Privacy policy

Log data: when you visit our website, our servers may automatically log the standard data provided by your web browser. It may include your device's Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, and the time spent on each page.

Account information: if you create an account, we ask for a name (any name you like), an email address, and optionally your hemisphere so seasonal guidance matches your part of the world.

Content you add: the plant records, care logs, notes, heights, and photos you save to your account are stored so the service can show them back to you. They are private to your account: no other user can see them, unless you deliberately create a plant-sitter link (section 1a).

Notification subscriptions: if you turn on notifications for a device, your browser gives us an address for that device and two keys that let us deliver a message to it. That is all it is. It does not identify you, read anything on the device, or work for any purpose other than sending you the care reminder you asked for. Turning notifications off on that device deletes it, and so does deleting your account.

Error reports: if something breaks in your browser, we record the error message, the page it happened on, your browser's user-agent string and, if you are signed in, your account id, so the fault reaches a human who can fix it. These reports go only to DueDrop's own server. We do not use a third-party crash-reporting or telemetry service.

Payments: DueDrop itself never collects payment information. Optional support contributions happen entirely on Buy Me a Coffee's website under their own privacy policy.

If you create a plant-sitter link in your settings, DueDrop publishes a read-only page at a long, unguessable web address. Anyone who has that address can open it without an account, so treat it the way you would treat a house key.

That page shows your first name, your plants and their species, what needs water, when each was last watered, and any notes you wrote on a plant, because notes are usually the instructions a sitter needs. It never shows your email address, your account settings, your care history, or anything else about you.

The link is off until you switch it on. You can replace it at any time, which immediately breaks the old address, or turn it off entirely, which makes the page vanish for everyone.

Two DueDrop features work by sending a photo to a company outside DueDrop. Both are things you start yourself, one photo at a time. Nothing is sent in the background, and neither one looks at the photos already saved to your plants.

"What plant is this?" sends the photo you pick to Pl@ntNet, a botanical identification service, which sends back a list of candidate species. DueDrop does not store that photo: it is passed straight through and discarded with the request.

"What's wrong with it?", where that feature is available to you, sends the photo you pick to Anthropic, along with the care history of the plant you are asking about: its watering schedule, recent entries from its care log, and the pot and light details you have recorded. That context is the point of the feature, because it is what lets the answer be about your plant rather than about plants in general.

Unlike identification, this one keeps the photo: it is saved to that plant's own care timeline along with what the diagnosis said, so you can look back at how the plant was doing and see what you were told last time. It is stored exactly like any other progress photo you add — private to your account, included in your export, and deleted when you delete that log entry, the plant, or your account. Location data is stripped from the copy we keep.

Each company handles what it receives under its own privacy policy. If you would rather not send a photo to either of them, simply do not use those two features. Everything else in DueDrop works without them.

We will process your personal information lawfully, fairly and in a transparent manner. We collect and process information about you only where we have legal bases for doing so. These legal bases depend on the services you use and how you use them, meaning we collect and use your information only where:

• it's necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract (for example, storing your plants and sending the care reminders you signed up for);
• it satisfies a legitimate interest (which is not overridden by your data protection interests), such as operating and improving the service and protecting our legal rights and interests;
• you give us consent to do so for a specific purpose; or
• we need to process your data to comply with a legal obligation.

Where you consent to our use of information about you for a specific purpose, you have the right to change your mind at any time (but this will not affect any processing that has already taken place).

We don't keep personal information for longer than is necessary. While we retain this information, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification. That said, we advise that no method of electronic transmission or storage is 100% secure and we cannot guarantee absolute data security.

We may collect, hold, use and disclose information for the following purposes, and personal information will not be further processed in a manner that is incompatible with these purposes:

• to enable you to access and use DueDrop: your plants, schedules, care logs, and photos;
• to send you the service emails you request, such as watering reminders and password resets;
• to contact and communicate with you about the service;
• for internal record keeping and administrative purposes;
• to operate and improve the website; and
• to comply with our legal obligations and resolve any disputes that we may have.

DueDrop does not sell personal information and does not use your data for third-party advertising.

We may disclose personal information to:

• third party service providers for the purpose of enabling them to provide their services, which for DueDrop means our hosting, data storage, and server providers, our email delivery provider for the messages described above, the photo services described in section 1b on the occasions you choose to use them, and, only if you have accepted analytics under section 7, Google Analytics;
• courts, tribunals, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights.

The personal information we collect is stored and processed in the United States, or where we or our partners, affiliates and third-party providers maintain facilities. By providing us with your personal information, you consent to the disclosure to these overseas third parties.

We will ensure that any transfer of personal information from countries in the European Economic Area (EEA) to countries outside the EEA will be protected by appropriate safeguards, for example by using standard data protection clauses approved by the European Commission, or the use of binding corporate rules or other legally accepted means.

Choice and consent: by providing personal information to us, you consent to us collecting, holding, using and disclosing your personal information in accordance with this privacy policy. If you are under 16 years of age, you must have, and warrant to the extent permitted by law to us, that you have your parent or legal guardian's permission to access and use the website and they have consented to you providing us with your personal information.

Access, correction and portability: you may request details of, a copy of, or corrections to the personal information that we hold about you at any time using the contact details below.

Deletion: you can delete your account, including every plant, log, and photo file in it, yourself at any time from Settings, or ask us to do it for you. It happens immediately and cannot be undone, so export your data first if you may want it. Encrypted disaster-recovery backups keep older snapshots on a tiered schedule (recent ones for weeks, then monthly and yearly archives), so a copy can remain in cold storage for a period before ageing out on its own; those exist only so a server failure cannot erase everyone's records, and a deleted account is never restored from them.

Complaints: if you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us with full details of the alleged breach. We will promptly investigate and respond in writing. You also have the right to contact a regulatory body or data protection authority in relation to your complaint.

Unsubscribe: service emails like watering reminders can be stopped by adjusting or removing your plants' schedules, or by contacting us using the details below.

A cookie is a small piece of data that our website stores on your device when you visit, so we can recognise your browser when you return.

DueDrop uses first-party essential and functionality cookies: a session cookie that keeps you signed in, a security (CSRF) token that protects forms, and small preference cookies that remember your theme and layout choices. These are required for the site to work and are always active.

• We use Google Analytics to count page views and see which care guides people actually find useful. It is switched off by default. The first time you visit, DueDrop asks whether you are willing to be counted.
• If you decline, or simply ignore the question, no analytics cookie is set, no Google script is downloaded, and no request about your visit is ever sent to Google. Declining is remembered so we do not keep asking.
• If you accept, Google Analytics sets its own cookies to tell repeat visits apart, and receives your page views, approximate location, and general device and browser information. Your IP address is anonymised, and DueDrop does not enable any Google advertising or personalisation features.
• To change your mind at any time, use the "cookie settings" link in the footer of any page. It reopens this choice, and declining there stops analytics immediately: the page reloads without them.

DueDrop uses no advertising cookies and no cross-site tracking of any kind, and never sells or shares your information with data brokers.

You can instruct your browser to refuse cookies, with the understanding that signing in will not work without the essential ones.

If we or our assets are acquired, or in the unlikely event that we go out of business or enter bankruptcy, we would include data among the assets transferred to any parties who acquire us. You acknowledge that such transfers may occur, and that any parties who acquire us may continue to use your personal information according to this policy.

Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

At our discretion, we may change our privacy policy to reflect current acceptable practices. We will take reasonable steps to let users know about changes via our website. Your continued use of this site after any changes to this policy will be regarded as acceptance of our practices around privacy and personal information.

If we make a significant change to this privacy policy, for example changing a lawful basis on which we process your personal information, we will ask you to re-consent to the amended privacy policy.