1. Who is responsible for your data
Verdary is operated by Nikolay Boyukliev, Bulgaria, acting as the data controller. For privacy questions or requests, email nboukliev@gmail.com.
2. What Verdary is
Verdary is a private gardening diary. Signed-in users can organize gardens, planters and tracked plants, and keep dated records containing notes, observations, tags and photos. Garden content is private by default and available to authorized garden members. A garden owner can optionally create an unlisted public gallery link that exposes only garden photos, their record titles and activity dates.
3. Data we collect
Google account information
When you choose Google sign-in, Verdary receives the basic identity information needed to create and recognize your account: your Google account identifier, name, email address and profile image, when available. Verdary does not request access to your Gmail, Google Drive, Google Photos, contacts, calendar or other Google content.
Content you provide
We process the gardens, locations, descriptions, plants, planters, diary dates, titles, notes, observations, tags and photos that you choose to add. Photo metadata can include filename, file type, dimensions and size. You should avoid uploading unnecessary personal information or images of other people without an appropriate reason and permission.
Technical and support information
Essential session cookies keep you signed in. Security and operational logs may include timestamps, IP addresses, browser or device information, requested paths, response status and diagnostic errors. If you contact the operator, we process the contact details and message you provide.
4. Why we use this data
- To authenticate you and maintain your private account.
- To store, display, edit, organize and delete the gardening content you request.
- To enforce garden membership and prevent one user from accessing another user's data.
- To provide optional photo analysis when you intentionally invoke that feature.
- To display the limited public gallery content when a garden owner enables sharing.
- To secure, troubleshoot and maintain the service and prevent misuse.
- To respond to support, privacy and legal requests.
Under applicable EU data-protection law, these activities are based principally on providing the service and taking steps at your request, the operator's legitimate interests in operating and securing Verdary, compliance with legal obligations, and consent where consent is specifically requested. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
5. Google user data
Google identity information is used only to authenticate you, create your Verdary profile, display your account identity and support account security. It is not sold, used for advertising, used to determine creditworthiness, or used to train AI models. Verdary's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
6. Optional AI features
When you add a supported photo to a general diary record, or manually request observations for a known plant, an optimized copy of that photo is sent to OpenAI's API to produce editable plant-identification or garden-observation suggestions. In known-plant mode, the tracked plant's name is also included. Verdary does not send your Google account identity, complete garden catalogue or previously saved diary to OpenAI for this feature.
When an owner or editor uses a tracked plant's chat, Verdary sends OpenAI the message, photos attached to that turn, that plant's profile and current planter, recent linked diary history, recent messages, and factual summaries of older relevant history. It does not include unrelated plants, gardens, members, or older raw photos. Verdary keeps the durable conversation in its own Supabase database and requests that OpenAI not store the response as application conversation state. OpenAI may still retain API data for limited periods for abuse monitoring or as otherwise described in its API data-controls policy.
Suggestions may be inaccurate and are not professional horticultural, health or safety advice. The generated fields remain editable, and you decide what is saved to your diary. Verdary does not use your content to train its own AI model.
7. Service providers and disclosures
Data is disclosed only as needed to operate Verdary:
- Google provides account authentication.
- Supabase provides authentication, the PostgreSQL database and private photo storage.
- Hetzner hosts the Verdary application and its operational access logs.
- OpenAI processes selected photo-analysis inputs and the relevant plant-chat inputs described above when those optional features are invoked.
- Authorities or professional advisers may receive data when required by law or necessary to establish, exercise or defend legal claims.
These providers may process data in countries outside Bulgaria or the European Economic Area under their applicable contractual and legal transfer safeguards. Verdary does not sell personal data and does not use advertising or analytics trackers.
8. Storage, security and retention
Verdary uses encrypted HTTPS connections, private photo storage, authenticated sessions, database row-level security and garden-membership controls. No online system can guarantee absolute security.
Account and diary data are kept while your account remains active or as needed to provide the service. Content you delete is removed from the active service, subject to reasonable technical processing time. Limited copies may remain temporarily in protected backups, provider retention systems or security logs and are removed or overwritten according to operational retention cycles, unless longer retention is legally required.
Public gallery links
Anyone who obtains an active gallery link can view and forward it without signing in. Public galleries are marked for search engines not to index, but this cannot prevent a recipient from copying the link or visible content. Owners can disable sharing or generate a replacement link at any time. This stops new gallery and image access; a previously issued short-lived image URL may continue working for up to approximately five minutes. Notes, care observations, tags, plant and planter associations, members, garden location and original filenames are not included in the public gallery response.
9. Your choices and rights
You can edit or delete individual gardens and diary content through Verdary. To request a copy, correction, deletion or portability of account data, or to restrict or object to processing, email nboukliev@gmail.com from your account email address. Additional verification may be requested before acting on an account request.
Depending on applicable law, you may also complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority. Verdary does not make decisions producing legal or similarly significant effects through automated processing.
10. Children
Verdary does not impose a separate product age limit, but users must be legally able to use the Google account through which they sign in. Where applicable law requires authorization from a parent or guardian, Verdary may be used only with that authorization and supervision. A parent or guardian can contact the operator to request deletion of a child's data.
11. Changes to this policy
This policy may be updated when Verdary's functionality, providers or legal obligations change. The effective date above will be updated, and material changes will be communicated through the service when reasonably possible.
Please also read the Terms of Service.