Draft: to be checked before launch.
The short version
Your list is yours. We keep only what the app needs to work, we never sell it, and there are no ads or tracking. You can ask us to send you everything or to delete it all, any time.
Who we are
The Done Garden is made by Anja Petrovic (VAT ID FI32127102), Kauppalantie 31 A 16, 00320 Helsinki, Finland. We decide how your data is used (we are its “controller” under the EU’s GDPR). Write to us at hi@anja.design.
What we keep, and why
- Your account: your email address and, if you sign in with Google, your name. To sign you in and to write to you about your account.
- Your list and garden: your tasks and steps, their order, the name of your list, what you finished and when, and your garden’s flowers. This is the service itself.
- Your plan: whether you’re on the free or paid plan, and the IDs Stripe gives your customer record and subscription. Card details go straight to Stripe; we never see or store them.
- Sign-in cookies: small cookies that keep you signed in. Nothing else: no analytics, advertising or tracking cookies.
What we don’t collect
No location, no contacts, no advertising IDs, nothing from other apps. We don’t run analytics, build profiles or show ads, and we don’t read your list unless you ask us to help with something in it.
Why we’re allowed to
The GDPR asks us to name a legal reason for each use. Ours are:
- Your account and garden: needed to give you the service you signed up for (our agreement with you).
- Your plan and payments: needed to bill you, and payment records are kept because accounting law requires it.
- Sign-in cookies: strictly needed to keep you signed in, so they don’t need a cookie banner.
- Server logs: our host keeps short-lived logs (such as IP addresses) to keep the site running and safe, which is in our legitimate interest and yours.
Who helps us
A few trusted services process data for us, only to run the app:
- Supabase: our database and sign-in, in the EU (Stockholm, Sweden).
- Vercel: hosts the website and app.
- Stripe: takes payments and manages subscriptions.
- Google: only if you choose to sign in with Google.
Your garden lives in the EU. Vercel, Stripe and Google are US companies and may handle some data in the US; when they do, it’s protected by the EU–US Data Privacy Framework or the EU’s standard contractual clauses. Each of them works under a data processing agreement and may use your data only to do its job for us.
How we keep it safe
Everything travels encrypted (HTTPS) and is stored encrypted. Each person can only reach their own garden, which the database itself enforces. Only Anja has admin access, and only uses it to fix problems.
If something ever goes wrong and your data is exposed, we’ll report it to the Data Protection Ombudsman within 72 hours and tell you straight away if it could affect you.
How long we keep it
As long as you have an account. You can delete your account any time in Account and plan: your account and everything in your garden are deleted straight away, and any subscription is cancelled. Payment records stay with Stripe and in our accounts as long as accounting law requires.
Your rights
You can ask to see a copy of your data, correct it, delete it, take it with you, or object to how we use it. You can delete everything yourself in Account and plan; for anything else, write to hi@anja.design and we’ll answer within a month. If you think we’ve got something wrong, you can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).
Children
The app is for people aged 16 and over. If you think a child under 16 has made an account, write to us and we’ll delete it.
Changes
If we change this policy in a way that matters, we’ll tell you by email before it takes effect.