Privacy
Questions to privacy@ldn.garden
Anything that leaves your phone is minimal and anonymous.
Everything that can run on your phone runs on your phone.
- Camera frames. Analysed live to recognise trees; never stored, never uploaded.
- Finding the trees around you. The whole database is inside the app, so your location is matched against it on the phone and that lookup sends nothing.
- Sun, shade and recognition. All worked out on the phone.
- Chat history. Kept locally on your phone.
A few things go out on their own rather than because you asked: the weather, the list of trees other people have added near you, a report if the app crashes, and a count of which screens get opened. The first two are sent an area of about a hundred metres rather than where you are standing, and the last two carry no position at all. Your exact position leaves the phone only when you ask for walking directions, the name of a street, or add a tree to the map. All of it is listed below.
| Data | Where | When | What it contains |
|---|---|---|---|
| Weather request | A weather service | Automatic | Approximate coordinates only, no identifiers |
| Trees added nearby | Our servers | Automatic, as you move | An area of about 100 m, an anonymous device token, and your account once signed in |
| Tree chat | Our servers, then a language model provider | When you send a message | Your messages, the tree’s public dataset facts, a one-line weather summary, an anonymous device token |
| Purchase receipt | Our servers, then the app store | After a purchase | The store’s signed transaction, and your account. Buying requires signing in, so this one is tied to your Apple ID rather than anonymous: that is what lets a purchase follow you to a new phone |
| Match telemetry | Our servers | Only if you opt in. Off by default | Species guess, confidence, roughly 1 km grid cell. Never photos, never precise location |
| A correction you send | Our servers | When you tell us a guess was wrong | The guess, what you say it really is, and roughly a 1 km area. Sent whether or not the setting above is on, because you asked us to know. Never photos, never your exact position |
| Walking directions | Apple Maps | When you ask to be shown the way to a tree | Your position and the tree’s, so a route can be drawn |
| Street name | Apple | When a tree’s street is shown | The tree’s position, not yours |
| A tree you add | Our servers | When you submit one | The tree’s position, your note and photograph, and your account |
| Spoken replies and calls | Our servers, then a speech provider | When you listen or call | The tree’s words to be spoken, and for the length of a call your live microphone audio, which is not kept |
| A photograph of a mapped tree | Our servers | When you offer one | The picture, where it was taken, the name you chose to put on it if any, and which licence wording you agreed to. Photographs a person approves become public on that tree’s page |
| A voice message | This phone, or Apple | When you record one | The recording, turned into text on the phone whenever it can, and on Apple’s servers when the phone has no offline English |
| A crash or a freeze | A crash reporter | Automatically, when one happens | What went wrong and where in our own code, the version of the app and the model of phone. No account, no position, nothing that names you |
| Which screens get opened | An analytics provider | Automatically, unless you turn it off | Which part of the app was used and whether something worked. No account, no position, and never what you typed, said or photographed. Off from Settings |
| Species photographs and facts | Our servers | When a tree’s page is opened | Which species is being looked at, and the device token |
| Birds nearby | Our servers | When a tree’s page or a chat is opened | A roughly 1 km area, and the device token. Never your exact position |
| Entitlement refresh | Our servers | On launch, and after a purchase | The device token, or your account once you have signed in. This is how the app knows what you have paid for |
| The photographs themselves | Wikimedia Commons | When a picture is shown | Fetched straight from Wikimedia, so they can see this phone’s IP address and which species you looked at. We do not pass them through our servers, which would hide your address from Wikimedia and show it to us instead |
A random identifier created on first launch and kept in your Keychain. It lets free trials, purchased credits and rate limits work with no account, no email and no sign-in. It is not derived from any hardware identifier.
If you sign in, it stops being anonymous. Signing in with Apple creates an account that holds the email address Apple gives us, which may be its private relay address rather than your real one, and the token on this phone is linked to that account so your purchases follow you to a new one. Delete the account from Settings in the app and both go, along with anything you bought and any trees you added.
- Chat content is not logged; quota counters store numbers only.
- Telemetry events are stored without device tokens and without IP addresses.
- Rate-limit counters expire automatically.
- Hosting and databases
- The servers behind chats and purchases, and the counters that limit them
- A language model provider
- Answers a conversation
- A speech provider
- Turns a reply into a voice
- A mailing list provider
- Holds an address you gave us yourself, until you unsubscribe
- The app store
- Verifies a purchase
- A weather service
- Reports the conditions over a tree
- A crash reporter
- Receives a report when the app crashes or freezes
- An analytics provider
- Counts which parts of the app get opened
Each is given only what it needs for that job.
We do not sell, rent or share anything about you with anyone for their own purposes. There is no advertising in the app, no advertising identifier is read, and nothing here is passed to an advertising network or a data broker. The only companies that see any of it are the ones listed above, each doing one job for us, and none of them is paid in data.
Usage is counted so we can see which parts of the app get opened. It is stored without your device token and without your address, no profile of you is built from it, and you can turn it off in Settings. Crash reports are the same bargain: they say what broke and in which version, so it can be fixed, and they carry nothing that names you.
The data controller is ZOKE.GG LTD, a company registered in England and Wales, company number 16383692, registered office 124-128 City Road, London EC1V 2NX. For any question about your data, or to ask for the anonymous purchase record tied to your device token to be deleted, write to privacy@ldn.garden.
The app is not directed at children under 13 and we do not knowingly collect anything about them.