Wild Garden app privacy notice

Last updated: October 25, 2026

This is a translation for your convenience; the German version is the legally binding one. This notice covers the app at app.wildgarden.io. The website www.wildgarden.io has its own privacy notice.

In short

Your answers can reveal something about your health. That is why we process them only with your explicit consent.
Your data is stored in a database in Frankfurt. An AI reads your texts through Amazon Web Services in data centers in the EU to ask follow-up questions and summarize. Your inputs are not used to train AI models.
In the exercise without sign-up, we know neither your name nor your email address, and we delete everything automatically after 30 days.
If you become a member, Stripe handles the payment. We never see your full card or account details.
If you invite someone to keep at it with you, that person sees only your current step, never your answers.
No advertising trackers, no analytics cookies.
You can withdraw any consent at any time and delete your account completely yourself.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Wild Garden GbR
Baaderstr. 88
80469 München
Germany
Email: privacy@wildgarden.io

Data protection officer: We will appoint a data protection officer before the general launch and name them here. Until then, contact us with any data protection question at the address above.

2. Delivering the app

The app is delivered through Vercel; its server functions run in Frankfurt. Supabase runs the database and sign-in in Frankfurt. They process the data your browser sends for technical reasons: IP address, date and time, address requested, browser type, operating system and status code.

Purpose: delivering the app and keeping it stable and secure, for example against attacks and overload.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure, working service.
Retention: Vercel and Supabase delete these logs automatically, after seven days at the latest.

3. The exercise

When you tap "Start", we first ask for your age group (section 16). If you are 18 or older, the app creates an anonymous account: a random ID, with no name and no email address. Before your first answer in the exercise, we ask for your consent. We then process:

your age group (required before consent, stored only after it; until then it stays in your browser only);
your answers in your own words, your obstacle, your first step and the name you give your direction;
if you make your first step smaller: the new version, which you write yourself; it replaces your first step, and the original version stays stored;
the AI's follow-up questions and summary (section 4) and your corrections to them;
your ratings from 1 to 5: how you feel (at the start and at the end), how clearly you now know what you want, whether you felt understood and how confident you are that you will take your first step in the next three days;
your life situation (optional, e.g. changes at work or a new phase of life; may concern your health);
which version of the exercise you see (we test several openings; chance decides which one you get);
your consents: text and version, when given and, if so, when withdrawn.

Your text from the start page. On the start page you can write right away where you want to go or what is on your mind. This text is not sent to us and does not appear in the page address. It stays only in this tab of your browser (section 10) until you have answered the age question and given your consent. Before that, your browser checks it against fixed keywords for signs that you may be in a very bad place right now (section 5); if the check triggers, we first show you contacts for support services and store nothing. Only after your consent does the text become your first answer in the exercise and get processed like any answer, including by the AI (section 4); we then delete it from your browser's storage. If you start this way, chance does not choose the version of the exercise, and we record this entry point. If you stop before giving consent, the text never leaves your device, and your browser deletes it when you close the tab.

We do not offer a dictation feature of our own. If you use your keyboard's dictation, your device maker processes the speech under its own terms; we only receive the finished text.

Purpose: to let you do the exercise and show you your result.
Legal basis: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR).
Withdrawal: at any time, with effect for the future. We then delete your answers.

Until you sign up, your answers are linked to you only through the sign-in in your browser. If you clear your browser data or switch devices, they can no longer be matched to you.

If you write about other people, please keep it to what you need for the exercise.

4. Follow-up questions and summaries written by an AI

An AI writes the follow-up questions and summaries; the app tells you so (Art. 50 EU AI Act). The AI builds them only from your words. It gives no advice and makes no diagnoses.

To do this, we send your texts from the current exercise to Amazon Bedrock, a service of Amazon Web Services (AWS), where AI models by Anthropic (Claude) run. We call the service in Frankfurt and use AWS's EU routing: each request is processed in an AWS data center in the EU (Frankfurt, Stockholm, Milan, Spain, Ireland or Paris), never outside the EU. AWS is our processor. Your inputs are not used to train AI models. Model invocation logging is switched off on our side, and we have switched off data retention at Amazon Bedrock (mode "none"): AWS does not store inputs or outputs. Anthropic as the model provider has no access to your inputs.

Legal basis: as in section 3.

5. Pointers to support

Your texts and mood ratings are checked automatically for signs that you may be in a very bad place right now. If so, we show you contacts for support services. The check runs in two stages: first against fixed keywords, then by the AI (section 4). If it triggers, we only record that the support screen was shown. Nobody is notified, and nothing is passed on to third parties.

We count, in aggregated form, how often such pointers appear. If they appear clearly more often in one version of the exercise than in others, we pause that version.

Legal basis: your consent under section 3 (Art. 9(2)(a) GDPR).

6. Your account and your membership

When you sign up, your anonymous account becomes an account with sign-in, and your answers stay. There are two ways:

Email link: we store your email address and send you a sign-in link.
Sign in with Google (only if you choose it): Google sends us your email address and a Google ID and, if stored at Google, your name and profile picture. Google is responsible for the sign-in at Google itself; Google's privacy policy applies to it.

With an account you get an in-depth assessment (questionnaires on personality, strengths and patterns) and a personal plan; once we offer the membership, the plan is part of the membership (below). We store your questionnaire answers, your results and your plan. We score the questionnaires using fixed, versioned rules. No AI writes any of it: the assessment is assembled from fixed, pre-reviewed text blocks and your own words, and you write your plan yourself.

Legal basis: for account data, Art. 6(1)(b) GDPR; for questionnaires, results and plan, your consent under section 3 (Art. 9(2)(a), Art. 6(1)(a) GDPR).

Check-ins and "Your path"

With an account, we ask you how things are going after three, 30 and 90 days. With a membership, we also ask after seven days and then every week. As long as we don't offer a membership, everyone with an account also gets the check-in after seven days. We store your answers:

after three, seven and 30 days: the step it was about, whether you took it, how much closer you have come to your direction (1 to 5) and whether your if-then plan kicked in;
every week (membership): the step it was about, whether you took it, how much closer you have come to your direction (1 to 5), optionally what got in the way (a choice of: no time, no energy, forgot, the step was too big, other people, doubts), and your next step in your own words, which becomes your current step;
after 90 days: how much closer you have come to your direction (1 to 5) and whether your goal stayed the same or whether you consciously adjusted it or consciously let it go;
each time, optionally and in your own words, what helped and what held you back.

"Your path" shows your check-ins. For the weekly check-in we store the weekday you choose in your account (without a choice, the weekday your membership started) and on which days we sent you a check-in.

Legal basis: for your answers, your consent under section 3 (Art. 9(2)(a), Art. 6(1)(a) GDPR); for the weekday and send dates, Art. 6(1)(b) GDPR. For the emails, see section 7.

Membership

The membership is optional and costs money (terms of use, section 14). It gives you your personal plan, the check-ins after seven days and every week, "Your path" with every week, and "Keeping at it together" (below).

For the membership we store in our database: your account ID, your customer ID and subscription ID at Stripe, status, plan (yearly, monthly, or the monthly continuation after a year), start, end of the current period, whether it is cancelled as of that end, whether you have chosen another year, and for which year-end we reminded you. Before paying, you expressly request that we start before the withdrawal period ends; we store this statement as proof, like a consent (text and version, time).

Legal basis: Art. 6(1)(b) GDPR; for the proof of your request to start before the withdrawal period ends, Art. 6(1)(f) GDPR: if you withdraw, we must be able to show that you requested the earlier start (Section 357a(2) BGB). We delete the proof with your account, even if the payment did not go through.

If you delete your account, we first end a running membership at Stripe immediately (section 13).

Paying through Stripe

Stripe handles the payment. The payment field on the membership page comes from Stripe: what you enter there, for example card or account details and, depending on the payment method, name, country or address, goes directly to Stripe. We never receive full card or account details. We give Stripe your email address, your account ID, your language and the plan you chose. Stripe collects the payments, issues the invoices and runs the terms of your membership. In Stripe's customer portal, which you reach from your account, you change your payment method and see your invoices. You can pay by credit or debit card and, depending on your device, also through Apple Pay or Google Pay; Apple's or Google's terms then also apply, and they are responsible for their own service. We do not offer other payment methods, such as PayPal, direct debit or Link, Stripe's own payment service.

For processing the payment, Stripe is our processor. For its own purposes, Stripe is a controller itself under its data processing agreement: to detect and prevent fraudulent payments, to meet legal obligations such as anti-money-laundering checks, to involve banks and payment providers, to manage financial risk and to improve its own services. Stripe's privacy policy applies to this: stripe.com/privacy.

So that Stripe can detect fraud, the membership page loads a script from Stripe (Stripe.js). According to Stripe, it sends Stripe characteristics of your browser and device and signals about how you use the page, such as mouse movements and time on the page; Stripe may also load a check against automated access (hCaptcha) there. We load the script only on the membership page. Which cookies and browser storage entries Stripe uses for this, and for how long, Stripe describes at stripe.com/cookie-settings. We are responsible for including the script on our page; what Stripe does with these signals is Stripe's own responsibility (above).

Legal basis: Art. 6(1)(b) GDPR; for invoices and accounting records, Art. 6(1)(c) GDPR with the retention duties under tax law; for the fraud-detection script, Art. 6(1)(f) GDPR; our legitimate interest is protecting your payment and us against fraud. Section 10 explains the storage on your device this needs.

Cancelling and withdrawing without signing in

At the bottom of every page of the app you find "Cancel contracts here" and "Withdraw from contract". There we store what you enter: name, email address, optionally a contract number or your account's email address, for a cancellation its type (ordinary or extraordinary), the requested date and, for an extraordinary cancellation, the reason; plus language, time of receipt and processing status. For an ordinary cancellation, we look up memberships under the email address given at Stripe and end them at the end of the current period. We send the confirmation to the email address given and a copy to our team inbox. To prevent mass requests, we accept at most ten requests per IP address in ten minutes; for this, the IP address is held only in the server's memory, for at most ten minutes after the last request, and is not stored.

Legal basis: Art. 6(1)(c) GDPR with Sections 312k and 356a of the German Civil Code (BGB); where you have a contract with us, also Art. 6(1)(b) GDPR.
Retention: section 13.

Keeping at it together

As a member, you can invite one person to keep at it with you. You enter what the person should call you, their name and their email address, and confirm that you asked them and that they agree to an invitation. You also explicitly consent to them seeing your current step. We send them a single invitation (contents below). Only when they accept by clicking the button does it begin. After that, once a week, on the day you get your weekly check-in, they receive a short reminder to ask you how it is going. The email does not contain your step, only a personal link. Through it, the person sees only your current step (the next step from your latest weekly check-in, otherwise your first step) and the name you gave for yourself. They never see your answers, your ratings, your progress or anything else. Your step can reveal something about you, including about your health; don't put anything in it you don't want the person to read.

In your account you see the person's name and whether they have accepted. There is only ever one open invitation or person. You can withdraw the invitation or end it, and so can the person; we then delete their name and email address. We keep only the fact that there was an invitation: your account ID, the name you gave for yourself, status and times. If your membership ends, keeping at it together is paused: we send no more reminders, and the person's links no longer show your step, only that it is paused. If you become a member again, it continues.

Legal basis: for your invitation details, Art. 6(1)(b) GDPR (part of your membership); for showing your step, your explicit consent, which you give separately when you invite (Art. 9(2)(a), Art. 6(1)(a) GDPR), because your step can reveal something about your health. You withdraw it by ending it. We store your confirmation that you asked the person, with its wording and time, as proof (Art. 6(1)(f) GDPR).

If someone invited you

If a member invited you through "Keeping at it together", this is our information for you under Art. 14 GDPR. We are the controller (section 1).

Where your data comes from: from the member who invited you.
Which data: your name and email address, the language of the invitation, whether you accepted, declined or ended it, and when.
What for: to send you the invitation and, if you accept, a short weekly reminder with a link to the member's current step.
What we don't do: we send you only this one invitation; if you don't answer, we won't write again. You don't need an account, and we set no sign-in cookie for you. The links in our emails only open a page; only you can accept, decline or end, by clicking the button there.
Recipients: Supabase (database), Vercel (servers) and Google Workspace (sending the emails), all as our processors (section 11).
Retention: if you decline or end it, we delete your name and email address right away; the same if the member withdraws the invitation, ends it or deletes their account. An unanswered invitation is valid for 30 days; after that we delete it automatically, with the name and email address.
Legal basis: until you answer, Art. 6(1)(f) GDPR: the member wants to invite you, and we want to make that possible; for this we send you only this one email and delete your details after 30 days at the latest. If you accept, we process your details with your consent, which you give by clicking "Accept the invitation" (Art. 6(1)(a) GDPR). You withdraw it by ending it.
Your rights: as in section 14, including the right to object. An email to privacy@wildgarden.io is enough.

Your garden

With your account you can use the garden: planner, goals, journal and mood. It is free. Before you keep anything in it, we ask you once, explicitly, for your consent (`consent-garden-2026-10-23`), because your entries can reveal something about your health.

What we store: what you keep in the garden: goals with milestones, entries, notes and reasoned changes; tasks with date, time, duration, energy, recurrence, subtasks and if-then sentences; journals with entries, tags, photos, voice recordings and PDF files; moods with your own words, activities, notes and photos; important days; reminders with time and time zone; your settings (time zone, which AI features you switched on). Plus the times you created or changed something.
Your first entry: when you open the garden for the first time and consent, we take your direction from your first session as a goal and your first step as a task for today, in your words. If you did not edit the AI's summary yourself, it appears labelled in the notes.
Photos and files: your browser re-encodes every photo before uploading and removes its metadata, including location. If a photo still contains location data, we refuse and delete it. We do not accept videos. Voice recordings are made in your browser and contain no location. PDF files are stored as you upload them, including the details stored in the file itself, such as author, creating software or date; remove them first if you don't want us to store them. At most 50 MB per file and 1 GB in total.
What for: so you can use, find and evaluate your entries (for example "What does you good") and so we remind you as you set it up. Your garden is not used for research and never for advertising.
Legal basis: your explicit consent (Art. 9(2)(a), Art. 6(1)(a) GDPR). Without it the database stores nothing new, and we send no reminders.
Where: in our database and file storage at Supabase in Frankfurt, encrypted at rest. Only you can read your entries; the database checks this on every query.
AI features (only if you switch each one on): create tasks from a sentence; draft a day from your own tasks; ask one question about a journal entry; write a monthly look-back from your entries. For this an AI reads the texts it needs via Amazon Bedrock in data centres in the EU (as in section 4); before that we check the text for signs of a crisis. Nothing is used for training, and AWS does not store inputs or outputs. So that nobody uses the AI without limit, we count per day and feature how often you used it; we delete these counters after 30 days. For quality control we log per call only the feature, model, duration and success, without your text and without any link to you.
Reminder emails are sent via Google Workspace. Subject and text only say that a reminder is due and lead into your garden. Only if you explicitly set it for a reminder does the email name the task or goal and the if-then sentence. Every email has an unsubscribe link.
Reminders as push notifications (only if you allow them on a device): your browser gives us an address at its maker's push service (for example Apple, Google or Mozilla). Through it we send an encrypted message the push service cannot read; it shows only "Wild Garden". If you sign out or switch push off, we delete this device's address.
Calendar: you can subscribe to your plan as a calendar link. Anyone who knows the link sees the tasks in it; so we store only a check value of the link, and you can replace it with a new one at any time. If you wish, the calendar shows only "Wild Garden" instead of titles. If you connect your own calendar through its secret link (Google, Apple, Microsoft), we store that link encrypted. Our server fetches the calendar only when you look at your plan and shows the events as busy times; we do not store the events. The calendar provider sees our server's address.
App lock (optional): if you set a PIN, only a check value of the PIN stays in this browser. The PIN hides the garden on this device; your account, not the PIN, protects your data.
How long: until you delete entries, withdraw your consent or delete your account. Uploads that were never completed are deleted after one hour.
Withdrawal: at any time under Settings → "Empty garden". From then on we store nothing new and send no more reminders. You can export your garden first (JSON, CSV, print view); then we delete it entirely, including photos and files. Your account stays. If you stop halfway after withdrawing, we delete the rest automatically by the next day at the latest.

7. Emails

We send sign-in links and the check-ins about your first step, your plan and your progress (section 6: after three, 30 and 90 days, with a membership also after seven days and every week on the weekday you choose) through Google Workspace (Google Ireland Limited) as our processor. You can unsubscribe from the check-ins at any time via the link in every email or in your account; this applies to all check-ins together, including the weekly one. The emails do not contain the wording of your answers, only a link into the app.
Legal basis: Art. 6(1)(b) GDPR.

With a membership, we also send you emails about the contract that you cannot unsubscribe from: the purchase confirmation with the contract details, your request to start before the withdrawal period ends, the withdrawal instructions and the model withdrawal form and, for the yearly membership, a reminder 14 days before the year ends about what happens next. We answer a cancellation or withdrawal with a confirmation of receipt (section 6).
Legal basis: Art. 6(1)(b) and (c) GDPR (Sections 312f(2), 312k(4) and 356a BGB).

Invitations and reminders for "Keeping at it together" go to the invited person, not to you (section 6).

If you email us, we process your message to answer it (Art. 6(1)(b) or (f) GDPR) and delete it once it is no longer needed for that and no retention obligation applies.

8. Measuring and improving

To see where the exercise helps and where people drop off, we store in our own database which step you reach, when, and which version you see, and we analyze your ratings for clarity, feeling understood and confidence. No third-party analytics, no advertising trackers. We also store which link brought you here (campaign identifiers, so-called UTM parameters, and entry point).

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is improving the exercise. You can object (section 14).

We analyze your age group and, if you gave it, your life situation in aggregated groups to see who the exercise works for. Because your life situation can concern your health, we do this within your consent under section 3 (Art. 9(2)(a) GDPR).

Other data that reveals something about your health, such as your mood or a support pointer shown to you, is analyzed only with your consent: for safety (section 5) and, if you agreed, for research (section 9).

Make a wish. With the "Make a wish" form (on the start page, at the end of the exercise, in your account and on a page of its own) you can tell us what to build, change or fix. We store your message, its kind (wish, change, problem, praise), the page it comes from, the language and the time, plus our processing status (new, planned, built, declined). If you are signed in, including with the anonymous account of the exercise, we link the message to your account. You give your email address only if we may ask follow-up questions or let you know. We send a copy (message, kind, page, language, whether you were signed in and, if given, your email address) to our team inbox at Google Workspace (section 11). To prevent mass messages, we accept at most five messages per IP address in ten minutes; for this, the IP address is held only in the server's memory, for at most ten minutes after your last message, and is not stored (section 2 applies to access data). If your message contains keywords that may point to a crisis, the form shows you contacts for support services after sending; nothing else happens. Please do not write anything about your health or other sensitive information about yourself or other people in the form.

Legal basis: for the message and the details that go with it, Art. 6(1)(f) GDPR; our legitimate interest is building what people need. You can object (section 14). For your optional email address, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Retention: section 13.

9. Research (only with separate consent)

If you choose, you can consent to us analyzing your answers in pseudonymized form, separated from your name, email address and account ID, to better understand what people really want and what helps them. We publish only aggregated results with a minimum group size, so no conclusions about individuals are possible.

Legal basis: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR).
Withdrawal: at any time, with no disadvantage. We then stop using your data for research and delete the pseudonymized data, at the latest together with your other data (section 13). Results already aggregated anonymously remain.

Whether you consent makes no difference to what you get in the app.

10. Cookies and storage in your browser

We store information on your device only when this is strictly necessary for the use you request (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG): for your sign-in session, including the anonymous account, and for running the exercise. Without the sign-in session, the app could not match your answers to you. The sign-in cookie is called sb-ttelbxzaqqtvwyfslppb-auth-token (split into several parts if needed) and lasts up to 400 days or until you sign out. During a sign-in by link or with Google, a cookie ending in -code-verifier is added briefly. The legal basis for the processing related to the sign-in cookie is Art. 6(1)(b) GDPR.

For the exercise, the app also uses two entries in your browser's storage:

wg.hero in this tab's session storage: your text from the start page (at most 2,000 characters), until you give your consent (section 3). If you reload the page before giving consent, the app restores it from here. Your browser deletes it when you close the tab; after your consent, we delete it.
wg.first-session.1.1.0 in local storage: your progress in the exercise (session ID, version, the step you reached, your answers so far and, from the age question on, your age group; session ID and age group already before your consent), so you can continue after a reload. Your text from the start page is never stored there. We remove this entry when you finish the exercise or delete your answers or your account.

Once content from these entries reaches us, section 3 applies.

On the membership page, Stripe's payment field loads. Stripe may store or read information on your device there to detect fraud (section 6); Stripe lists which entries these are and how long they last at stripe.com/cookie-settings. This is strictly necessary so that the payment you request there can be processed securely (Section 25(2) No. 2 TDDDG); that is why we do not ask for your separate consent.

People invited through "Keeping at it together" don't need an account; we set no sign-in cookie for them.

We set no advertising or analytics cookies, so there is no cookie banner.

11. Recipients

These providers process data as our processors (Art. 28 GDPR), only on our instructions:

Vercel Inc., USA, 440 N Barranca Avenue #4133, Covina, CA 91723, USA: hosting, server functions in Frankfurt (fra1)
Supabase (Supabase Pte. Ltd., Singapore): database and sign-in, Frankfurt (eu-central-1)
Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): AI processing through Amazon Bedrock, data centers in the EU (called in Frankfurt, eu-central-1)
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: sending emails, including contract confirmations and invitations, and copies of feedback, cancellations and withdrawals to our team inbox (Google Workspace)
Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: processing payments for the membership, invoices, customer portal

For push notifications from the garden (section 6), we use the push service your browser specifies (for example Apple's, Google's or Mozilla's). It forwards an encrypted message it cannot read and receives only your device's push address and technical delivery details, such as time and size. Independently responsible are Google for sign-in with Google, if you choose it, Stripe for its own purposes, such as fraud prevention and legal obligations, Apple or Google if you pay through Apple Pay or Google Pay (section 6), and the browser makers for their push services; we have no contract with them for this. We use no further services in the app.

Beyond that, we share personal data only where the law requires us to or where you want us to: we show your current step to the person you invited through "Keeping at it together" (section 6). We do not sell data.

12. Transfers to third countries

The database and server functions run in Frankfurt, AI processing in data centers in the EU. Vercel Inc. is based in the USA; transfers to it rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework of July 10, 2023 (Art. 45 GDPR) and on standard contractual clauses (Art. 46(2)(c) GDPR). Google LLC and Amazon Web Services, Inc. are based in the USA and certified under the Data Privacy Framework; the same applies where data reaches them. Supabase Pte. Ltd. is based in Singapore; possible access from Singapore or the USA (for example in support) is covered by standard contractual clauses. Possible third-country access at AWS is also covered by standard contractual clauses. Stripe transfers data to Stripe, LLC in the USA, which is certified under the Data Privacy Framework (Art. 45 GDPR); in addition, the standard contractual clauses in Stripe's Data Transfers Addendum apply (Art. 46(2)(c) GDPR). The browser makers' push services may run their servers outside the EU, for example in the USA. Where the provider is certified under the Data Privacy Framework, the transfer relies on the adequacy decision (Art. 45 GDPR); otherwise on the fact that you switched on push notifications and we can deliver them only through your browser's push service (Art. 49(1)(b) GDPR).

13. Retention

Without sign-up: we delete all data automatically after 30 days, counted from the start of the exercise.
With an account: until you delete your account. The deletion you trigger yourself in your account removes everything: account data, answers, results, plan, check-ins, measurement data and consents, plus the membership details in our database and your invitation for "Keeping at it together". We first end a running membership at Stripe immediately. We keep no record of your consents after that.
Membership at Stripe: we keep invoices and accounting records, at Stripe too, for eight years from the end of the calendar year in which they were created (Section 147(1) No. 4, (3) and (4) of the German Fiscal Code, AO; Section 14b(1) of the German VAT Act, UStG). The customer and subscription details at Stripe they belong to are kept for as long; after that we have them deleted at Stripe. What Stripe keeps for its own purposes (section 6) is governed by Stripe's privacy policy.
Cancellations and withdrawals: they are not tied to an account and stay stored after an account is deleted, until three years after the end of the year in which we dealt with them (regular limitation period, Sections 195 and 199 BGB); we then delete them, and the copies in our team inbox too.
Keeping at it together: the invited person's name and email address until they decline, either side ends it, the invitation is withdrawn or you delete your account; unanswered invitations 30 days. With the invitation we store that, when and in which wording the member confirmed they asked the person.
Withdrawal of the exercise consent: we delete your answers.
Your garden: until you delete entries, withdraw your consent (then we delete the garden, by the next day at the latest) or delete your account; AI use counters 30 days; unfinished uploads one hour.
Feedback ("Make a wish"): with an account, including the anonymous account of the exercise, until the account is deleted (without sign-up, therefore at the latest 30 days after the start of the exercise); without an account, 24 months from receipt. We delete an email address you gave automatically after twelve months, or earlier if you withdraw consent. We delete copies in the team inbox after twelve months at the latest, or earlier if you withdraw consent.
Research: section 9. Log data: section 2.
Backups: deleted data can remain for up to seven days in the daily database backups Supabase makes for us; after that it is deleted there too. We restore a backup only to recover the service after a failure.
We keep aggregated figures with no link to individuals, such as how many people reached a step.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal.

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR (sections 2 and 8; in section 6, the proof of your request to start before the withdrawal period ends, Stripe's fraud-detection script, the proof that you asked a person for "Keeping at it together", and an invitation until the invited person answers), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can delete your account and data and withdraw consents yourself in the app (in the exercise via “Delete my answers”, with an account in your account); we send you a copy of your data on request. Otherwise, an email to privacy@wildgarden.io is enough. Without an account, we recognize you only through the sign-in in your browser and usually cannot match an email to any data; that data is deleted after 30 days at the latest.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

15. No obligation to provide data, no automated decisions

You are not obliged to give us data. Without giving your age group and without the exercise consent, however, you cannot do the exercise, and without an email address or Google account you cannot create an account. For the membership we need the payment details; without them, no contract is concluded.

The in-depth assessment evaluates personal aspects such as personality and strengths. This is profiling within the meaning of Art. 4(4) GDPR, and it serves only you. It leads to no decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The app is not therapy and makes no diagnoses.

16. Minimum age

The app is for adults aged 18 and over. That is why we ask for your age group at the start (and anyone invited to keep at it together confirms they are at least 18 when accepting), before we ask for your consent and before any account is created. We rely on what you tell us and do not verify it.

If you choose "under 18", the exercise ends there. We create no account and store nothing about you in our database. The only thing we record there is how often "under 18" was chosen on a given day: a daily figure with no identifier and no IP address. As with any visit, the technical access data described in section 2 are processed.

Why 18: minors can conclude the app's contract of use on their own only to a limited extent (Sections 107 and 108 of the German Civil Code), and the app uses an AI to process sensitive data, such as data about health. That is why it is for adults only.

17. Changes

We update this notice when the app or the law changes. The version published here applies, with the date shown at the top. If what you consented to changes, we will ask you again.