Plotilo Open the editor

Privacy policy

The data Plotilo processes, why, for how long, who receives it, and how to exercise your rights.

Effective since . The French version prevails.

Who is responsible

Plotilo covers the plotilo.com website, the app.plotilo.com web app and the iOS and Android apps. It is published by Lucas Vaudey, the controller of the data described here. For any question or request: info@plotilo.com.

Without an account

Your garden plan, beds, crops, planting records, preferences (language, appearance) and backups stay on your device or in your browser. They are not sent to our servers, except the copy of a garden you choose to publish in the community.

Data processed with an account

  • Account: name, email address, password (stored only as a hash), optional bio and region, whether the address is verified, creation and update dates.
  • Sign-in with Google or Apple, if you choose it: your account identifier at that provider, name, email address (which Apple may hide behind a relay address), profile picture for Google, and the sign-in tokens it sends us. Plotilo never receives your Google or Apple password.
  • Sessions: session token, IP address and software used (browser or device) when signing in, expiry date.
  • Emailed codes (forgotten password, address verification): stored only as a hash, valid for 10 minutes.
  • Community: posts (text, photo, garden copy), comments and likes. They are public and shown with your name, without your email, bio or region. Photos are recompressed on our servers without their original metadata (GPS location included).
  • Feedback sent from the app: category, rating, message, platform, language, app and system versions, and your account if you are signed in.
  • Abuse protection: request counters tied to an IP address or its hash, used only to limit repeated submissions.

Why, and on what basis

  • Providing what you ask for (account, sign-in, posts, feedback): performance of the service.
  • Sending the emails the account needs (verification and reset codes): performance of the service. Plotilo sends no newsletter and no promotional email.
  • Securing accounts and limiting abuse: legitimate interest.
  • Measuring audience on the website and web app, without cookies: legitimate interest.

Plotilo does not sell your data, shows no advertising and does no profiling.

Audience measurement

plotilo.com and app.plotilo.com use Umami, an audience measurement tool hosted on our own servers, without cookies or persistent identifiers. It counts page views, the referring page, device type, browser, language, and the country or region derived from the IP address, which it does not keep. URL parameters (after “?” or “#”) are not recorded. The iOS and Android apps do not include this measurement.

Cookies and on-device storage

Only one strictly necessary cookie is used: the one that keeps you signed in on the web app. On iOS and Android, the session is kept in the device’s secure storage. Your browser’s or device’s local storage keeps your garden, preferences and drafts. No advertising or measurement cookie is set.

Who has access

  • OVHcloud (OVH SAS) hosts the servers, database and photos in its Roubaix data centre in France, and carries the emails sent from info@plotilo.com.
  • Google or Apple receive your sign-in request only if you choose to sign in with them. Their own privacy policies then apply.
  • Apple and Google distribute the mobile apps through the App Store and Google Play, under their own policies.

No other company receives your data. Only the publisher administers the service.

How long

  • Account, profile and related content: as long as the account exists. Deleting the account also erases the feedback attached to it.
  • Sessions: they expire after 7 days without use.
  • Emailed codes: 10 minutes at most, then unusable.
  • Posts and comments you delete: they disappear from the service immediately but remain in the database until a permanent deletion, which you can request.
  • Feedback: as long as it helps improve Plotilo, or until you ask for its deletion.

Your rights

You can access your data, correct it (the profile can be edited in the app), have it erased, restrict or object to its processing, and ask for its portability. Your garden can also be exported from the app. Account deletion is requested by email; it is not available in the app yet. Write to info@plotilo.com from your account’s address: we answer within one month. You may also lodge a complaint with the French data protection authority, the CNIL.

Security

Traffic is encrypted (HTTPS), passwords and codes are stored only as hashes, private photos are served only when a public post references them, and administration is limited to accounts designated on the server.

Changes

This page shows its effective date. Any significant change will be announced on the website and in the app.