Privacy Policy

Effective date: April 3, 2026 · Last updated: August 23, 2026

Introduction

Gardenpatch ("we," "us," or "our") is committed to protecting the privacy and security of our users' personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at gardenpatch.xyz, purchase our products, or use our services.

Information We Collect

Information you provide directly

• Contact information: name, email address, phone number (when voluntarily provided via forms)
• Payment information: processed securely through Stripe — we never store credit card numbers on our servers
• Communications: messages you send through our contact form or email
• Newsletter subscription: email address for our newsletter ("The Growth Spurt")
• Coach conversations: what you say or type to an AI coach — see "AI Coaches and Voice Data" below

Information collected automatically

• Usage data: pages visited, time spent, referring URL, browser type, device type
• IP address: used for analytics, security, and approximate geographic location
• Cookies and similar technologies: see Cookie Policy section below

Cookie Policy

We use the following types of cookies:

• Essential cookies: required for the site to function (e.g., workbook access tokens, session management). Cannot be disabled.
• Analytics cookies: help us understand how visitors use our site (Google Analytics/Vercel Analytics). Collect anonymized usage data.
• Functional cookies: remember your preferences (e.g., portal progress stored in localStorage — not transmitted to our servers).

We do not use advertising or tracking cookies. We do not serve third-party ads. You can manage cookies through your browser settings. Disabling essential cookies may prevent certain features (like workbook portal access) from functioning.

How We Use Your Information

• To provide and deliver products you purchase (workbooks, playbooks)
• To send you our newsletter (only if you opted in — you can unsubscribe anytime)
• To respond to your inquiries and provide customer support
• To improve our website, products, and services through analytics
• To process payments securely through Stripe
• To comply with legal obligations

We do not sell your personal information. We do not use your data for third-party lead generation or affiliate marketing.

Third-Party Service Providers

We share data with the following service providers who process data on our behalf:

• Stripe — payment processing (PCI DSS compliant)
• Mailgun — transactional email delivery (newsletter, purchase confirmations)
• Vercel — website hosting and edge functions
• Google Analytics / Vercel Analytics — anonymized website usage analytics
• OpenAI — powers the voice coach. Your microphone audio streams from your browser directly to OpenAI, which returns the coach's spoken replies
• Anthropic — powers the text coach and the free growth audit, and condenses coach conversations into the short memory facts described below
• Upstash — managed Redis storage for coach memory, usage allowances, and rate limiting

Each provider is bound by their own privacy policies and data processing agreements. We only share the minimum data necessary for each service to function.

AI Coaches and Voice Data

Our coaches are AI. Talking or typing to one is always your choice, and you can use the playbooks and portal without ever starting a conversation.

Voice conversations

• Where your audio goes: when you start a voice session, your browser connects directly to OpenAI and streams your microphone audio there. That audio does not pass through, and is not stored on, Gardenpatch servers.
• The live transcript you see on screen exists only in your browser for that session and is discarded when the session ends. We do not save voice transcripts.
• What we send OpenAI to start a session: the coach's instructions, the chosen voice, and — if you are signed in through a purchase or membership — the memory facts described below. We also send a one-way hash derived from your IP address so OpenAI can detect abuse; we do not send your name or email.
• OpenAI's own handling of audio it receives is governed by OpenAI's privacy policy and our agreement with them, not by this policy.

Text conversations

• Messages you type to a coach are sent to Anthropic to generate the reply. Your chat history for a module is kept in your own browser's local storage, not on our servers, and clearing your browser data removes it.

Coach memory

• What it is: if you are identified by a purchase, membership, or an email you gave us, a coach can save short facts about your business (for example, "runs a two-van HVAC company in Tampa") so it does not ask you the same thing twice. These are brief notes, capped in length — not recordings and not transcripts.
• Where it lives: our Upstash Redis store, keyed to your email address.
• How long: we keep at most the 40 most recent facts, and each expires automatically after about 200 days.
• How it is used: the most recent facts are included in the instructions sent to the AI provider at the start of a conversation, so the coach remembers you.
• Your control: email privacy@gardenpatch.xyz to see or erase what a coach remembers about you, and we will delete it.

Other coach-generated records

• If you ask a coach to email you a plan, or you give it your email during a conversation, we store that email with the short summary the coach produced (a headline and a few next steps) so we can send it and follow up.
• To keep the free tier sustainable we count usage against a signed, random visitor ID stored in a cookie, or against your email if you are a member, plus a one-way hash of your IP address. These counters hold usage totals, not conversation content, and expire within about 40 days.
• If a coach creates a shareable summary card for you, it lives at an unguessable link that expires. Treat any link you share as public.

Coaching is not professional advice. Our coaches give general business guidance and are not a substitute for professional, legal, financial, or medical advice. Please do not share sensitive personal information — health details, government ID numbers, or card numbers — with a coach.

Data Retention

• Contact form submissions: retained for 2 years, then deleted
• Newsletter subscribers: retained until you unsubscribe
• Purchase records: retained for 7 years (tax/legal compliance)
• Analytics data: retained for 26 months (Google Analytics default), then automatically aggregated and anonymized
• Playbook access tokens: expire after 1 year
• Coach memory facts: most recent 40 kept, each expiring after about 200 days — or erased on request
• Coach usage counters: about 40 days (monthly allowances) or 48 hours (daily limits), then automatically deleted
• Voice audio and transcripts: never stored by us — see "AI Coaches and Voice Data" above

Data Security

We protect your data with industry-standard security measures including:

• HTTPS encryption on all pages (TLS 1.3)
• HSTS with 2-year preload for forced encrypted connections
• HMAC-signed tokens with timing-safe comparison for access control
• HttpOnly, Secure, SameSite cookies to prevent XSS and CSRF attacks
• Content Security Policy headers restricting script execution
• Payment data handled entirely by Stripe (PCI DSS Level 1 compliant) — never touches our servers

Your Rights Under GDPR (EU/EEA Users)

If you are located in the EU or EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Data portability — receive your data in a structured format
• Object to processing based on legitimate interest
• Withdraw consent at any time

Legal basis for processing: We process your data based on (a) your consent (newsletter signup, form submissions, starting a coach conversation), (b) contractual necessity (workbook purchases, delivering coaching you subscribed to), and (c) legitimate interest (analytics, service improvement, preventing abuse of free usage).

Your Rights Under CCPA (California Residents)

If you are a California resident, you have the right to:

• Know what personal information we collect and how we use it
• Delete your personal information
• Opt-out of the sale of your personal information (we do not sell personal information)
• Non-discrimination — exercising your rights will not result in different pricing or service quality

To exercise any CCPA rights, email privacy@gardenpatch.xyz with "CCPA Request" in the subject line. We will respond within 45 days.

Children's Privacy

Our website and services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@gardenpatch.xyz and we will promptly delete the data.

SMS Communications

For users who voluntarily provide a phone number and explicitly consent, we may send SMS messages for service-related purposes only (appointment confirmations, meeting reminders). We never send marketing SMS without consent. To opt out, reply STOP to any message or email privacy@gardenpatch.xyz.

International Data Transfers

Our services are hosted in the United States. If you access our site from outside the US, your data may be transferred to and processed in the US. We ensure appropriate safeguards (including standard contractual clauses where applicable) are in place to protect your data during transfer.

Do Not Track

We honor Do Not Track browser signals. When we detect a DNT signal, we disable non-essential analytics tracking.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via a notice on our website or by email. The "Last updated" date at the top reflects the most recent revision. Continued use of our site after changes constitutes acceptance of the updated policy.

Contact Us

For privacy-related inquiries, data access requests, or to exercise your rights:

• Email: privacy@gardenpatch.xyz
• General inquiries: hello@gardenpatch.xyz
• Response time: We aim to respond to all privacy requests within 30 days (45 days for CCPA requests)