Privacy.

Routine Garden is operated by Routine Garden in Spain. References to "we", "our", or "Routine Garden" refer to that operator, who is the data controller for the information described here.

Privacy questions or requests: privacy@routinegarden.app · Mailing address: Granada, Spain.

• Email address — your account identifier; also used to deliver confirmation links, sign-in links, transactional emails, and (with consent) the weekly recap.
• Password hash — if you sign up with email + password. Stored as a cryptographic hash (handled by our auth provider, Supabase), never as plain text.
• Display name— only what you type during onboarding. Skipping it defaults you to "Friend".
• Routines you create: title, category, plant species assignment, schedule type, and the order you place them in.
• Completions — a row each time you tap Water, with the local-calendar date.
• Plant state — current stage (seed → mature) and total completions, derived from your completion rows.
• Reminder hour + timezone — to fire the daily push at the hour you chose, in your local time.
• Push subscription — the endpoint URL + encryption keys your browser/PWA hands us when you opt in to push.
• Family membership — which family (if any) you belong to, and your role (owner / parent / kid).
• Stripe customer + subscription IDs if you upgrade. Card details never touch our servers — Stripe handles them.
• Founding-seat number if you bought the lifetime tier, plus the timestamp you confirmed it.
• Weekly-recap rows — one per week summarising your totals + a URL to the shareable card image.

• Photos of you, your family, your home — there is no upload anywhere.
• Precise location / GPS — never requested by the app.
• Mood, health, body, or appearance data.
• Contacts, calendar, browsing history.
• Voice or microphone input.
• Biometric identifiers of any kind.
• Analytics tied to your identity. The only marketing pixel is a consent-gated Pinterest tag that stores a hashed first-party cookie, and only after you accept the cookie banner.

We never sell your personal information, and we never "share" it for cross-context behavioral advertising as those terms are defined under California and other US state privacy laws.

You must be 18 or older to create a Routine Garden account. We do not knowingly collect personal information from children under 13.

Children participate onlyas profiles inside a family that a parent or guardian creates and controls. A child does not sign up, does not provide an email, and does not have their own login — the parent is the account holder and the data subject for all billing and communications, and any information about a child is provided by that parent acting on the child's behalf. We collect no behavioral data on children, show them no ads, and never share or sell a child's information.

If you believe a child under 13 has somehow provided us personal information without a parent's involvement, email privacy@routinegarden.app and we will delete it promptly. Parents may review, delete, or refuse further collection of their child's information at any time from Settings or by emailing us.

If you live in California, Virginia, Colorado, Connecticut, Utah, or another US state with a consumer-privacy law, you have the right to:

• Know & access — see and download what we hold about you (Settings → Export everything).
• Delete — erase your account + all associated data (Settings → Delete account).
• Correct — fix your display name, reminder hour, timezone, or any routine, in-app, any time.
• Opt out of sale / sharing — not applicable, because we never sell or share your data for advertising. There is nothing to opt out of.
• Non-discrimination — exercising any right never changes your price or service.

To exercise any right, use the in-app controls above or email privacy@routinegarden.app. We respond within 45 days (CCPA) and don't charge a fee for reasonable requests. California residents may also designate an authorized agent.

We're based in Granada, Spain, so the EU GDPR (Regulation 2016/679) and the Spanish LOPDGDD (Organic Law 3/2018) apply to everyone we serve in the EU/EEA. The UK GDPR applies to UK users. Our legal bases are:

• Contract — email, display name, routines, and completions are processed to provide the service you signed up for.
• Legitimate interest — anti-abuse + security logging and payment fraud-prevention. You may object at any time.
• Consent — push notifications, weekly-recap emails, and the Pinterest analytics cookie. Withdraw any time.
• Legal obligation — invoices + tax records (held by Stripe per applicable law).

You have the rights to access, rectify, erase, restrict, object, and to portabilityof your data, plus the right not to be subject to solely automated decision-making with legal effects (we don't do this — there are no automated decisions about you in the product).

You also have the right to lodge a complaint with your supervisory authority. Our lead supervisory authority is the Spanish AEPD (Agencia Española de Protección de Datos). UK users may contact the ICO (ico.org.uk). You can also raise it with the data-protection authority in your country of residence — they will coordinate with the AEPD.

Because we're established in the EU (Spain), we are the data controller directly and don't need to designate a separate GDPR Article 27 representative.

• Supabase, Inc. — database + authentication.
• Stripe, Inc. — payments, if you upgrade. Card data is held by Stripe; we never see card numbers.
• Vercel, Inc. — application hosting + edge functions.
• Resend — transactional + marketing-adjacent email.
• Cloudflare R2 + CDN — caches your shareable weekly-recap card images.
• Cloudflare Turnstile — bot challenge on signup.
• Pinterest Tag — pageview pixel, only loaded after you accept the cookie banner.

We share data with no one else. Full processor list with addresses + data-processing agreements available on request to privacy@routinegarden.app.

• Authentication cookies (Supabase) — required for sign-in. Strictly necessary; no consent needed.
• Cookie-consent preference (localStorage) — remembers your accept/reject choice.
• Pinterest Tag cookie (1p, hashed) — loaded only after you accept. Reject it and the tag never loads.
• iOS install-banner flag(localStorage, 14-day expiry) — so we don't re-prompt you to add the PWA.
• Service-worker cache — your installed PWA stores HTML + static assets for offline use. No personal data.

• We keep your account data (profile, routines, completions, plant state, family membership) until you delete it. There is no automatic expiry — your garden is yours for as long as you want it.
• When you delete your account, your data is removed immediately and permanently. There is no recovery window — once it's gone, it's gone.
• Payment + invoice records held by Stripe are retained by Stripe per their legal obligations, separate from our database. Deleting your Routine Garden account does not erase Stripe's tax records.
• Email unsubscribe records are kept so we can honor your opt-out.

• Export — Settings → Export everything downloads a machine-readable JSON file of all your data.
• Delete — Settings → Delete account, immediate and permanent.
• Correct — edit your name, reminder, timezone, or any routine in-app.
• Opt out of marketing — one tap in any marketing email (one-click unsubscribe), or turn off push in Settings → Daily reminder.

Or email privacy@routinegarden.app and we'll handle any request manually.

Connections are TLS-only. Database access is gated by row-level security policies enforced by Supabase Postgres; no application code reads another user's data. Sign-in works via an email + password pair OR a one-time email link — passwords are hashed cryptographicallyby our auth provider before persistence; we never see or store your plain-text password. Card data is held by Stripe and never touches our servers. If a personal-data breach affects you we'll notify you without undue delay (within 72 hours where required by GDPR Article 33 / Article 34), and we'll notify the AEPD and any other relevant authority as legally required.

We'll email you on material changes (anything affecting processing, retention, or your rights). The version date at the top of this page reflects the most recent change.