Your data and your privacy

Milpa keeps as little about you as a garden planner can. Signed out, everything stays on your device. Signed in, your gardens sync to your own account and nobody else's. Your plans and your photos are never sold, never used to advertise to you, and never mixed into the public plant data.

Last updated October 12, 2026. Data controller: Milpa Gardens.

This page says what is collected, who it is sent to, and what you can do about it. Every line is true of what the app actually does; when a data flow changes, this page changes with it.

What Milpa collects, and only when

Your email address: Your account identity, used to sign you in and to show teammates who made a change on a garden you share with them. Collected only if you create an account.
Your garden's location: The address you type and its approximate coordinates, so the planner can find your frost dates, hardiness zone and daylength. Collected only when you enter it.
Your garden itself: Beds, plantings, seasons, notes, soil observations, and any plants you add. This is the work you do in the app.
Team messages: If you share a garden with other people, the posts you write to that garden's team. Only members of that garden can see them.

What never leaves your device

Photos: Every photo you attach stays in this browser and is never uploaded. The export is how you move or back them up.
Everything, when signed out: With no account, all of the above lives only on this device, and nothing leaves your browser. That also means nothing backs it up: the season export and the daily backup come with a free account.
Your plant list, for the site's search page: So the search page can offer "Your plants", the planner keeps a short list of which plants are in your garden (just which plants, with no locations, notes or dates) in this browser. The search page reads it there, and it is never sent anywhere. Clearing this site's data removes it.
Your reminders: Your week and its heads-ups are worked out on this device from your garden, and the list your phone reads for its reminders stays in this browser. Turning reminders on asks your browser's permission and sends nothing to a server. Which notices you have read in the app's bell is kept in this browser too, for 30 days. When you're signed in, how often you're reminded and the day “Your week” comes sync with your other display settings, such as your units.

Who your data is sent to

Only these services, only for what each line says.

Supabase (our backend host): When you sign in and sync, your account data is stored on Supabase. It is readable only by your own account (and by teammates for a garden you explicitly share). We do not run ads on it and it is never sold.
Google, the US Census Bureau, and OpenStreetMap: When you look up an address, the text you type is sent to these services to turn it into a location. Only what you typed is sent. Your plans never are.
Google and Esri: When you view the satellite map, the app requests map imagery for the area you are looking at. That reveals roughly where you are looking to the imagery provider.
GoatCounter (visitor counts): Page visits are counted anonymously, with no cookies, no accounts and no personal data. Do Not Track and Global Privacy Control are honored, and your plants and plans are never part of any count.

Like any request your browser makes, each of these carries your device's IP address to the service it reaches. That is how the web works, so we mention it.

How it is stored

Your account data is protected at the database by a rule that lets each account read and write only its own rows, so one account has no way to reach another's garden. The plant knowledge that powers the app is a public file built into the app itself; your data never mixes into it. Once a day we save an encrypted copy of the account database, so a fault on our side can't lose your garden. The copy is locked with a key only Milpa holds, kept in private storage at our code host (GitHub, which can't read it), and deleted after 30 days.

Your control

Delete it

Delete your account from the Account page and it removes your account and every record it holds (your gardens, plans, seasons and team messages) in one step, including messages you wrote on gardens others shared with you and any pending invitations addressed to you. You can also delete a single garden on its own. Copies already in those daily backups are deleted within 30 days.

Take it with you

Export any season as a plain-text file, with its photos in a matching zip. Your data is yours to keep and to move.

What we never do

Sell your data, or share it to advertise to you.
Build a profile of you, or track you across other sites.
Put your plants, plans or photos into any analytics.
Mix your data into the public plant corpus.

Contact

Questions, or want your data removed and cannot reach the Account page? Write to us. This page is versioned in the open with the rest of the project, so what it promised and when is a matter of record. privacy@milpa.garden