What’s Fruiting: Privacy Policy

Last updated: 4 August 2026

This policy explains what personal information What’s Fruiting collects, why, and the choices you have. It’s written to comply with the New Zealand Privacy Act 2020. It applies alongside our Terms of Service, and you accept both when you create an account during sign-up.

“We” and “us” means CALH Trading Limited.

1. What we collect

Account information: your email address and a password (stored in hashed form by our authentication provider; we never see your actual password), plus your hemisphere setting.

Your garden data: everything you add to the app, including plant records, varieties, quantities, notes, harvest logs, fruiting data, wishlist and nursery lists, and your settings.

Images of your property: photos, plans, and aerial or satellite screenshots you upload as your map, plus the boundaries you draw, the land area you enter, your north point, and the locations of pins on that map. We treat property imagery and pin locations as personal information: an aerial photo of your home is information about you.

Photos: images you attach to plants and harvests.

Billing information: if you subscribe to a paid plan, we hold your plan, subscription status, and a customer reference from our payment provider, Stripe. Your card details go directly to Stripe and are never seen or stored by us. Stripe tells us when payments succeed, fail, or are refunded so the app can reflect your plan.

Usage analytics: we use PostHog to understand how features are used, for example events like “completed onboarding” or “placed a map pin”. Analytics events never include your content, plant names, map coordinates, property details, email, or name; signed-in users are identified only by an internal account ID, and guest sessions are anonymous. We have session recording disabled. Our infrastructure providers also keep standard server logs (such as IP addresses and timestamps) for security and operations.

We collect this information directly from you. Guest/demo mode works without an account, and data entered there is not saved to any account.

2. Why we collect it

We use your information to:

• provide the service, since storing and displaying your garden data and maps is the product;
• take payments for paid plans and manage your subscription;
• keep your account secure and support you when something goes wrong;
• send you service messages (things like security notices, changes to these documents, or advance notice if features change materially);
• improve the service in aggregate, understanding how features are used, never selling or advertising with your data.

We don’t sell personal information, and we don’t use your content for advertising. We do not use your content to train AI models. Aggregate feature-usage analytics (section 1) is how we do the “improve the service” part.

3. Consent

When you sign up, the onboarding flow asks you to accept the Terms of Service and this Privacy Policy. That acceptance is our basis for collecting and using your information as described here. You can withdraw by deleting your account (section 7), and specific choices (like removing individual photos or your map) are available in the app at any time.

4. Where your information lives, and who else touches it

Your data is stored with our infrastructure provider, Supabase, hosted in Sydney, Australia. That means your information is held outside New Zealand: Australia’s privacy protections are broadly comparable to New Zealand’s, and Supabase applies the same security controls regardless of region.

We share personal information only with:

• service providers that host and operate the app for us (Supabase for data and authentication; PostHog for usage analytics, hosted in the EU; Stripe for payment processing, a US company, so billing information is processed outside New Zealand under Stripe’s own privacy and security safeguards), who may only use it to provide their service to us;
• anyone you direct us to: for example, if a future feature lets you share your map, sharing happens only when you choose it;
• authorities, if legally required, and only what’s required.

No one else. We don’t sell, rent, or trade personal information.

5. How long we keep it

Your data is kept while your account exists. When you delete content or your account, it’s removed from the service immediately. We don’t keep automated backups, so there are no residual backup copies, which also means you should keep your own copies of anything irreplaceable (Terms of Service, section 7).

One exception: payment records (invoices and transaction history) are kept by Stripe and by us for as long as tax and accounting law requires, even after you delete your account. They contain billing details, not your garden data.

6. Security

Access to your data is protected by your password and our provider’s security controls (including row-level access rules so accounts can only read their own data). No internet service can promise perfect security, which is one reason the Terms of Service §7 asks you to keep your own copies of irreplaceable photos.

7. Your rights

Under the Privacy Act 2020 you can:

• access the personal information we hold about you;
• correct it if it’s wrong (most of your data you can edit directly in the app);
• delete: request deletion of your account and its data at any time via the Delete account button in Settings (it sends us your request by email); we action requests promptly and confirm by email when it’s done.

To exercise access or correction beyond what the app itself offers, contact us at whatsfruiting@gmail.com and we’ll respond within 20 working days as the Act requires.

If you’re not happy with how we’ve handled your information, tell us first and we’ll try to put it right. You can also complain to the Office of the Privacy Commissioner: privacy.org.nz.

8. Children

The service is for people aged 16 and over. We don’t knowingly collect personal information from anyone younger; if you believe we have, contact us and we’ll delete it.

9. Changes to this policy

If we change this policy materially (new kinds of data, new uses, new sharing), we’ll notify you in the app or by email at least 30 days before the change takes effect, and where the law requires it we’ll ask for fresh consent. The “Last updated” date and the changelog below always reflect the current version.

10. Contact

Privacy questions and requests: whatsfruiting@gmail.com

Changelog