models.
We ask first. The first time you use any of these features, TerraSprout tells you who receives what and asks for your permission. If you say "Not now", nothing is sent, and the feature does what it can without AI. You can change your answer at any time in Settings → AI. If we ever send your information to a different AI company, or send a new kind of information, we will ask again.
AI help is not available in child mode, and the question is never asked there.
The market
The market lets growers aged 18 and over swap produce with neighbours. If you create a market account, we store:
- your email address;
- your password, in scrambled (hashed) form, so we cannot read it;
- the display name and area name you choose;
- your listings, orders and the messages you send to other growers;
- your location, rounded to about 1 km before it is saved, so buyers can sort listings by distance. We never keep your exact position.
Other growers can see your display name, area name and listings. The pickup note on a listing is shown only to the person who claims it.
Payments
Payments are not switched on yet: the market is for free swaps. When they are, they will be handled by Stripe. TerraSprout will never see your card number, and sellers will give their identity and bank details directly to Stripe. We will update this policy before payments start.
Error reports
When something in the app breaks, a report goes to the TerraSprout server so we can fix it. It contains the error message, which screen and action it happened on, the app version, and a random ID created on your phone so repeated errors can be told apart. Web addresses, email addresses and anything that looks like a password or key are removed from the message first. Reports never include your garden, your name, your location or your photos. The server keeps recent reports in memory only, and they are gone when it restarts. In child mode, reports stay on the phone and are not sent.
Family gardens
Family sync is off until a grown-up turns it on. Until then, and if you never turn it on, nothing about your garden leaves your phone.
When a grown-up turns it on, the phones in your family keep the same family garden through our sync service. Everything about the garden is encrypted on your phone before it leaves. The key that would make it readable is made on your phone and is passed only from one of your phones to another, wrapped so that only the receiving phone can open it. It is never sent to us, and we cannot read what the service holds: not your plants, your notes, your photos, the names people use, or where your garden is.
What the service does hold, and can see:
- an id for your family and an id for each phone in it, neither of which we can connect to a name or an email, because we never ask for one;
- each phone's public keys, and the key material each phone needs, which is scrambled for that phone alone;
- the encrypted changes themselves, with how big each one was, when it arrived, and which phone sent it.
It does not hold anyone's age, and it cannot tell which phone belongs to a child: a child's phone never reaches it at all, and who is who is kept inside the encrypted part. It does hold the key that says which phone may approve changes to the family, such as adding or removing a phone. That is the phone of the grown-up who started the family garden.
What syncs. Only the family garden: its plants, beds, seed packets, journal entries, harvests, and the people's nicknames and emoji. A personal garden never syncs — someone's own pot stays on their own phone. Photos are sent only if you choose that photo, and a photo is remade before it goes, so what the camera recorded in the file (including where it was taken) does not travel with it.
Children. While a young gardener is using a phone, that phone sends and fetches nothing at all, and nothing a child writes is ever sent, on any phone. A child's own phone cannot join a family garden yet.
How long it is kept. A change is kept at most 30 days, and is removed sooner once every phone in the family has it. A family garden that has not synced for a year is deleted. An invitation to add a phone lasts 10 minutes and works once; a phone that asks to join and is never allowed is dropped after an hour. A family garden can hold up to 12 phones.
Removing a phone, and deleting. A grown-up can remove a phone; the key changes at the same time, so what that phone still holds stops being enough. A grown-up can also delete the whole family garden from the service, which removes every change and every phone record we hold for it. Each phone keeps its own copy of the garden, so nobody loses their plants.
Our logs. Our own records for this service note only which kind of request arrived — not your family's id, not any phone's id, not the encrypted contents, and no addresses. Fly.io, which runs the service, sees network addresses as described under "Our servers".
Backups and sharing
When you save a backup or share your garden, the file goes wherever you choose to send it. We do not receive a copy. A backup also holds the app's settings, including the grower's birth year and, in child mode, the grown-up's code in scrambled form, so that restoring it on a new phone keeps child mode on.
Our servers
Our servers run on Fly.io. Their logs record the time, what was requested and whether it worked. They do not record your IP address. Fly.io keeps these logs for about 7 days. To stop abuse, our servers briefly hold IP addresses in memory to count requests. They are not written to disk.
Who receives your information
Only the services named above, and only to make the feature you are using work:
| Service | What it receives | Why |
|---|---|---|
| Open-Meteo | Garden coordinates; the town name you search for | Weather and frost dates |
| BigDataCloud | Your phone's position, only if you choose "Use my current location" | The name of your town |
| Anthropic, OpenAI | Your photo or question and the garden details it needs | AI answers |
| Our sync service (terrasprout-sync) | Encrypted family-garden changes, and the ids and keys of the phones in one family | Keeping a family's phones in step |
| Fly.io | Everything sent to the TerraSprout servers | Hosting |
| Stripe (not yet in use) | Payment details, entered directly into Stripe | Payments |
We do not sell or rent your information, and we do not share it for advertising. We may disclose information if the law requires it.
The website
This policy covers the TerraSprout website as well as the app.
The site is plain pages. It sets no cookies, stores nothing on your device, has no accounts, no ads, and no third-party scripts or fonts, so nothing about your visit is shared with anyone else. There is nothing to consent to and nothing to opt out of.
The company that hosts the site keeps ordinary request logs — the page asked for, the time, and the network address it came from — for a short period, to serve the pages and stop abuse. That is the host's own record, not something we collect or keep, and we add nothing of our own to it. If you want to know who hosts the site on any given day, email us and we will tell you.
We count no visitors today. If we ever do, it will be a service that uses no cookies, does not store network addresses, and cannot follow you from site to site, and this section will name it before it starts.
Phone permissions
- Location, to measure your climate. It's optional: you can search for your town instead. It is not used in child mode.
- Camera and photos, to add photos of your plants and, if you choose, to run photo checks or read a seed packet.
- Notifications, for frost and care reminders. These are scheduled on your phone.
You can change any of these in your phone's Settings at any time.
Children
TerraSprout is suitable for children aged 6 and up. When the app is set up, it asks the year the person growing was born. The year stays on the phone; it is never sent to us or anyone else. For anyone under 13, the app runs in child mode:
- the whole garden works, and stays on the phone as it does for everyone;
- AI help, the phone's GPS and the market are turned off;
- the location is set by searching for a town, and the coordinates sent for weather are rounded to about 11 km;
- error reports stay on the phone;
- while a young gardener is using the phone, family sync sends and fetches nothing at all, nothing a child writes is ever sent from any phone, and a child's own phone cannot join a family garden.
A grown-up sets a 4-digit code when child mode is turned on. The code is needed to change the birth year to an older one, or to erase the app's data, and restoring a backup can never turn child mode off. Child mode ends by itself once the grower is certainly 13. To work that out, the app uses the date in its weather forecasts, not only the phone's clock, so changing the phone's date does not end it early. Because child mode sends no personal information from a child to us or anyone else, we do not collect personal information from children under 13. If you believe a child has given us personal information, email ayden@terryadvisors.com and we will delete it.
The market is only for people aged 18 and over.
Deleting your information
- Your garden: delete it in Settings, under Data, or delete the app. In child mode, erasing needs the grown-up's code.
- Your market account: use "Delete account" in the market. This removes your account, your listings and your messages. Records of past orders stay, so the other person in a trade still has their own record, but your name is removed from them.
- Your family garden: a grown-up can delete it from the sync service in the app, which removes every change and phone record we hold for it. Turning family sync off on one phone stops that phone sending or fetching, and leaves the rest of the family as it is.
- Anything else: email ayden@terryadvisors.com.
Your rights
Depending on where you live, you may have the right to see, correct, delete or get a copy of the information we hold about you, or to object to how we use it. Email ayden@terryadvisors.com and we will respond within 30 days. We will not treat you differently for using these rights.
Security
Market passwords are stored scrambled (hashed), connections to our servers are encrypted, and we keep as little as we can. No system is perfectly secure; if something goes wrong that affects your information, we will tell you.
Changes to this policy
If we change this policy, we will update the effective date at the top. If the change is significant, we will tell you in the app before it takes effect.