Privacy

Plantdex is operated by Lillian Jahr, trading as Plantdex. Questions about anything on this page, or a request about your own data, go to bboymont@gmail.com.

Plantdex is operated from the United States and is intended primarily for users in the United States. The service is not specifically marketed to residents of the European Union, United Kingdom, or other jurisdictions outside the United States.

Privacy rights vary by location. Where applicable law gives you rights relating to your personal information, Plantdex will honor those rights as required by that law. You may contact us at bboymont@gmail.com to request access, correction, deletion, or other rights that apply to you.

Nothing in this policy is intended to waive rights that cannot legally be waived or to claim that a particular privacy law does not apply where it does.

Most of Plantdex works signed out, and when you use it that way nothing you do leaves your device. There is no server call to record it, because for a signed-out visitor there is no server involved at all — the site is a set of static files.

Your progress is kept in your own browser, under these keys:

Local storage

Which plants you have discovered, learned and mastered; Field Research completions and achievements; your sightings; which cards you have revealed for reading; the current research board; your Seed Shelf — species you identified that have no card yet, with the dates you found them; and your profile settings — a display name you choose, and which plants, frame, title and achievements you have picked for it.

IndexedDB

Photographs you attach to a sighting. They are held in the browser database because a single phone photo is far larger than local storage can hold.

Because this is browser storage, clearing your site data deletes it, and nobody — including us — can recover it. That is the trade-off for a version that asks you for nothing.

An account exists so your collection follows you between devices. Creating one asks for an email address and a password, and nothing else. There is no username and no date of birth, because the application has no such fields. You may give yourself a display name and pick an avatar on your profile, but both are optional, neither is asked for at sign-up, and your profile is visible only to you — there are no public profiles, followers or leaderboards here.

Signed in, these things are stored on our behalf by Supabase:

Your email address

Held by Supabase Auth so you can sign in and reset your password. Your password is never stored in a readable form.

Collection progress

One row per fact: which plants you discovered, learned and mastered, which Field Research tasks you completed, and which achievements you unlocked — each with the date it happened.

Sightings

The date, an optional free-text region you type yourself, optional notes, an optional growth stage, and whether it was a return visit.

Sighting photographs

Resized and re-encoded on your device before they are stored, which strips the EXIF metadata a camera writes — including any GPS coordinates. The original camera file is never stored: a photo your browser cannot re-encode is refused rather than saved as it came. What is stored goes in a private bucket, in a folder belonging to your account; it is not public, and not readable by other signed-in users.

Your Seed Shelf

One row per save: the scientific name an identifier suggested, its common name and taxonomy ids where the provider gave them, the date, the score, and a reference to the scan it came from. A shelf entry records a plant you photographed that has no Plantdex card. It is not a discovery, earns nothing, and says nothing about whether a plant is safe.

Profile settings

Only the choices you make: an optional display name, and the ids of the plants, frame, title and achievements you have picked. It holds no level, XP or counts — those are recalculated from the rows above, the same as everywhere else.

Your XP and level are not stored. They are recalculated from the rows above every time they are shown, which is why there is no score in the database to lose, leak or dispute.

Plantdex does not use your device’s location. It never requests location permission, and it stores no coordinates.

Plantdex does not upload or store camera location metadata. A phone writes GPS coordinates into a photograph whether or not you meant it to. Every scan or sighting photograph is re-encoded on your device first, and that re-encoding drops the EXIF metadata the coordinates live in. There is no exception for a format that cannot be re-encoded: such a photo is refused rather than kept or sent as it came.

A sighting has a region field, but it is free text you type — “the woods behind the school”, “north field” — and the application neither interprets it nor checks it. Whatever you write there is what is stored, so write it as loosely as you like.

These are properties of the current build, not intentions:

No cookies

The site sets none at all. Your signed-in session is kept in your browser’s local storage, not a cookie.

No advertising or session recording

No tag manager, no advertising pixel, no session recorder, no heatmap and no mouse tracking. Nothing watches what you do on a page; see “Measurement” below for the small amount that is counted.

Almost no third-party requests

Loading a page contacts our own host, the analytics script described below, and — only once you sign in — Supabase. Even the fonts are served from our own site rather than fetched from a font provider.

No selling or sharing

Your data is not sold, rented, shared with advertisers, or used to train anything.

No profiling

Nothing you do is used to build a profile of you, and no automated decisions are made about you.

Links to external references — the journals and university pages cited on plant pages — are ordinary links. Nothing is requested from those sites unless you click through.

We count how the site is used, so we can tell which parts of it work. That counting is done by Plausible Analytics, which is the only third-party script the site loads.

Plausible sets no cookies and stores no identifier on your device. That is why you have never been asked to accept cookies here: there are none to accept. It is also why nothing below can be tied back to you, or to your previous visits.

What is counted:

Page views

Which page was opened, plus the coarse information any web request carries anyway — a rough country, a browser, a device type, and which site linked here.

A short list of actions

Opening the collection, the garden or your profile; viewing, revealing, discovering or mastering a card; passing a knowledge check; finishing a Field Research task; starting or completing a sign-up; signing in; and importing local progress into an account.

Nothing attached to them

Each action is counted by name and carries no attached data whatsoever. The function that records them accepts an event name and nothing else, so there is no field an address, an identifier or anything you typed could travel in — not by mistake and not by a later edit. A test fails the build if that ever stops being true.

What is deliberately never sent:

Nothing that identifies you

No email address, no account id, no session id, no persistent identifier of any kind. A signed-in visitor and a signed-out one are indistinguishable in the analytics.

Nothing about which plant

The actions above are counted as bare totals. Where a page view already records which plant page was open, that is the ordinary page address — the same thing every web server sees — and not a record of what you personally collected.

Nothing you wrote or photographed

Sighting notes, region text and photographs are never sent to the analytics service, in whole or in part.

No location

No coordinates, and nothing derived from your device location — the site never asks for it in the first place.

Measurement is switched on by a single build-time setting. When it is off, the script is not loaded and nothing is sent at all — which is the state of any local copy of the site and of any fork.

Supabase provides the database, authentication and file storage that accounts depend on. They hold the data described above on our behalf, on servers in East US (North Virginia), in the United States.

The Supabase Data Processing Addendum, Version 1 dated August 1, 2026, forms part of the Supabase Terms of Service and is effective as of the Effective Date of the Agreement. Plantdex has not separately executed one, and under the addendum’s own terms does not need to.

GitHub Pages serves the site’s files. Like any web host it necessarily sees the network requests that fetch those files.

Plausible Analytics receives the counts described above, and nothing else.

PlantNet identifies plants from photographs you choose to submit, and receives nothing else.

Stripe handles payment if you buy the printed deck. They receive your name, delivery address, email and payment details directly — none of it passes through this site. Stripe is contacted only when you click through to checkout; browsing Plantdex, including the shop page, contacts them not at all.

Signed out and not buying anything, only GitHub Pages and Plausible are involved.

Plant identification sends your photograph to PlantNet, an identification service, and shows you what came back. It happens only when you choose to identify something.

The photograph, resized and stripped

Before it leaves your device it is re-encoded, which drops its EXIF metadata — including any GPS coordinates your camera recorded. The original file is never sent: if your browser cannot re-encode the format, the scan is refused rather than sent as it came.

Nothing that identifies you

No account id, no email and no name is sent to the identification service. It receives an image and returns names; it is not told whose image it is.

A daily count, so one device cannot use up the allowance

Signed in, the counter is keyed to your account. Signed out, it is keyed to a one-way hash of your network address combined with a secret and the current date — that value cannot be turned back into an address, cannot be linked to yesterday, and is deleted within days. The address itself is never stored.

Your scan history, only if you have an account

What you photographed, what was suggested and what you confirmed. You can delete any of it, it is in your data export, and it is erased with your account. Signed out, no history is kept anywhere.

An identification is a suggestion from an image. It is never a statement that a plant is safe to eat, drink or apply.

Checkout happens on Stripe’s own pages, not on this site. Your card number never reaches Plantdex — there is no payment form here, no Stripe script on these pages and no key that could collect one. What we receive from Stripe afterwards is what is needed to pack and post an order.

An order is not connected to a Plantdex account. Buying a deck does not create one, does not unlock anything, and leaves no trace in your collection — Stripe holds the order, this site holds the collection, and nothing joins the two. That is also why deleting your account has no effect on an order, and why a refund has no effect on your collection.

Stripe’s own privacy terms cover what they do with payment data, which is outside what this repository can describe.

Every table is protected by database rules that allow a signed-in person to read and write only their own rows, checked by the database itself on every query rather than by the app asking politely. Photographs are scoped the same way, to a folder named after your account.

There is deliberately no update permission anywhere: rows can be created and deleted, never edited. It means a record of when you found something cannot be quietly rewritten afterwards — including by us.

Use it without an account

The whole collection, garden, journal and research system works signed out, with nothing sent anywhere.

Delete a sighting

Any sighting can be deleted from the journal, signed in or out. Deleting one never removes progress it previously earned.

Delete your account

On your profile page, under “Your data”. It removes every row described above, every photograph you have uploaded, and the account and email address themselves. It is immediate and permanent: we keep no copy and cannot restore any of it, so you are asked to type the word DELETE first.

Download your data

On the same page. It produces a single JSON file containing your collection, research, achievements, every sighting and every photograph — signed out, it exports what this browser holds instead. If a very long journal of photographs exceeds what a browser can assemble into one file, the file lists by name which photographs were left out and why; nothing is dropped silently.

XP and level are not in the export, because they are not stored anywhere: they are recalculated from the records above every time they are shown.

Your data stays until you delete it. Deleting your account removes it immediately — the rows and the photographs both, in that order, and the account itself last, so a failure part-way through can never leave photographs behind with no owner.

Whether anything is retained in backups after that, and for how long, is governed by Supabase's own backup schedule rather than by Plantdex — nothing is kept in the application itself, and no copy is made anywhere else.

Plantdex is a plant identification deck, and children plausibly use it. The application does not ask for or verify age. The minimum age for holding an account is 13 years old.

The date at the top is the day this description was last checked against the application. When what Plantdex does with data changes, this page is updated in the same change — not afterwards.

See also the Terms of Use.