Privacy policy

Last updated: November 12, 2026

The privacy of your data, and it is your data, not ours, is a big deal to us. In this policy we lay out what data we collect and why, how it’s handled, and your rights over it. We never sell your data, and we don’t show ads.

This policy covers VeraScape, the garden design app for iPad, Android and the web, and our website, verascape.app. Both are made by VeraScape Studios LLC, a Pennsylvania limited liability company (“VeraScape”, “we”, “us”).

• What we collect and why
• What stays on your device
• Cookies
• When we access or disclose your information
• Your rights with respect to your information
• How we secure your data
• What happens when you delete a project or your account
• Data retention
• Children
• Location of site and data
• Changes and questions

What we collect and why

Our guiding principle is to collect only what we need. Here’s what that means in practice.

Identity and access

When you sign up, we ask for your email address and a password. Your email is how you sign in and where we send a password reset link. We store your password only as a one-way hash (scrypt), never the password itself. We also keep your choice of units (feet or metres).

We don’t ask for your name, phone number, postal address or date of birth. Sign-up asks you to confirm you’re 18 or older, and we record when you confirmed it, not your age.

While sign-up is by invitation only, we record which invite code you signed up with. The code holds no personal data; we keep a note of which group it was for (like “TestFlight wave 1”) and how many times it’s been used.

Each time you sign in, we record a session for that device: a short label the app sends, like “iPad” or “Chrome on Mac”, when you signed in, and when the session was last used (to the nearest hour). The label never includes a device model, serial number or device ID, and we don’t store your IP address with it. You can see your signed-in devices in Profile. Signing out deletes that device’s session; “Sign out everywhere” and a password reset delete all of them; and every session is deleted on its own when it expires, 7 days after sign-in.

Your designs and yard photos

We store on our servers what you create in the app, so you can use it as intended:

• Yard photos you add to a project. Before a photo leaves your device, the app resizes it and saves it as a new image, which drops the hidden metadata a camera adds, including any GPS location, camera model and time stamp.
• Projects: the project name, the photo and how you’ve rotated or adjusted it, the measurements you mark on it, the plants, beds, features and sun or shade zones you place, the hardiness zone, the month shown, and any layouts you copy from a project.
• Your project’s US state (and, for a few large states, which part of it), if you set one. We use it to name that state’s official invasive plant list and to show plants suited to your region first. It’s stored with the project, so it follows the project to your other devices. It’s a state code like “PA”, not a location.
• Favourite plants you star.
• Plants you add yourself (“Add your own”): the name, height, spread and shape you enter.
• Plant requests you send us: the plant’s name, and the botanical name, sizes and note if you add them. We read these to decide which plants to add to the catalog.

Your photos and designs are private to your account; no other user can see them. We keep them as long as your account is active. We don’t use them to train AI.

Your location, only when you ask

Creating a project or editing its settings offers “Use my location” to suggest your USDA hardiness zone. When you tap it:

• The app asks your device for your approximate location, once. It never asks on launch and never tracks you in the background. On iPad it asks for “while using the app” permission at reduced accuracy; on Android, approximate location only; on the web, your browser’s prompt with high accuracy off.
• The app works out the zone on your device, from a copy of the USDA 2023 Plant Hardiness Zone Map that ships with the app. Your location isn’t sent to us.
• On iPad and Android, the app also asks your device’s built-in map service (Apple’s on iPad, Google’s on Android) for the nearest town and state, so it can say “Zone 6b, from your location near Doylestown, PA” and fill in the project’s state. That one request sends the approximate coordinates to Apple or Google, under their own privacy terms. The web version skips it.
• The coordinates are thrown away as soon as that’s done. The town name is shown while the screen is open, then discarded.
• What’s saved, with the project, is the zone (like “6a”) and, if you keep it, the state. We never store your coordinates or a history of where you’ve been.

You can always pick the zone and state by hand instead.

Product interactions

We collect usage data to learn which parts of the app work and which confuse people. In the app there are two kinds, and our website sends a few more.

Milestones, in our own database. For example: a project was created, a photo was measured, the first plant was placed, a bed was drawn, a shopping list or image was exported, a tutorial step was finished. Each records the event, a few details about it (like the photo’s size in pixels, how many measuring sticks were used, or which plant was placed), your account ID and the time. They never include your photo, a location, your project’s name, or anything you typed. No outside company sees them.

Product analytics, sent to PostHog. For example: a plant search, including the words searched for; opening a plant’s details; starring a plant; and the steps of measuring a photo. Each event carries your account ID (a random code, never your email or name), whether you’re on iPad, Android or the web, whether the device draws full or lighter graphics (picked from its memory, or chosen in Settings), and the app version. Before a search is sent, anything that looks like an email address or phone number is removed. We don’t send screen views, taps, session recordings, your device model, your location or advertising identifiers. PostHog is told not to look up a location from your IP address, and our PostHog project is set to discard IP addresses.

You can turn product analytics off at any time in Profile → Settings → Usage data. Then nothing more goes to PostHog, and events still waiting on your device are deleted. Nothing goes to PostHog from the app while you’re in a tutorial, or while you’re signed out, with one exception: if you open the web app on a phone, the page you see instead (see “The waitlist” below) sends PostHog that it was shown and which button you used, with the site that linked you there (just its name, like reddit.com). Those events carry a new random code each time, not an account ID, so they can’t be tied to each other or to you, and never the email address you type. That page has no Usage data switch yet, since it comes before the app’s settings, but nothing it sends identifies you.

Visits to our website, sent to PostHog. When one of the plant pages on verascape.app opens, it sends PostHog which plant’s page it was, and the address of the website that linked to it (just the site, like “google.com”), if there was one. If you press its button to see the plant in your yard, it sends which plant and where the button leads. If you join the early access waitlist on our home page, it sends that someone joined, which plant page sent you there, if one did, and the site that linked you (just its name). Never your email address. These are sent without an account, a cookie, or anything saved in your browser, so they can’t be tied to you or to each other. PostHog is told not to look up a location from your IP address, as above. If your browser sends a Global Privacy Control signal, our website sends nothing.

Crash reports

When the app crashes or something goes wrong, a report goes to Sentry, an error-tracking service: the technical details of the error, your device model, operating system version, screen size, memory and app version, a short trail of what the app was doing just before (like “placing a plant” or “photo failed to load”), and your account ID. It doesn’t include your email, IP address, photos or passwords, and we strip password reset links, invite codes and working photo links out before it’s sent. Sentry also gets performance data with the same details: how long the app took to start and each screen to load, and how often drawing stuttered. During the beta that’s every app launch; later it will be a small share of them. Our server reports its own unexpected errors to Sentry the same way, without the content of your request.

Email

We send email for password resets, the link you ask for on a phone, the waitlist’s announcement and early access invites (below), through Resend, an email delivery service. It gets your email address and the message; a reset email holds a link that works once and expires after an hour. We don’t track whether you open the email or click the link, and we don’t send marketing email.

The waitlist. VeraScape is made for iPad and computers. If you visit on a phone, you can leave your email address to hear when the iPad app arrives in the App Store, or ask us to email you the link to open later. For the waitlist we keep your email address, whether you joined from the app or the website, the name of the site that sent you (like reddit.com), and when. We use it only for that announcement, every email we send to the list has an unsubscribe link, and we delete your address when you unsubscribe, or six months after the announcement at the latest. “Email me the link” sends one email through Resend and doesn’t keep your address. No account is created, and we don’t share the list.

Early access. On our website’s home page you can leave your email address for an invite to VeraScape’s early access. We keep your email address, the plant page that sent you there (if one did), the name of the site that linked you (like reddit.com), and when. We use it only to email you once, when your invite is ready; there’s no newsletter. That email has an unsubscribe link, and we delete your address when you unsubscribe, or six months after we send your invite at the latest. No account is created until you accept the invite, and we don’t share the list.

General technical data

Like any online service, our servers see the IP address and basic details of each request. We use IP addresses, and for sign-in, password reset and emailed link requests the email address typed, for a short time to limit repeated attempts (those counters clear within an hour). We leave IP addresses out of our own request logs, which our hosting provider keeps for 7 days. We don’t use IP addresses to locate or profile you.

Billing information

VeraScape doesn’t sell anything yet. When it does, payments will go through Apple (in the iPad app) or Stripe (on the web), and your card details go straight to them, never to our servers. We’ll keep a record of what you bought and the payment provider’s transaction ID.

Voluntary correspondence

When you email us with a question or for help, we keep that correspondence, including your email address, so we have the history if you get in touch again.

Reports you send us

You can tell us a plant looks wrong (on its details page) or report a problem or an idea (in Profile, or the account menu in the designer). We keep what you pick and type, with your account ID and the time. So you don’t have to describe your setup, the app adds the app version, whether you’re on iPad, Android or the web, whether it draws full or lighter graphics, the screen you were on, and, if the app has sent a crash report since you opened it, that report’s ID so we can find it. A plant report also says which picture you were looking at and, if you sent it from a plant in your design, which project it’s in. Before a report is sent, anything you type that looks like an email address or phone number is removed. We read reports to fix problems and improve the plant catalog; we don’t promise a reply, and no outside company sees them. PostHog only learns that a report was sent and the choice you picked, never what you typed.

How we approach mobile app permissions

The app asks your permission before using your camera (to take a yard photo), your photo library (to pick one) and your location (for the zone, as above). Each is optional: you can say no and pick a photo or zone another way. You can change these permissions at any time in your device’s settings.

What stays on your device

So the app works with a weak signal, and so unsaved work isn’t lost, your device keeps some data itself:

Drafts and the items marked “account is deleted” stay on the device after you sign out, so signing out never loses unsaved work. If you share a device, remove the app or clear the browser’s site data when you stop using it.

The iPad and Android apps also keep a random ID for this install, which they send when checking for updates (see Expo, below). It isn’t linked to your account and goes when you remove the app.

Cookies

VeraScape doesn’t use cookies, and we don’t use advertising or tracking cookies of any kind. On the web, the app keeps the items in the table above in your browser’s local storage instead. They stay in your browser: the app reads them, and your browser doesn’t send them to us or anyone else on its own. Our website, where these pages are published, sets no cookies either and keeps nothing in your browser.

When we access or disclose your information

To provide the app. We use a few service providers (subprocessors) to run VeraScape. They handle data on our behalf, under contracts that limit what they can do with it:

Apple and Google see what their platforms see: app downloads through their stores, and the one location lookup described above, under your agreement with them.

No VeraScape human looks at your designs or photos except with your permission (for example, to help with a support request) or in the rare cases below.

AI. VeraScape doesn’t send your photos or designs to any AI service. The plant illustrations in the app were made in advance with AI image tools (Google Gemini to redraw and Bria to cut out, both through fal.ai), from reference photos credited on the Acknowledgements screen.

To investigate, prevent or act on misuse of the service (see the Terms of Service), as a last resort.

Aggregated and de-identified data. We may combine or de-identify usage data, for example “how many projects were created this month”, and use it to improve the app. It can’t be tied back to you.

When required by law. VeraScape Studios LLC is a US company and our data infrastructure is in the US. We share user data with authorities only when compelled by valid legal process, such as a warrant, subpoena or court order, or in an emergency involving risk to someone’s life. Unless the law forbids it, we’ll tell you before we do.

If the business changes hands. If VeraScape Studios LLC is acquired or merges with another company (we don’t plan on it), we’ll notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.

What we never do: sell your personal information, share it for advertising, show ads, track you across other companies’ apps or websites, or use advertising identifiers. Because we don’t track you across sites, we treat everyone the same way whether or not their browser sends a “Do Not Track” signal.

Your rights with respect to your information

We aim to give everyone the same rights, wherever they live:

• Right to know. This policy lists what we collect, how we use it and who we share it with.
• Right of access and portability. You can ask for a copy of the personal information we hold about you.
• Right to correction. You can change your units in Profile → Settings, set a new password with “Forgot password?” on the sign-in screen, and ask us to correct anything else, including your email address.
• Right to erasure. You can delete your account yourself in the app (see below), or ask us to.
• Right to opt out. You can turn off product analytics in Profile → Settings, and location permission in your device’s settings. There’s nothing to opt out of on sale of data: we never sell it.
• Right to non-discrimination. Using these rights never changes what you pay or the service you get.

To make a request, email support@verascape.app. We may need to confirm it’s you, usually by replying from your account’s email address. We’ll answer within 30 days.

California residents. This policy is meant to meet the California Online Privacy Protection Act: the kinds of personal information we collect are listed above, with the companies we share it with and how to review or change it. We don’t sell or “share” personal information as California law defines those words.

How we secure your data

All data travels encrypted (HTTPS/TLS) between the app and our servers. Passwords are stored only as hashes. Yard photos are kept in private storage, and the app reaches each one through a link that works for a little over an hour and that only your account can request. We limit repeated sign-in attempts. No service can promise perfect security, but we take reasonable steps to protect your data, and we’ll tell you, as the law requires, if a breach affects it.

What happens when you delete a project or your account

Deleting a project deletes it and its photo from our servers straight away.

Deleting your account: you can do it yourself at any time in the app, under Profile → Delete account, by entering your password. That immediately and permanently deletes your account, email, password, projects, yard photos, favourites, plants you added, plant requests, reports you sent us, signed-in sessions and usage milestones from our database and storage. The app also clears your drafts, offline copies, tutorial progress and waiting events from the device you delete it on. Other devices you’ve used drop their offline copies and photos the next time they sign out or try to sign in, but a draft left on another device stays until the app is removed there.

Two things outlast your account:

• Purchase records, unlinked from you. If you’ve bought anything, we keep a financial record of each purchase (what was bought, the amount, the date and the payment provider’s transaction ID) for taxes, refunds and disputes, without your email, name or account ID. Apple and Stripe keep their own records.
• Analytics already sent to PostHog stay there under your old account ID, which no longer matches anyone. If you’d like them deleted too, email us before you delete your account, so we can find them, and we’ll delete them.

If you can’t sign in, email support@verascape.app and we’ll help.

Data retention

We keep information only as long as we need it for the reasons above:

• Account, designs, photos, plants you added, plant requests, reports you sent us and usage milestones: while your account is active.
• Photos uploaded but never used in a project: deleted after about a day.
• Signed-in sessions: until you sign out, and 7 days after sign-in at most.
• Password reset links: until used, or one hour. Reset emails in Resend’s logs: 30 days.
• Counters that limit repeated sign-in, sign-up and reset attempts: an hour at most. Counters that limit emailed links: a day at most.
• The waitlist: until you unsubscribe, and six months after the App Store announcement at most. Early access sign-ups: until you unsubscribe, and six months after we send your invite at most.
• Our server’s request logs (no IP addresses): 7 days.
• Product analytics in PostHog: kept available for 1 year, or until we delete them on request.
• Crash reports in Sentry: 30 days. Performance data in Sentry: 30 days.
• Update checks at Expo: as long as Expo reasonably needs them, under its own policy, which sets no fixed period.
• Backups: we keep backups so we can recover from mistakes and outages, so deleted data can remain in a backup for up to 30 days before it’s gone for good.

Children

VeraScape is for adults. You must be 18 or older to create an account, and sign-up asks you to confirm it. One reason is that AI services we may use for future features don’t allow use by anyone under 18. We don’t knowingly collect data from anyone under 18; if you believe a child has made an account, email support@verascape.app and we’ll delete it.

Location of site and data

VeraScape is operated in the United States. Your data is stored and processed in the United States and in other countries where our service providers operate. It’s offered to people in the US.

Changes and questions

We may update this policy to reflect new features or legal requirements. When we make a significant change, such as a new kind of data or a new use of your photos, we’ll update the date at the top and tell you in the app or by email before it takes effect.

Questions, comments or concerns about this policy, your data or your rights? Email us at support@verascape.app.

Adapted from the Basecamp open-source policies / CC BY 4.0.