Formal privacy policy is still pending.

What reaches the website host

Like any website, Pink Garden Plot sends the page address you request to its CDN and hosting provider so the page can load. If your selected state or region appears in a calendar URL, that location choice is part of the request. Hosting and configured observability may record request details in operational logs; their final retention settings still need review.

What stays in this browser

My Garden records and saved Garden Projects use local browser storage for this site. They are scoped to this browser profile and site origin, with no server sync, backup, or export. Clearing site data, changing browser profiles, or losing access to this device may remove those records.

Managed account service

The client-owned Supabase project is connected for the limited account sign-in flow. Supabase Auth processes the client-created user's email address, password authentication, email verification, recovery, session, and authenticator status. The password goes directly to Supabase; Pink Garden Plot does not store, log, or recover it. The site uses auth cookies to keep the reviewed session refreshed.

Supabase Postgres stores an internal user ID, optional display name, account timestamps, a protected role grant if one is manually approved, and a subscription-ready calendar entitlement record if one is later granted. Row Level Security limits users to their own readable account rows, and browser code cannot write roles or entitlements. The initial administrator also must complete email verification and TOTP before the protected admin status page opens.

Public signup and public password recovery are disabled. Cloudflare Turnstile protects the enabled sign-in form. Supabase's default auth email remains limited to the client administrator during bootstrap review; customer accounts require a dedicated transactional email service and further policy approval. Provider-specific retention and deletion/export procedures remain pending.

What is not connected

The app has no geocoder, application analytics provider, server-side garden sync, payment processing, contact-form delivery, or newsletter storage connected. The visible newsletter signup does not currently send or save an address. No billing provider, price, subscription purchase, or customer entitlement is active.

Business email is separate

GoDaddy is the human-operated business mailbox provider. It is separate from Supabase authentication and from the still-pending application email provider. No mailbox credentials are part of this application, and this review work does not change email DNS.

What still needs a decision

A reviewed privacy policy, monitored support/contact method, account deletion and export process, age/consent decisions, dedicated transactional email, provider retention settings, and customer-account operations are required before public accounts can be enabled.