Privacy Policy

ASH is made by FNN Botanicals. When this policy says “we” it means FNN Botanicals, and when it says “you” it means whoever is signed in to the account.

If you use ASH through a business account that somebody else set up — a nursery you work at, for instance — the account owner controls that data, and you should ask them what they do with it. Section 9 covers that arrangement.

Almost all of it is something you typed or photographed on purpose.

• —Your account. Email address and password. Passwords are hashed by our authentication provider and we never see them. Optionally a display name and a ZIP or postal code, which is used for local weather.
• —Your plants. Species and nicknames, category, placement, soil, pot size, notes you write, and whether a plant is quarantined or has been retired.
• —Photos. Every picture you take or upload of a plant, a leaf, a pest, or soil.
• —Care history. Watering and feeding schedules, tasks you complete, growth measurements, health checks — including symptoms, the diagnosis, the treatment you tried, and whether it worked — pest logs, journal entries, and harvest yields.
• —Light readings. If you use the light meter, the brightness values it measures. The camera feed itself is processed on your device and is not uploaded.
• —Sightings. Plants you identify without adding them, along with any note you write about where you saw it. We do not read your device’s GPS.
• —Conversations with ASH. What you ask and what it answers.
• —Orders. If you buy something, your email, shipping address, and what you ordered. Card details go directly to our payment processor and never touch our servers.
• —Messages you send us. Name, email, and the message itself.
• —Invitations. The email address of anyone you invite to share plants or join a business team.
• —Technical records. IP address and request logs, kept briefly. We use the IP address to rate-limit the free plant identifier so it cannot be abused by somebody who never signs up.

We use cookies and browser storage to keep you signed in and to remember small preferences, like which view you last used for your collection. Those are required for the app to work.

We do not run any product analytics at the moment. Nothing counts your page views or your taps.

Photos are stored under a long random filename that nobody can guess. Inside the app they only ever appear to you.

Identification, diagnosis, the daily briefing, and the chat all work by sending information to Anthropic, which runs the Claude model behind ASH. Depending on the feature, that includes the photo you are asking about, the details of the plant, your recent care history for it, your first name, and the general weather where you are.

Anthropic processes this to produce the answer and does not use it to train their models. We do not send your email address, your exact address, or your payment details to any AI provider.

Answers from ASH are stored with your account so the conversation and your plant’s history make sense next time.

This is the section most people are actually looking for, so it is the most specific one here.

Deleting a plant. The plant disappears from your account immediately and stops appearing anywhere in the app. Before it goes, we copy part of its record into a research archive that has no link back to you. That copy has no user ID, no email address, no account of any kind attached to it — it is not that your name is hidden, it is that the columns to store it do not exist in those tables.

The photo files are moved out of your area of storage entirely, so the link you had stops resolving and the file’s new location says nothing about who took it.

We do this because a photo of a sick plant, the treatment that was tried, and whether the plant recovered is the only way ASH learns to give better answers than a generic care sheet. Deleting that record would throw away the one thing that makes the advice worth having. Keeping it attached to you would be worse. So we keep it detached.

Deleting your account. Your profile, plants, photos, schedules, logs, messages, and conversations are deleted. Research records already de-identified under the rule above stay, because there is no longer anything in them to connect to you and therefore nothing to return or erase. Order records are kept as long as tax and accounting law requires.

If you would rather it not be kept at all, tell us before you delete the plant and we will purge it instead. See Section 11.

If ASH identifies a plant wrongly and you correct it, we record the correction, the photo, and what the AI originally said. Your correction changes your plant right away.

It does not change anything for anybody else until a human reviews it. If several people independently correct the same photo the same way, that gets flagged for review sooner. When a correction is accepted, what enters our species knowledge base is the species name only — never your notes, and never anything identifying you.

Two features publish something, and both are off unless you turn them on.

• —Plant passports. Turning on a passport puts that plant’s page on the public internet at its own address — the photos, the species, and the care profile. It can be found by search engines and it does not show your email address. Turning it off takes the page down, though a search engine may hold a copy for a while after.
• —Sharing with people you invite. Inviting somebody to a household or a business team lets them see the plants you share with them, and they can see the email address you used to invite them. Removing them ends their access.

Business accounts can store customer records, supplier details, and sales history. If you put another person’s name, email, or phone number into ASH, you are the one responsible for having the right to do that and for telling them. We hold that information on your behalf, use it only to run the features you are using, and delete it when you delete it or close your account.

We do not sell your information, we do not share it for advertising, and none of these companies may use it for their own purposes.

We may also disclose information if the law genuinely requires it, or to protect somebody from harm. If a company acquires FNN Botanicals, your information may transfer with it, and this policy continues to apply until you are told otherwise.

• —Everything in your account stays until you delete it or close your account.
• —De-identified research records, as described in Section 6, are kept indefinitely.
• —Order and payment records are kept for as long as tax law requires, typically seven years.
• —Server logs are kept for a short period for security and debugging.
• —An account with no sign-in for 3 years may be deleted after we email the address on it first.

You can do all of this yourself, from inside the app:

• —See and edit everything on your plants, and export your care history.
• —Delete any plant, photo, or log, or close your account entirely.
• —Turn push notifications, the daily briefing, and calendar sync on or off.
• —Turn any plant passport on or off, and remove anybody you have shared with.

Depending on where you live you may also have the right to a copy of your data, to have it corrected or erased, to object to how we use it, and to complain to a data protection authority. Some places give you the right not to be discriminated against for exercising these rights, and we do not. Ask us and we will action it — we will not make you jump through hoops.

One honest limit: once a research record has been de-identified we can no longer tell which one was yours, so we cannot pull it back out for you. If that matters to you, say so before you delete the plant and we will purge it outright instead.

Your data is separated at the database level so that one account cannot read another’s, and that rule is enforced by the database itself rather than by the app remembering to check. Traffic is encrypted. Administrative access is limited to people who need it.

No service can promise it will never be breached, and we are not going to pretend otherwise. If a breach affects you, we will tell you and we will tell you what actually happened.

ASH is not for children under 13. We do not knowingly collect anything from them. If you believe a child has given us information, write to us and we will delete the account.

Our servers and service providers are in the United States. If you use ASH from elsewhere, your information is transferred there and handled under United States law, which may protect it differently than your own country does.

If we change something that matters, we will update the date at the top and tell you in the app or by email before it takes effect. We will not quietly rewrite this page and hope nobody notices.

Privacy questions, requests, or complaints go to privacy@fnnbotanicals.com or through the contact form. A real person reads them.

The rules for using ASH are in the Terms of Service.