Privacy Policy

PlotBase, Inc.
Effective Date: June 19, 2026
Last Updated: August 1, 2026

Contact: [email protected]

1. Introduction

PlotBase, Inc. ("PlotBase," "we," "us," or "our") operates the PlotBase platform, which helps community garden coordinators manage gardens, plots, and member applications. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information.

By using PlotBase, you agree to the practices described in this policy.

2. Who This Policy Covers

PlotBase serves two types of users:

  • Garden Owners — coordinators who create and manage community gardens on PlotBase.
  • Gardeners — community members who browse gardens, apply for plots, and join waitlists.

This policy applies to both.

3. Information We Collect

3.1 Information You Provide Directly

When you create a Garden Owner account, we collect:

  • Username
  • Password (stored as a bcrypt hash — we never store your plain-text password)
  • Email address
  • Phone number
  • ZIP code

When you create a Gardener account, we collect:

  • Username
  • Email address
  • Phone number
  • Password (stored as a bcrypt hash)
  • ZIP code

When you apply for a garden plot or join a waitlist, we collect:

  • Gardening experience level
  • Reason for applying
  • Any responses to custom questions set by the garden owner (which may include short-answer text, long-answer text, typed or drawn signatures, or file uploads)
  • Signatures (typed or drawn) on any waivers required by the garden owner
  • Your gardener ID and the timestamp of your waitlist request, stored as part of the garden's waitlist record

When you create or manage a garden listing, we collect:

  • Garden name, description, rules, and amenities
  • Garden address, neighborhood, ZIP code, and GPS coordinates (latitude/longitude)
  • Season dates and plot pricing
  • A cover photo
  • Email templates you configure

3.2 Information Collected Automatically

When you use PlotBase, we and our service providers automatically collect:

  • Usage data — pages visited, features used, and actions taken (for example, creating a garden, opening an application form, or submitting an application)
  • Device and browser information — browser type, operating system, screen resolution
  • IP address and approximate location — used to derive an approximate country/city; we do not store your precise location
  • Session recordings — see Section 3.4 below
  • Cookies and similar technologies — see Section 6 below

3.4 Session Recordings

We use session replay tools that record how you interact with PlotBase, including mouse movement, clicks, scrolling, page navigation, and the pages you view. These recordings help us find where people get stuck — for example, a form step that people repeatedly abandon.

What is excluded from recordings. Text you type into form fields is masked before the recording leaves your browser. This includes your password, email address, phone number, ZIP code, application answers, and signature fields. We do not capture the contents of files you upload.

Recordings are stored by our analytics providers (see Section 5) and are subject to the retention periods in Section 7. If you would prefer not to be recorded, see Section 8.

3.3 Information We Do Not Collect

We do not currently collect payment card numbers or billing information. If we introduce paid features in the future, payment processing will be handled by a PCI-compliant third-party provider and we will update this policy accordingly.

4. How We Use Your Information

We use the information we collect to:

  • Provide and operate the platform — create and authenticate accounts, display garden listings, process plot applications and waitlist entries, and facilitate communication between owners and gardeners
  • Send transactional emails — application status updates (accepted, rejected, waitlisted), confirmations, and other service-related notifications
  • Send marketing communications — product updates, feature announcements, and newsletters (you can opt out at any time; see Section 8)
  • Improve PlotBase — analyze usage patterns and session recordings to understand how features are used, find where people get stuck, and identify areas for improvement
  • Ensure security and prevent fraud — detect and investigate suspicious activity
  • Comply with legal obligations — respond to lawful requests from courts or government authorities

5. How We Share Your Information

We do not sell your personal information, nor do we "share" your personal information for cross-context behavioral advertising purposes as defined under the California Privacy Rights Act (CPRA). Our analytics and session replay providers are used solely for internal operational analytics to improve the platform, not for ad targeting.

We share information only in the following limited circumstances:

With garden owners: When you (as a gardener) submit an application, the garden owner can see your username, email, phone number, application responses (including any custom question answers and uploaded files), and waiver signatures. When you join a waitlist, the garden owner can see your username and the date you joined. This is necessary for the platform to function.

With gardeners: When a garden owner publishes a garden listing, gardeners can see the garden's name, description, location (at the neighborhood or address level, depending on the owner's settings), pricing, and amenities.

With service providers: We share data with third-party vendors who help us operate PlotBase, including:

  • Supabase — database and file storage (United States)
  • Vercel — web hosting and infrastructure (United States)
  • PostHog — product analytics and session replay (United States)
  • Microsoft Clarity — session replay, heatmaps, and interaction analytics (data may be processed in the United States and other countries, and is subject to the Microsoft Privacy Statement)
  • Email delivery providers — for sending transactional and marketing emails

These providers are contractually bound to use your data only to provide services to us.

For legal reasons: We may disclose information if required by law, subpoena, court order, or to protect the rights, property, or safety of PlotBase, our users, or the public.

In a business transfer: If PlotBase is acquired, merged, or sold, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the platform before your data is transferred and becomes subject to a different privacy policy.

6. Cookies and Tracking

PlotBase uses the following types of cookies and browser storage:

  • Essential / functional storage — We use localStorage in your browser to keep you logged in across tabs and sessions. This is required for the platform to work and cannot be disabled.
  • Analytics cookies and storage — PostHog and Microsoft Clarity set cookies and use browser storage to recognise a returning visitor across sessions and to group their activity into a single session. These collect information such as pages visited, time spent, features used, and general location (country/city level).

We do not use advertising or behavioral tracking cookies.

Once you log in, we associate your analytics activity with your account so we can understand how real users move through the product. We send only your account identifier, your role (garden owner or gardener), and your plan tier. We do not send your name, username, email address, phone number, or ZIP code to our analytics providers.

Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" (DNT) signals or Global Privacy Control (GPC) signals to websites. PlotBase does not currently alter its data collection or tracking behavior in response to DNT or GPC signals, because we do not engage in the cross-context behavioral advertising those signals are primarily designed to opt out of. We will update this section if our practices change.

7. Data Retention

We retain your personal information for as long as your account is active. If you delete your account or request deletion:

  • Your account data (username, email, phone number, password hash, ZIP code) is removed from our active database.
  • File uploads (application attachments) are deleted from our storage systems.
  • Application records you submitted to gardens are retained in a de-identified form for the garden owner's administrative history. Garden owners have a legitimate record-keeping interest in their application history; however, your personal details (username, email, phone) will be disassociated from those records upon account deletion.
  • Anonymized or aggregated analytics data may be retained indefinitely as it cannot identify you.
  • Session recordings are retained by our analytics providers under their own retention schedules — currently up to 30 days for Microsoft Clarity and up to 12 months for PostHog. Recordings linked to your account are deleted on request; see Section 8.

We may retain certain information for longer periods if required by law or to resolve disputes.

8. Your Rights and Choices

Opt out of marketing emails: Every marketing email we send includes an unsubscribe link. You may also email [email protected] to opt out.

Access and correction: You may review and update your account information by logging in to your account settings, or by contacting us at [email protected].

Account deletion: You may request deletion of your account and associated data by emailing [email protected]. We will process your request within 30 days.

Opt out of analytics and session recording: Email [email protected] and we will exclude your account from analytics collection and session recording. Most ad and tracker blocking browser extensions will also block these tools, and doing so does not affect your ability to use PlotBase.

California residents (CCPA): If you are a California resident, you have the right to know what personal information we collect and how it is used, request deletion of your personal information, and opt out of any sale of your personal information (we do not sell personal information). To exercise these rights, contact us at [email protected]. We will not discriminate against you for exercising your privacy rights.

9. Children's Privacy

PlotBase is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

10. Security

We implement reasonable technical and organizational measures to protect your personal information, including bcrypt password hashing, HTTPS encryption in transit, and private storage buckets for uploaded files (accessible only via server-side signed URLs). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the platform before the change takes effect. The "Last Updated" date at the top of this page reflects the most recent revision.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

PlotBase, Inc.
[email protected]