Privacy policy
In short: we only store what the community needs, no tracking or ads, location data is stripped from photos, and you can download or delete your data at any time.
01Controller
The controller within the meaning of Art. 4(7) GDPR is the operator of Perfect Plants Club:
[Name][Postal address]
Email: [Email address]
We are not required to appoint a data protection officer (Art. 37 GDPR). For privacy questions, contact us at the address above.
02What data we process
Account data
- Required: username, email address, password (stored only as a secure, irreversible hash), time of accepting the terms and confirming you are 16+.
- Optional: display name, bio, location (free text), country, website, profile and cover image, language, interests.
- Technical: time of registration, last login and last activity, storage usage, XP points and badges, settings.
Content you create
Plants and collection data, photos, bloom and care entries, posts, comments, likes, messages, swaps and ratings, wishlist, friendships and follows, blocks, reports.
Server and security data
For every request the hosting server logs the IP address, time, requested URL, browser type and referrer. To prevent abuse (e.g. password guessing, spam sign-ups) we briefly store a hash derived from the IP address or account name for rate limiting. Moderator and admin actions are logged.
03Purposes and legal bases
- Art. 6(1)(b) GDPR – performance of contract: providing your account, collection, community features, messages and swaps, and the emails required for them (confirmation, password reset, security notices).
- Art. 6(1)(f) GDPR – legitimate interest: security and stability, abuse prevention (server logs, rate limiting, honeypot field), moderation, handling reports and defending legal claims.
- Art. 6(1)(a) GDPR – consent: newsletter (double opt-in), optional profile details, external content loaded on click. Consent can be withdrawn at any time for the future (Art. 7(3)).
- Art. 6(1)(c) GDPR – legal obligation, where laws or authorities require retention or disclosure.
We do no profiling or advertising tracking, and we never sell your data.
05Swaps
We neither ask for nor store names, postal addresses or phone numbers for swaps. When two members agree, they exchange shipping details by private message; these messages are visible only to the two parties and are anonymised for the sender when the account is deleted.
Trust points are calculated automatically from your activity (account age, plants, posts, friends, swaps, ratings); they only determine how many swaps you can run at once.
06Hosting
The site runs on servers of IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) in an EU data centre. IONOS processes data as a processor under an Art. 28 GDPR agreement. Server logs are kept briefly by IONOS for security purposes.
Emails (confirmations, notifications, newsletter) are also sent via IONOS mail servers.
07Image processing
Every uploaded image is re-encoded to WebP and resized on our server. All EXIF metadata – including GPS location, camera model and capture details – is permanently removed, so your photos never reveal where your plants live.
Please upload only your own photos and do not show identifiable people without their consent. Each account has 300 MB of storage by default.
08External services
The following external services only receive data when you actively use the respective feature:
- Videos (YouTube, Vimeo) – embedded videos only load on click – YouTube via the cookie-less youtube-nocookie.com domain, Vimeo in “do not track” mode. When you click, your browser connects to servers of Google Ireland Ltd. (Gordon House, Dublin, Ireland) or Vimeo.com Inc. (New York, USA) and transmits your IP address; transfers to the USA are possible (EU-US Data Privacy Framework). Legal basis: Art. 6(1)(a) – your click is your consent.
- Weather (Open-Meteo) – if you enter a location for the weather forecast in the care hub, your browser fetches it from open-meteo.com (Switzerland – adequate protection per the EU Commission). Your IP address and the coordinates are transmitted. Without a location, no request is made.
- Species lookup (GBIF) – when you search for species names, the search term is sent to the open API of the Global Biodiversity Information Facility (GBIF Secretariat, Universitetsparken 15, Copenhagen, Denmark). If our server makes the request, GBIF only sees the server address; if your browser does, it also sees your IP address.
09Emails and newsletter
Emails required for operation (confirmation, password reset, security notice after a password or email change) are always sent. Event notifications (e.g. new message, friend request) can be switched off under Settings → Notifications.
The newsletter is only sent with explicit consent to a confirmed email address (double opt-in). We store the time of consent as proof. You can unsubscribe in Settings at any time.
10What others can see
Your username, display name, profile picture, level and badges are visible to other members for community features. You control the visibility of your profile, plants and posts (public / members / friends / private). Your email address is never shown publicly. Blocked members cannot see your content or message you.
Reported content is reviewed by our moderators, who may access the reported content and related account data.
11Retention
- Account data and content: until you delete your account. Profile details, profile and cover images are deleted immediately and your username and email anonymised; plants, photos and posts become invisible immediately and are permanently removed during regular maintenance [e.g. within 30 days].
- Messages you sent remain with the recipient (sender shown as “deleted”), as they are part of their conversation.
- Password reset link: 1 hour, single use. Rate-limit data: a few hours at most.
- Outgoing email queue: after sending [e.g. 30 days]. Moderation log: at most 1 year.
12Your rights
Under the GDPR you have the right to:
- access (Art. 15) and data portability (Art. 20) – download all your data as JSON with one click under Settings → My data;
- rectification (Art. 16) – you can edit most data yourself;
- erasure (Art. 17) – delete your account in Settings at any time;
- restriction of processing (Art. 18) and objection (Art. 21) to processing based on legitimate interests;
- withdraw consent (Art. 7(3));
- lodge a complaint with a supervisory authority (Art. 77), in particular where you live or where the controller is based – in Germany the state data protection authority, in Hungary the NAIH (naih.hu).
Competent supervisory authority at the controller’s seat: [e.g. LfDI Baden-Württemberg]. For questions or requests, write to: [Email address]
13Minimum age and security
Registration is possible from age 16 (Art. 8 GDPR). If we learn that a younger person registered, we delete the account.
Data is transmitted over encrypted HTTPS. Passwords are stored with a modern salted hash, forms are protected by CSRF tokens, login and reset attempts are rate-limited, and only hashes of reset tokens are stored.
14Changes
We update this policy when features or laws change. We announce significant changes on the site.