Legal

Privacy Policy

Last updated July 18, 2026.

This policy explains what PlotToTable, operated by Sandy Point Holdings Inc., collects when you use plottotable.com, how we use it, and the choices you have. We keep this short and plain on purpose.

What we collect

  • Your email address, when you sign in or buy something, so we can give you access to your plans and send service messages.
  • Your garden inputs: the crops you pick, household size, experience level, your ZIP code, and bed details. We use these to build your plan.
  • Your saved plans and subscription status, so your account works across visits.
  • Payment information, handled by Stripe. We never see or store your full card number; Stripe processes the payment and tells us whether it succeeded.
  • Photos you choose to upload. If you use the Plant Doctor, the photo of your plant is sent to Anthropic to produce the diagnosis and is not stored afterward; we keep only the written diagnosis in your history. If you import a plan from another app, the screenshot is used the same way: analyzed, then discarded.
  • Pest reports, if you tap “I have this too” on a pest alert. These are anonymous: we record the pest and the first 3 digits of your ZIP code, never your name or email.
  • A push subscription, only if you turn on push reminders. It lets your browser receive our notifications and is deleted when you turn them off.
  • Basic usage data, such as the pages you visit, the buttons and links you click, and which tools you use, to keep the Service working and improve it. Our own first-party counters record events like “visited”, “built a plan”, or the label of a button you pressed, with a coarse traffic source; they store a one-way hash of your email at most, never the address itself.

How we use garden data

Besides building your plan, we combine garden inputs from many gardeners into aggregated, de-identified regional insights: things like which vegetables are most planted in each state, or when gardeners in a growing zone actually sow tomatoes. These insights never identify you. Before anything is published or shared, we remove all identifiers, round location to a broad region (never your ZIP code), and drop any group smaller than 20 gardens. We commit to keeping this data de-identified and will never try to re-identify it, and we require the same of anyone we share it with.

Service providers we use

We share only what each provider needs to do its job. They process data on our behalf:

  • Stripe processes payments and subscriptions.
  • Supabase stores your account and saved plans.
  • Resend sends our emails (welcome, reminders, and confirmations).
  • Cloudflare hosts the Service and delivers it securely.
  • Anthropic (Claude) turns your garden inputs into the written guidance in your plan, and analyzes photos you upload to the Plant Doctor and screenshots you import. Your inputs and images are sent to generate that text; the numbers themselves are computed by us, and images are not stored.
  • Revegenerates the photorealistic garden renders. When you request one, your plan's bed-map blueprint and a text description of your garden layout are sent to Reve to produce the image. The finished render is stored with your plan (it lives as long as the plan does; we keep the latest few versions) and the blueprint sent for generation is not otherwise retained.
  • Telegram delivers an order alert to our staff when a purchase completes. That alert contains your email address and the plan you bought, nothing else.

We do not sell your personal information. Aggregated, de-identified insights (described above) are not personal information.

Cookies and analytics

Our own cookies are few and boring: one keeps you signed in, one remembers your theme, one remembers that you dismissed the cookie notice, one records a tracking opt-out, and one remembers whether European privacy rules apply to you. The notice you see on your first visit explains this; its Cookie settings button leads to the one-tap opt-out.

We also use third-party analytics and ad-measurement tools, currently including the ones listed below, and each may set its own cookies. This list is generated from the same configuration that loads the tools, so it always matches what actually runs on the site:

  • Google Tag Manager loads our measurement tags. It receives the pages you visit.
  • Google Analytics receives the pages you visit, plus scrolls and outbound clicks, and standard device and traffic-source data, so we can see which content people find useful.
  • TikTok Pixel receives page views, and when you buy something it receives a purchase confirmation with the amount and a scrambled (hashed) version of your email so we can measure our TikTok ads. We send that purchase event from our server as well, so it is covered by the same opt-out.
  • Metricool receives page views, so we can see how our social posts perform.
  • Reddit Pixel receives page views, so we can measure our Reddit ads.
  • Microsoft Clarity receives page views, clicks, and scrolls to build heatmaps and anonymous session replays that show us how pages are used. Text you type is masked before it leaves your browser.
  • Meta Pixel receives page views, and when you buy something it receives a purchase confirmation with the amount and a scrambled (hashed) version of your email so we can measure our Facebook and Instagram ads. We send that purchase event from our server as well, so it is covered by the same opt-out.

You can control cookies through your browser settings, though some features may not work without them. To turn off every tool above with one click, use our Do Not Sell or Share My Personal Information page. Opted-out browsers load none of them, and purchases made while opted out are excluded from ad measurement too.

Visiting from the EU, UK, Iceland, Liechtenstein, Norway, or Switzerland? None of the tools above load for you at all, and purchases are excluded from ad measurement. Rather than ask for consent, we simply do not run these tools where GDPR-style rules apply.

We also honor the Global Privacy Control (GPC) signal. If your browser or a browser extension sends it, we treat it as the same opt-out automatically: none of the tools above load, and purchases are excluded from ad measurement, with nothing to click.

We also participate in the Amazon Associates program: some product links earn us a commission. Click tracking on those links records the product and the page, never your name or email. See our affiliate disclosure.

How long we keep data

We keep your account information and saved plans for as long as your account is active. If you ask us to delete your account, we remove your personal data within a reasonable time, except where we must keep limited records (for example, payment records) to meet legal or accounting obligations. On deletion we also strip your identifier and ZIP code from our internal analytics records, so nothing there can be tied back to you.

Your rights

You can ask us to access, correct, or delete your personal information. Email support@plottotable.com and we will take care of it. You can unsubscribe from non-essential emails using the link in any such email.

Children

PlotToTable is meant for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

Contact

Questions about your privacy? Email us at support@plottotable.com.

← back to PlotToTable