Privacy policy

Draft, last updated 29 October 2026. To be reviewed by a lawyer before launch.

Patchmates helps home gardeners across Australia grow food and native plants. It runs on the web and in our iPhone and Android apps. This policy explains what we collect, why, who we share it with and your choices. We follow the Australian Privacy Principles in the Privacy Act 1988.

Patchmates is run by [Business legal name] (ABN [ABN]), [Business postal address]. In this policy “we” and “us” means that business.

What we collect and why

• Your email address, to sign you in and send the emails you choose. If you sign in with Google, Google tells us your email and name.
• Your display name, suburb, where you grow, your experience and what you like to grow, so we can tailor advice to your local climate.
• The year you were born and a tick box, to confirm you're 18 or over. We keep only the year and never show it.
• What you add: posts, comments, messages, swaps, your garden journal, beds, plantings, harvests, jobs and photos.
• Plant Doctor checks and questions you ask the garden helper, and the answers, so you can look back at them.
• Your gardener level and points, earned from what you do in the app.
• Feedback you send us, with the page you were on and your browser type, so we can fix problems.
• How you joined: the invite code or mate's link you used, and whether you're a founding member or tester.
• How many AI and Plant Doctor checks you've used this month, so we can apply fair-use limits.
• If you turn on alerts on your phone, a push notification address for your device.
• Basic usage information, such as pages viewed and buttons tapped, and error reports when something breaks.
• If you buy Plus, your billing name and address and what you bought. Stripe handles your card; we never see the card number.

We need your email, suburb and age confirmation to give you an account. Everything else is optional or comes from what you choose to do. We don't collect your street address, your phone's location, contacts or anything from other apps.

Location

We only store your suburb, never your street address. We use it to work out your local climate, planting times, weather alerts and the rules on declared weeds in your state. We remove location data (GPS) and other hidden information from every photo, on your phone before upload and again on our servers.

What other members see

• Signed-in members can see your display name, suburb and profile on your posts, comments and swaps.
• Signed-in members in your state can see your display name, gardener level and points on the monthly leaderboard if you're in the top 10.
• If you joined through a mate's invite link, they can see your display name, when you joined and whether you've been active.
• When a question is solved, the question and answers may appear on a public answers page. There we show your display name or “A Patchmates member”, your choice in your profile, and never your suburb.
• Your garden journal, Plant Doctor checks, garden helper questions and messages are private to you (and the person you message).

Photos are stored at long, random web addresses that aren't listed anywhere. Anyone who has the address can open the photo, so think before sharing a link to a private photo.

How we use AI

Some features send your content to AI services to work. AI-written content is always labelled in the app.

• Plant Doctor: your photos and note go to Pl@ntNet to identify the plant, then to Anthropic's Claude to suggest likely causes.
• Garden helper: your question, with your suburb, beds, plantings and local weather, goes to Anthropic.
• Post checks: new posts, comments, swaps and messages go to Anthropic to screen for spam and harmful content before or after they appear.
• First replies: if a question gets no answers for a while, its text goes to Anthropic to write a first suggestion, labelled as AI.
• Weekly email: your first name, suburb and this week's plants and jobs go to Anthropic to write a short intro.

No person reviews AI answers before you see them. Moderators review content that the AI check flags. If something you type to an AI feature suggests you may be at risk of self-harm, we don't send it to the AI; we show you support services instead.

These providers use your content only to give us the answer. Under its commercial terms, Anthropic doesn't train its models on what we send, and keeps it only for a short time for safety and abuse checks. [Owner to confirm with each provider's current terms, including Pl@ntNet's handling of photos.]

Who we share data with

We use these service providers to run Patchmates. Each one only gets what it needs for its job. Some are outside Australia, so your information may be stored or handled in the countries listed.

• Supabase: database, sign-in and backups. Sydney, Australia.
• Vercel: website hosting. Our code runs in Sydney; the company and some request logs are in the United States.
• Cloudflare: photo storage and delivery, and the bot check on sign-up and posting. Global network, company in the United States.
• Anthropic: AI features (see above). United States.
• Pl@ntNet: plant identification from Plant Doctor photos. France.
• Resend: sending our emails (your email address and the email). United States.
• Stripe: payments and GST. Australia and the United States.
• PostHog: product analytics. European Union (Germany).
• Sentry: error reports, without your name, email, cookies or form contents. [United States or Germany: owner to confirm.]
• Google: only if you choose to sign in with Google. United States.
• Apple and Google app stores: if you use our app, they handle the download and push notifications under their own policies.

Open-Meteo provides our weather forecasts. It only receives the coordinates of a climate area, never anything about you. We may also share information if the law requires it, or to protect someone's safety.

We take reasonable steps so these providers protect your information to a standard like the Australian Privacy Principles, through their contracts and data processing terms. We don't sell your personal information and we don't show you ads based on tracking.

Cookies and analytics

We use a sign-in cookie to keep you signed in, and a cookie that remembers if you opened Patchmates from our app. Our analytics run without cookies, mask the text on the page and don't record your screen. We don't use advertising cookies or track you across other apps or sites.

Emails and notifications

We send emails you need, such as sign-in codes, receipts and reminders before Plus renews. We send the weekly digest and alerts only while they're on in Me → Notifications. Every digest has an unsubscribe link that works without signing in, and we act on it straight away.

Your photos and the plant library

Under our terms you license plant photos you post under a Creative Commons licence, so we and others may use them in the plant library with credit to you.

Keeping it safe

Data is encrypted in transit and stored with providers that encrypt it at rest. Access is limited to people who need it to run Patchmates. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC).

How long we keep it

• We keep your information while your account is open.
• When you delete your account we cancel any Plus subscription and delete your profile, posts, journal, messages, Plant Doctor checks, feedback and photos straight away. Cached copies of photos in our delivery network may take a short time to clear.
• Database backups roll over within 7 days.
• We keep records of payments for as long as tax law requires (usually 5 years).
• We keep a record that an account was deleted, and usage totals with no name attached, to manage costs and prevent abuse.
• [Owner to decide: how long we keep accounts that haven't been used for a long time.]

Your choices

• See and correct your details in Me → Profile.
• Download everything we hold about you from Me → Download my data.
• Delete your account from Me → Delete my account, on the web or in the app.
• Choose which emails and alerts you get in Me → Notifications.
• You can use Patchmates under a display name that isn't your real name.

Questions and complaints

Email [Privacy contact email] or write to [Business postal address]. We'll reply within 30 days. If you're not happy with how we handle a complaint, you can contact the OAIC at oaic.gov.au or on 1300 363 992.

Changes

If we make an important change to this policy, we'll tell you in the app or by email before it takes effect.