TerraSprout Privacy Policy

Effective date: 14 October 2026

TerraSprout is a gardening app made and run by Dee Terry, doing business as TerraSprout. "We" and "us" in this policy mean Dee Terry. If you have a question about this policy or your information, email ayden@terryadvisors.com.

This policy lives at https://terrasprout.app/privacy.html, and the app links to it from More → How the numbers work.

The short version

• Your garden lives on your phone. The main app has no account and no sign-up.
• We do not sell your information, show ads, or track you across other apps or websites.
• A few features have to send something off your phone to work. They do so only when you use them, and this page lists every one.
• Child mode disables AI, the market, GPS and outgoing error reports, and pauses family sync. Weather searches still contact the services described below.

What stays on your phone

Your garden, beds, plantings, notes, harvest records, seed inventory, photos and settings are stored on your device. We cannot see them. If you delete the app, they are deleted too, unless you have saved a backup.

What leaves your phone, and why

Weather

To work out your frost dates and forecast, the coordinates of your garden are sent to Open-Meteo, a weather data service, at the precision your phone has them — they are not rounded the way the market's are. If you choose "Use my current location", your phone's position is also sent to BigDataCloud to look up the name of your town. If you search for a town instead, the words you type are sent to Open-Meteo's place search. In child mode, or before the age question has been answered, the coordinates sent for weather are rounded to about 11 km first.

AI help: photo checks, naming a plant, seed-packet reading and chat

When you ask the AI a question or send it a photo (of a plant, or of a seed packet so the app can fill in its details), the photo or question goes to the TerraSprout server, which passes it to an AI provider, Anthropic (Claude), or OpenAI if Anthropic is unavailable, and sends the answer back.

How much goes with it depends on what you asked for. The advisor chat carries the most, because it can be asked anything: your climate and frost dates, the weather, your growing setup, your plants and their ages, the beds and pots you have told the app about — including the names you gave them and the nicknames on your plants — the notes and harvest records for a planting, and anything you have told the advisor before, plus messages from the current conversation. A photo diagnosis or a photo check carries less: your climate, your growing setup — which includes how experienced you say you are and what you want from growing — the current weather, and the one plant it is about. And, for a diagnosis, whatever you typed describing the problem — that is the question. These photo features do not attach your other plantings, beds, journal, saved town label or precise coordinates. The advisor also omits the saved town label and structured coordinates. Names, addresses or other personal information you type into questions, notes, nicknames or remembered facts can travel in that text. Asking what a plant is carries none of that — that request is the photograph and a fixed question, and nothing about your garden, because the app applies what it knows about your garden to the answer instead of sending it with the question. Reading a seed packet carries the packet photo and the crop you are adding it to — nothing else about your garden.

Photos sent for AI are re-encoded to remove embedded camera metadata, including GPS metadata. Visible content is still sent: faces, house numbers, labels and anything else in the frame. Review both your picture and text before sending.

The TerraSprout relay does not save photo or question content. Under the providers’ standard API policies, inputs and outputs may normally be retained for up to 30 days; safety, abuse-prevention or legal obligations can require longer retention. API data is not used for model training by default. Different account arrangements or features may have different retention. See Anthropic’s API retention policy and OpenAI’s API data controls.

We ask first. The first time you use any of these features, TerraSprout tells you who receives what and asks for your permission. If you say "Not now", nothing is sent, and the feature does what it can without AI. You can change your answer at any time in Settings → AI. If we ever send your information to a different AI company, or send a new kind of information, we will ask again.

AI help is not available in child mode, and the question is never asked there.

The market

The market lets growers aged 18 and over swap produce with neighbours. If you create a market account, we store:

• your email address;
• your password, in scrambled (hashed) form, so we cannot read it;
• the display name and area name you choose;
• your listings, orders and the messages you send to other growers;
• your location, which your phone rounds to about 1 km before it sends it, so buyers can sort listings by distance. The market never receives your exact position — the rounding happens on your phone, not on our server.

Other growers can see your display name, area name and listings. The pickup note on a listing is shown only to the person who claims it.

Payments

Payments are not switched on yet: the market is for free swaps. When they are, they will be handled by Stripe. TerraSprout will never see your card number, and sellers will give their identity and bank details directly to Stripe. We will update this policy before payments start.

Error reports

When something in the app breaks, a report goes to the TerraSprout server so we can fix it. It contains the error message, which screen and action it happened on, the app version, and a random ID created on your phone so repeated errors can be told apart. Web addresses, email addresses and anything that looks like a password or key are removed from the message first. Reports never include your garden, your name, your location or your photos. The server keeps recent reports in memory only, and they are gone when it restarts. In child mode, reports stay on the phone and are not sent.

Family gardens

Family sync is off until a grown-up turns it on. Until then, and if you never turn it on, no family-garden records are sent through the sync service. Other optional features, such as AI and exports, have their own disclosures above.

When a grown-up turns it on, the phones in your family keep the same family garden through our sync service. Everything about the garden is encrypted on your phone before it leaves. The key that would make it readable is made on your phone and is passed only from one of your phones to another, wrapped so that only the receiving phone can open it. It is never sent to us, and we cannot read what the service holds: not your plants, your notes, your photos, the names people use, or where your garden is.

What the service does hold, and can see:

• random ids for your family and its phones; sync does not require an email account or a real name, but these ids link requests from the same family or phone;
• each phone's public keys, and the key material each phone needs, which is scrambled for that phone alone;
• device registration and approval state, invitation expiry and use, sync sequence and key-version information;
• the encrypted changes themselves, with their type (change, snapshot or roster), size, time and sending phone. Hosting infrastructure also sees network addresses.

The sync protocol does not include a birth-year field, and child mode blocks sync requests. Eligible member records are inside the encrypted part. These controls do not identify a child who is using a phone set to an older age mode. It does hold the key that says which phone may approve changes to the family, such as adding or removing a phone. That is the phone of the grown-up who started the family garden.

What syncs. Family-garden records include plantings and their nicknames, beds and their names, seed packets, journal notes, harvests, completed tasks, garden details, and eligible household-member records including nicknames and emoji. Personal-garden plantings and records are excluded; eligible member records are shared across the household. A photo is shared only when you mark that photo for sharing. It is re-encoded to remove camera metadata, including GPS metadata, but people, addresses and other details visible in it remain in the encrypted picture and are readable on approved family phones.

Children. While the phone is in child mode or a young member is active, family sync is paused. The outgoing filter excludes records attributed to a member marked young and excludes that young member’s own record. It cannot recognize a child’s words entered under another member or an older age setting. A phone in child mode cannot join a family garden.

How long it is kept. A change is kept at most 30 days, and is removed sooner once every phone in the family has it. A family garden that has not synced for a year is deleted. An invitation to add a phone lasts 10 minutes and works once; a phone that asks to join and is never allowed is dropped after an hour. A family garden can hold up to 12 phones.

Removing a phone, and deleting. A grown-up can remove a phone; the key changes at the same time, so what that phone still holds stops being enough. A grown-up can also delete the whole family garden from the service, which removes every change and every phone record we hold for it. Each phone keeps its own copy of the garden. Pausing sync, removing a phone or deleting the server’s family garden does not erase copies already received by family phones or backups those people made.

Our logs. Our own records for this service note only which kind of request arrived — not your family's id, not any phone's id, not the encrypted contents, and no addresses. Fly.io, which runs the service, sees network addresses as described under "Our servers".

Backups and sharing

When you save a backup or share your garden, the file goes wherever you choose to send it. We do not receive a copy. A backup also holds the app's settings, including the grower's birth year and, in child mode, the grown-up's code in scrambled form, so that restoring it on a new phone keeps child mode on.

Our servers

Our servers run on Fly.io. Their logs record the time, what was requested and whether it worked. They do not record your IP address. Fly.io keeps these logs for about 7 days. To stop abuse, our servers briefly hold IP addresses in memory to count requests. They are not written to disk.

Who receives your information

Only the services named above, and only to make the feature you are using work:

We do not sell or rent your information, and we do not share it for advertising. We may disclose information if the law requires it.

The website

This policy covers the TerraSprout website as well as the app.

The site is plain pages. It sets no cookies, stores nothing on your device, has no accounts, no ads, and no third-party scripts or fonts, so nothing about your visit is shared with anyone else. There is nothing to consent to and nothing to opt out of.

The company that hosts the site keeps ordinary request logs — the page asked for, the time, and the network address it came from — for a short period, to serve the pages and stop abuse. That is the host's own record, not something we collect or keep, and we add nothing of our own to it. If you want to know who hosts the site on any given day, email us and we will tell you.

We count no visitors today. If we ever do, it will be a service that uses no cookies, does not store network addresses, and cannot follow you from site to site, and this section will name it before it starts.

Phone permissions

• Location, to measure your climate. It's optional: you can search for your town instead. It is not used in child mode.
• Camera and photos, to add photos of your plants and, if you choose, to run photo checks, name a plant from a photo, or read a seed packet.
• Notifications, for frost and care reminders. These are scheduled on your phone.

You can change any of these in your phone's Settings at any time.

Children

TerraSprout is suitable for children aged 6 and up. When the app is set up, it asks the year the person growing was born. This setting stays on the phone and is not added to service requests; it is included in backups you choose to export. For anyone recorded as under 13, the app runs in child mode:

• the whole garden works, and stays on the phone as it does for everyone;
• AI help, the phone's GPS and the market are turned off;
• the location is set by searching for a town, and the coordinates sent for weather are rounded to about 11 km;
• error reports stay on the phone;
• family sync is paused in child mode or while a young member is active; its outgoing filter also excludes records attributed to members marked young. A phone in child mode cannot join a family garden.

A grown-up sets a 4-digit code when child mode is turned on. The code is needed to change the birth year to an older one, or to erase the app's data, and restoring a backup can never turn child mode off. Child mode ends by itself once the grower is certainly 13. To work that out, the app uses the date in its weather forecasts, not only the phone's clock, so changing the phone's date does not end it early. These protections depend on the age and active-member settings; they cannot identify a child using an adult profile or remove a child’s details from text or pictures an adult chooses to share. We do not intend to collect children’s personal information. If you believe a child has given us personal information, email ayden@terryadvisors.com and we will delete it.

The market is only for people aged 18 and over.

Deleting your information

• Your garden: delete it in Settings, under Data, or delete the app. In child mode, erasing needs the grown-up's code.
• Your market account: use "Delete account" in the market. This removes your account, your listings and your messages. Records of past orders stay, so the other person in a trade still has their own record, but your name is removed from them.
• Your family garden: a grown-up can delete it from the sync service in the app, which removes every change and phone record we hold for it. Turning family sync off on one phone stops that phone sending or fetching, and does not delete the server’s records or copies already held by other phones.
• Anything else: email ayden@terryadvisors.com.

Your rights

Depending on where you live, you may have the right to see, correct, delete or get a copy of the information we hold about you, or to object to how we use it. Email ayden@terryadvisors.com and we will respond within 30 days. We will not treat you differently for using these rights.

Security

Market passwords are stored scrambled (hashed), connections to our servers are encrypted, and we keep as little as we can. No system is perfectly secure; if something goes wrong that affects your information, we will tell you.

Changes to this policy

If we change this policy, we will update the effective date at the top. If the change is significant, we will tell you in the app before it takes effect.