Privacy Policy

It covers trytrowel.com and the Trowel application. Most people using Trowel do so through an organization created by their employer. In that case the organization controls the account and its data, and its administrators can see and manage the designs and members within it. Direct questions about an employer’s data practices to that employer.

Account information. Name, email address, and a password. Passwords you choose are hashed by our authentication provider and we never see them. There is one exception: when an administrator invites you or resets your access, we generate a temporary password so you can sign in. It is emailed to you, and it is also shown on screen to the administrator who created it, so that they can pass it on if the email does not arrive. It is the only password of yours that ever exists in readable form, it is never stored in readable form, and it stops working as soon as you change it — so change it once you are in. We also record your role, permissions, when you were last active (the last time you used the app, updated at most once an hour), and which tips and announcements in the app are finished for you (you closed or opened them, or they ended). When a banner in the app announces a major new version of Trowel, we also record up to 5 of the days on which you open Trowel while it is running, so that it can go away by itself.

Organization information. Company name, plan and usage allowances, team membership, and role settings.

Design content. Everything you enter to do the work: client name, location, dates, season, pot specifications, plant placements, your plant library, AI Design Notes, Client Notes, approval notes, and generated images.

Usage records. Counts and cost estimates for AI calls, export events, and similar operational logs. We use these to enforce plan allowances and control our own costs.

Support and feedback. Anything you send us, including in-app feedback submissions.

If you ask us to remind you. Our public pages offer a box where you can leave an email address to be contacted before next season. If you use it we store that address, which page you used, and the time — plus the IP address of the request, purely to stop the form being abused to send mail to people who did not ask for it. This is not a mailing list. You get one confirmation email straight away, and one reminder before the next season, written by a person. Leaving your address there adds you to no newsletter and no automated sequence, we do not add you to anything else, and we never sell or share the address. Reply to either email asking to be removed and we delete it.

If you unsubscribe. Our unsubscribe page (trytrowel.com/unsubscribe) takes an email address and keeps it, with the time, on a list of addresses we must not send sales email, tips or check-ins to. It also sends that address to our own inbox, because that is where the list is checked before anyone at Trowel sends a sales email. We store no IP address for it, and it deletes any reminder request (above) for the same address. If the address belongs to a Trowel account, it stops the tips and check-ins described in section 10. It does not stop account email: receipts, billing notices, password resets and security messages still arrive.

Payment information. When paid plans are active, Stripe processes your card and gives us a customer reference, subscription status and billing period. We never receive your full card number. Stripe's checkout page also requires your billing address. Stripe stores it with your payment details; it is not copied into Trowel's own database, and we look at it in our Stripe account only to know where our customers are, because sales-tax rules depend on where a customer is.

Technical data. Standard server and security logs from our hosting provider, including IP address and browser type.

When you run an AI review or generate a preview image, we send our AI provider the design specification — pot type, shape and size, season, the plants and their positions — together with your AI Design Notes, because those notes exist to steer the result.

AI design generation sends more, and you should know what. When you ask the AI to build a design for you, our software first searches your whole plant library and picks up to 120 plants that best match the pot, season, sun, style and your requests. We send that list (for each plant: name, category, colors, sun and water needs, bloom season, growth habit and height, and never your plant notes) so the AI picks plants you actually stock rather than ones you cannot get. We also send this design’s AI Design Notes (all but the “AI arrangement:” line described next, which is the AI’s own earlier answer) and the Special Requests box verbatim, because those are the instructions. What you type in Special Requests is also written into this design’s AI Design Notes, on the line that begins “AI arrangement:” (shortened, or left out, when the notes are nearly full). From then on it goes with this design’s AI reviews, as the rest of its AI Design Notes does, and with its preview images once the design is saved; it stays in the notes when you save, is copied into any design you duplicate from this one, and prints wherever AI Design Notes print, until you edit or remove that line. Treat that box the way you treat AI Design Notes: it goes to the AI, so keep client-identifying detail out of it and in Client Notes.

AI Fill on the Plants page sends only the plant name you type, so the AI can suggest that plant’s attributes.

Our seasonal emails are drafted by AI, without your data. For each of our seasonal emails, at most 6 a year, we ask our AI provider to draft one email for every customer at once, from instructions we write. Nothing about you, your organization, your clients or your designs is sent to it. Our software then adds your name and your organization’s name and, where they apply, a few plant names from your own plant list and how many designs you approved for that season, and leaves out any sentence it has nothing true to fill in. Every draft is checked by our software against fixed rules before it can be used, and an AI draft reaches a customer only after it has been sent to us first.

Location is used inside our own systems to tell an in-ground bed from a container, which changes how a design is drawn and reviewed, and an indoor or covered spot from an open-air one, which changes only the background and lighting asked for in a preview image. The words you type in Location are never included in what we send the AI provider: an indoor or covered spot is sent as one of two fixed descriptions we wrote. The Indoor Planter, Living Wall and Moss Wall pot types also change how a preview is drawn and how a design is reviewed, using fixed descriptions we wrote, and a Moss Wall is not sent for review.

Requests go to the Google Gemini API under its terms for paid API customers. We do not use your content to train any model, and we do not permit our providers to use it to train theirs.

To provide the service; to authenticate you; to enforce plan limits and bill correctly; to send transactional email you would expect (invites, password resets, approval notifications, usage warnings, and billing notices such as receipts, a declined card, a cancellation, a plan ending, or your account being deactivated or deleted); to keep the platform secure and debug problems; and to meet legal obligations. Our payment processor, Stripe, may also email you a reminder shortly before a subscription renews.

If you are an administrator of a Trowel account, we also use your name, your organization’s name, plan and billing dates (such as when a free trial ends or a first payment went through), what your organization has set up in Trowel (for example, whether it has made a design or added a logo, the plants it placed most often in a season’s approved designs, or how many designs it approved for a season), and when people in it last used the app, to choose which tips and check-ins to send you and what they say (section 10).

Separately, if you asked us to remind you before next season (section 3), we process that address for exactly that: to send you the one confirmation, and to contact you once when the season comes round. Nothing else.

If you unsubscribed (section 3), we keep that address for one purpose only: to make sure we never send it a sales email, a tip or a check-in again. We never use it to contact you.

Where the GDPR applies, our bases are performance of a contract (running the service), legitimate interests (security, abuse prevention, understanding product usage, and the tips and check-ins we send account administrators), and legal obligation. A reminder request is processed on your consent, given by submitting that form, and you can withdraw it at any time by replying to either email or writing to us. For customers’ personal data that you enter, you are the controller and we are your processor.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

This design lets images load quickly in the app, in exports and in printed sheets. If your work requires that previews be unreachable after deletion, tell us at hello@trytrowel.com before relying on the feature.

We keep the list short on purpose. Each provider only receives what it needs to do its job.

Data is stored and processed in the United States. If you use Trowel from outside the US, you are transferring your information there.

We may also disclose information if legally required, or as part of a merger or acquisition — in which case we would notify you before your data became subject to a different policy.

We use cookies only to keep you signed in and to keep the session secure. Your browser also stores small preferences locally, such as which tips and announcements are finished for you.

We do not use advertising, analytics or third-party tracking cookies, which is why the site has no cookie consent banner. Blocking essential cookies will prevent sign-in from working.

We do count visits to our public pages. We use Vercel Web Analytics on the marketing pages, the sign-in and sign-up pages, and the demo page. It sets no cookies, stores nothing on your device, and is served from our own domain rather than a third party’s.

Each page view records: the time, the page address and its route pattern, the referring site, filtered query parameters, your approximate location from your IP address (country, region and city), your device type, and your browser and operating system version. Your IP address itself is not stored. Repeat views within a day are grouped using a hash derived from the incoming request, and that grouping is discarded after 24 hours, so it cannot follow you from one day to the next or to any other website. We may also record named events such as “opened the demo” — these carry the name of the action, the page and the referring site only, never your email address or anything you typed.

Account and design data is kept while your account is open.

Deleted designs are retained, not erased. Deleting a design marks it as deleted and removes it from your lists and exports while preserving it for audit and recovery. Use account deletion (below) to remove content permanently.

Two consequences worth stating plainly, because neither is obvious. A deleted design still exists on our systems until the account is deleted — so if you delete a design to remove a client’s information, it has been hidden rather than erased. And because the export covers what is live, deleted designs are not included in it. If you need a copy of one, or need it genuinely erased before you close the account, email hello@trytrowel.com and we will do it by hand.

Usage, billing and security logs are kept as long as needed for operations, accounting and legal requirements.

A record of which tips and check-ins we sent, to whom and when, is kept with the account and erased with it.

Reminder requests are kept until you ask us to stop, or for two years. If you left your address on one of our public pages to be contacted before next season (section 3), we keep it until you tell us to remove it, or for two years from the day you left it — whichever comes first — because an address left more than two seasons ago is no longer a request anyone remembers making. Reply to any email we send you asking to be removed, or write to hello@trytrowel.com, and we delete the record outright rather than marking it hidden. It has no connection to any Trowel account, so deleting it does not affect one and deleting an account does not remove it.

Unsubscribe requests are kept for good. The only way to keep a promise not to email you is to remember the address, so a request made on our unsubscribe page (section 3) has no expiry. It is not tied to any Trowel account, so it is not one of the account records described below, and deleting an account does not remove it. It is also kept in the notice emails in our own inbox (section 3). If you would rather we deleted it, write to hello@trytrowel.com: we will delete it from our database and delete the emails in our inbox that name you (first recording again anyone else such an email lists, so their requests still hold), but we would then have no record that you asked not to be emailed.

Four things survive account deletion, by design.

The trial hash. When a free trial starts we store a one-way cryptographic hash of your email address — never the address itself — so that the same person cannot delete an account and immediately claim another free trial. The hash cannot be turned back into an address, cannot be used to contact you, and is never shared; it can only confirm whether an address someone already holds has had a trial. It is the sole reason a returning visitor may be offered a subscription without a further trial period.

The billing record at our payment processor. If you ever chose a plan with us, including to start a free trial, or paid for anything at checkout, Stripe holds a customer record. The first time you choose a plan it is created with your email address and your organization name, before you enter a card and whether or not you are ever charged. Once you complete a checkout, including one that only starts a free trial and takes no payment, it also holds the card details and the billing address you gave at checkout, any subscription, and your payments, invoices, credit notes and refunds (a refund we issue automatically, when you close your account or when a payment went through after you had canceled, carries your organization’s Trowel ID, so it can be matched to the account). We do not delete it when you delete your account. Where you paid us, tax and accounting law require the record of a completed sale to be kept. Where you were never charged, it is kept all the same; section 10 says how to ask us about it. It is held by Stripe under its own retention policy and is not used to contact you or to build a profile. Everything Trowel itself holds is erased as described above.

The notice emails in our own inbox. When an account is created, Trowel emails our own inbox the name, organization name and email address it was created with, and when a plan or free trial starts at checkout it emails us the organization name, the email address given at checkout, the plan, and when any trial ends. When a plan is canceled, or an account is deactivated or deleted, it emails us the organization name, the plan, and when the plan ends or the account closed. That is how we know a new customer has arrived or a customer has left, and how we make sure our sales emails never go to someone who is already a customer. Deleting the account does not remove those emails. If you would rather we deleted them, write to hello@trytrowel.com and we will, but we would then have no record that tells us not to send you a sales email.

Emails you send us. A reply to one of our emails (a tip or check-in included), or anything else you email us, stays in our own mailbox, and deleting the account does not remove it. If you would rather we deleted those emails, write to hello@trytrowel.com and we will.

Everything else associated with a deleted account is erased from Trowel, including the two records that are not attached to your organization and would otherwise be missed: any feedback or support messages you sent us through the app, and the email address recorded when the account was created. One narrow exception: the signup attempt itself leaves a row holding the IP address it came from and the time, and we keep that row — with your email address removed from it — because it is what stops one person opening accounts in bulk. It is not linked to you by name or address after deletion, but an IP address is not nothing, so we would rather say it than call the record anonymous.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, to data portability, and not to be discriminated against for exercising them. You have these controls directly in the product:

• Access and portability — export your designs, plant data and every AI preview image at any time from the Exports screen, on every plan. Designs you have deleted are not in the export; see section 9 for how to get those.
• Correction — edit your design and plant data directly in the app. Your own name and email address are not editable in the app today: ask an administrator of your organization, or email us, and we will change them.
• Deactivate account (Settings → Danger Zone) — hides the organization and locks everyone out of it, and can be undone. Your data is preserved and an administrator can restore it. A subscription is canceled, not paused: you choose a plan again when you return.
• Delete account permanently (Settings → Danger Zone) — erases the organization, every design in it, and every member’s login. This is an administrator action and it deletes the whole organization, not one person. If you want only your own access removed, ask an administrator to deactivate you instead. It cannot be undone. See section 9 for what is retained afterwards, such as the hashed value that prevents repeat free trials and the billing record at our payment processor.

You can also email hello@trytrowel.com and we will respond within the time the applicable law requires. We may need to verify your identity first. If you are a member of an organization, some requests must be made through its administrator, who controls that account.

Transactional email is required to operate the account and cannot be switched off while it is open.

Tips and check-ins. If you are an administrator of a Trowel account, we also email you a few tips and check-ins, sent in the name of Mark Daneshvar, who runs Trowel (replies reach him). They are a welcome when you sign up; up to 2 more in your first days, while you choose a plan and during a free trial; a note when your first payment goes through; an occasional feature tip; a seasonal note, at most 6 a year, drafted with the help of AI (see “How AI requests are handled” above); and a note each time nobody in your organization has opened Trowel for 30 days. Most depend on what your organization has or has not done, so you may well get fewer. Apart from those first days and the note when your first payment goes through, we send at most one every 14 days. Members who are not administrators never receive them, and neither do demo accounts. Every one links to our unsubscribe page; entering your address there stops them for that address. Receipts, billing notices, password resets and security messages are account email and still arrive.

Apart from the seasonal notes above, which go only to the administrators of a Trowel account, we have no newsletter. To businesses that are not our customers, what we send is a short introduction, written to a business at the general address it publishes on its own website (such as info@), with at most one follow-up. If you reply no, we stop: you will not hear from us again, and we do not send a reply about it. A request on our unsubscribe page stops them too, normally within minutes of reaching us. To stop them, reply to one, or use trytrowel.com/unsubscribe.

Data is encrypted in transit. Every database query is scoped to your organization and enforced at the database layer, so one organization cannot read another’s data. Access to production systems is limited to those who need it, and AI keys and other secrets are held server-side only and never exposed to the browser.

No system is perfectly secure. If we discover a breach affecting your personal information we will notify you and any regulator as the law requires.

Trowel is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We will post updates here and change the effective date. For material changes we will give notice by email or in the app.

Privacy questions, or to exercise any right above: hello@trytrowel.com.

See also our Terms of Service.