Chili Tracker privacy notice

Who is responsible

Chili Tracker is operated by Henry Berkin, who is the data controller for personal information processed by this PWA.

For privacy questions or requests, email support@chilitracker.com.

Information we process

Account and security information: email address, display name, a securely salted and hashed password, account identifier, account creation time, email-verification and account status, last successful login, and the time and broad category of the latest account action.

Controlled early-access invitation information: the invited email address, invitation creation, expiry, use or revocation times, and the restricted owner reason for issuing or revoking it. The usable invitation token is stored only as a one-way hash.

Early-access request information: your email address, consent time, optional indoor or outdoor growing context, the optional short answer about what you would like to track, confirmation and review status, and any later invitation association. The usable email-confirmation token is stored only as a one-way hash.

The latest-action category records only a general description such as adding a plant, updating a task, or recording a harvest. It does not copy the plant name, task title, note, photo, or other grow-record content into the activity field.

Grow records you choose to add: plant category and variety, nickname, grow space, placement, planting date, care intervals, status, notes, tasks, custom varieties, feeding, watering, growth, health and harvest history.

Photos you upload: the image, original filename, optional caption, plant association, and upload time.

Support or feedback: the message you choose to send and any name or reply address you choose to include.

Essential technical information: an authentication token and preferences stored in your browser, plus standard request and security metadata processed by the hosting provider.

An email address, display name, and password are required to create an account. Other grow records, photos, support details, and optional preferences are provided by you only when you choose to use the relevant feature.

Why we use it and our lawful bases

Contract: to create and authenticate your account and provide the plant-record, task, photo, and care-history service you ask to use.

Legitimate interests: to keep the early-access service secure and reliable, diagnose failures, prevent misuse, answer support requests, and improve core usability. Chili Tracker does not currently use advertising trackers or behavioural analytics.

Legitimate interests also support operating a small, controlled invitation programme rather than exposing unrestricted registration. An invitation is used only to offer and secure early access; it does not subscribe the recipient to marketing.

Consent: if you send an early-access request, Chili Tracker may contact you about that request or an available invitation. You can withdraw the request at any time by emailing the public support address.

Legal obligation: to keep or disclose limited information if the law requires it.

Consent: any future use of grow observations for the public variety database will require a separate, optional choice. It is not covered by simply creating an account or accepting this notice.

Chili Tracker does not use your information for automated decisions or profiling that produces legal or similarly significant effects.

Account email and restricted support access

Cloudflare Email Service sends early-access request confirmations, controlled invitations, and transactional account messages such as email-verification links, password-reset links, and password-change notices. These messages do not subscribe anyone to wider marketing and contain no advertising or tracking pixels.

Early-access confirmation, invitation, verification, and password-reset links are single-use and time-limited. Chili Tracker stores a one-way hash of each security token rather than the usable link token. Requesting a replacement confirmation, verification, or reset link makes the earlier unused link invalid.

The restricted owner-only support console can show account identity, verification and account status, record totals, last-login and broad last-action times, and recent administrative support actions. It does not provide access to passwords, plant notes, task titles, photos, or other grow-record content.

The owner may use the console to issue or revoke a controlled early-access invitation, resend a verification message, start the normal password-reset process, end account sessions, suspend or reactivate an account, or record a deletion or export request. Each completed administrative change requires a reason and creates an audit record.

Location and weather

Local weather is not available in this release. The production PWA does not ask the browser for coordinates and does not send coordinates to a weather provider.

A grow-space name or note is information you choose to type. Avoid entering a home address or other precise location unless it is genuinely useful to your own records.

If weather is introduced later, it will remain off by default and this notice will be updated before the production feature is enabled.

Service providers and sharing

Cloudflare provides the website and Pages hosting, Worker API, D1 database, private R2 photo storage, security, caching, and recovery facilities used by Chili Tracker. The early-access request form is submitted directly to the Worker API and stored in D1 for restricted owner review.

Cloudflare Email Service processes outbound transactional account messages and related delivery information, including bounce or suppression status. Email preview is disabled for the Chili Tracker sending domain.

Cloudflare Email Routing forwards messages sent to the public support address. Google Gmail provides the private inbox used to receive and answer support and feedback messages; the private destination address is not disclosed by the PWA.

Chili Tracker does not sell personal information, share it with advertisers, or make account plant records public.

Information may also be disclosed where required by law, to protect users or the service, or with your specific instruction.

International processing

Cloudflare and Google operate internationally, so information may be processed outside the United Kingdom.

Where UK personal information is transferred internationally, Chili Tracker relies on applicable adequacy regulations or contractual safeguards provided by the service provider, such as the UK Addendum to standard contractual clauses.

How long we keep information

Account and grow-record information is kept while your account remains open so the service can provide your history.

After a verified account-deletion request, information will normally be removed from active Chili Tracker systems within 30 days. Cloudflare D1 point-in-time recovery may keep deleted database information recoverable for up to 30 further days under the current Workers Paid plan.

Restricted release-recovery copies are kept for no more than 30 days. They are used only for disaster recovery and are then deleted unless a live recovery or legal requirement temporarily requires a longer period.

Early-access request confirmation and account verification links expire after 24 hours, password-reset links after one hour, and invitations on the date stated in the invitation. Used, revoked, expired or replaced links cannot be used again. Limited request, invitation, security and administrative audit metadata is kept for as long as reasonably necessary to operate the controlled pilot, protect accounts, evidence support actions, handle requests, and establish or defend legal claims.

Early-access request records, support and feedback messages are normally kept for up to 12 months after the last contact or activity so that requests, issues and decisions can be followed up. A record may be kept longer where needed for an unresolved dispute, security incident, or legal obligation.

Effectively anonymised information that can no longer identify anyone may be kept for longer.

Your choices and rights

Depending on the circumstances, you may ask for access to your personal information, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw a consent choice at any time without affecting earlier lawful processing.

You may withdraw an early-access request at any time by emailing the public support address. This does not affect an account you later choose to create through a separate invitation.

Right to object: you may object to processing based on legitimate interests. Chili Tracker will stop that processing unless there are compelling legitimate grounds to continue or it is needed for legal claims.

Email the public support address to exercise a right. Chili Tracker may ask for enough information to verify that the request relates to your account and will normally respond within one month.

Self-service password recovery is available from the sign-in page. Account deletion and data export are not yet self-service; contact Support to make either request. Removing the installed PWA or clearing browser storage does not delete information held in your account.

Future public variety database

This feature is not active. Chili Tracker does not currently use your plant records to build or publish a variety database.

If grow-data contributions are introduced, they will be a separate optional choice that is off by default. Before you opt in, Chili Tracker will explain which observations would be used and how to turn future contribution off without losing access to the app.

Only derived grow measurements and broad growing conditions would be considered. Account identity, email address, notes, photos, precise location, and record identifiers would not be published. Information would be aggregated and checked so that individuals are not identifiable before it contributes to a public CC BY 4.0 dataset.

Turning contribution off would stop future use. Information already irreversibly anonymised and included in a published dataset may not be removable because it can no longer be linked to your account.

Security and early-access limitations

Passwords are stored as salted hashes. New accounts must verify control of their email address, API access is authenticated, records are scoped to their account owner, and plant photos require an authenticated request.

Accounts created before verification was introduced are honestly labelled as legacy accounts rather than being falsely marked verified. They can continue to sign in and may verify later.

No internet service can promise absolute security. Please use a unique password and contact support if you believe your account or information has been exposed.

Material changes to how personal information is used will be reflected on this page and, where appropriate, explained before the changed processing begins.

Questions and complaints

Please contact Chili Tracker first if you have a privacy concern so it can be investigated and, where possible, resolved.

You also have the right to complain to the UK Information Commissioner's Office. Visit the ICO complaints service or call 0303 123 1113.