What we hold, and why.

Every photograph you take is private by default. Nobody else sees the picture of your neem unless you share it yourself.

Photographs are used for one thing: checking that a care task was done, and building the growth timeline you see on your plant's page. They are not used to train anything, and they are not sold.

They stay on your phone. Your plants, your photographs and your points are held by the browser on the device, and the checking runs there too, on a small copy of the picture. No proof photograph is ever uploaded, and there is no server holding a library of where people live.

There is exactly one exception, and it only happens if you ask for it. When you add a plant you can have the photograph identified for you. That one picture goes to a plant identification service so it can name the species, and nothing else about you goes with it. The offer says so before you tap it, and saying no leaves you with the same list of species to pick from.

The trade is that an account lives on one device. Clearing the browser's data for this site clears the plants with it.

A plant's coordinates are fixed when you register it, because every later check is measured against that point. That is what stops somebody photographing a tree that is not theirs.

Anywhere a plant appears publicly, it appears in an area rather than at an address. A shared plant page says the neighbourhood, never the house.

Location is read at two moments and no others: when you register a plant, and when you photograph a task so the two can be compared. It is not tracked in between. The three plants in the demo account are placed near wherever you open it, so the check has something real to measure against.

When a reward is redeemed, the partner is told that a valid code was used. They are not told which plants you keep, where they are, or what you photographed.

When an organisation runs a planting drive through Rooted, it sees survival and care figures for the plants in that drive. It does not see the photographs or the exact locations behind them.

Reminders go to the channels you give us and nowhere else. Turning a channel off turns it off; there is no separate marketing list.

You can export everything you have put in, and you can delete your account. Deleting removes your photographs and your plants' locations. Aggregate survival counts that have already been reported stay, with nothing in them that points back to you.

Questions about any of this go to privacy@rooted.example, and get a reply from a person.