Privacy Policy

It covers trytrowel.com and the Trowel application. Most people using Trowel do so through an organization created by their employer. In that case the organization controls the account and its data, and its administrators can see and manage the designs and members within it. Direct questions about an employer’s data practices to that employer.

Account information. Name, email address, and a password. Passwords you choose are hashed by our authentication provider and we never see them. There is one exception: when an administrator invites you or resets your access, we generate a temporary password and email it to you so you can sign in. Change it once you are in — it is the only password of yours that ever exists in readable form, and only in that one message. We also record your role, permissions, and when you were last active.

Organization information. Company name, plan and usage allowances, team membership, and role settings.

Design content. Everything you enter to do the work: client name, location, dates, season, pot specifications, plant placements, your plant library, AI Design Notes, Client Notes, approval notes, and generated images.

Usage records. Counts and cost estimates for AI calls, export events, and similar operational logs. We use these to enforce plan allowances and control our own costs.

Support and feedback. Anything you send us, including in-app feedback submissions.

Payment information. When paid plans are active, Stripe processes your card and gives us a customer reference, subscription status and billing period. We never receive your full card number.

Technical data. Standard server and security logs from our hosting provider, including IP address and browser type.

When you run an AI review or generate a preview image, we send our AI provider the design specification — pot shape and size, season, the plants and their positions — together with your AI Design Notes, because those notes exist to steer the result.

AI design generation sends more, and you should know what. When you ask the AI to build a design for you, we also send a list of plants from your plant library (name, category, color and sun requirement, up to 150 entries) so it recommends plants you actually stock rather than ones you cannot get — and we send the Designer requests box verbatim, because that is the instruction. Treat that box the way you treat AI Design Notes: it goes to the AI, so keep client-identifying detail out of it and in Client Notes.

Location is used inside our own systems to tell an in-ground bed from a container, which changes how a design is drawn and reviewed. It is not included in what we send the AI provider.

Requests go to the Google Gemini API under its terms for paid API customers. We do not use your content to train any model, and we do not permit our providers to use it to train theirs.

To provide the service; to authenticate you; to enforce plan limits and bill correctly; to send transactional email you would expect (invites, password resets, approval notifications, usage warnings); to keep the platform secure and debug problems; and to meet legal obligations.

Where the GDPR applies, our bases are performance of a contract (running the service), legitimate interests (security, abuse prevention, understanding product usage), and legal obligation. For customers’ personal data that you enter, you are the controller and we are your processor.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

This design lets images load quickly in the app, in exports and in printed sheets. If your work requires that previews be unreachable after deletion, tell us at hello@trytrowel.com before relying on the feature.

We keep the list short on purpose. Each provider only receives what it needs to do its job.

Data is stored and processed in the United States. If you use Trowel from outside the US, you are transferring your information there.

We may also disclose information if legally required, or as part of a merger or acquisition — in which case we would notify you before your data became subject to a different policy.

We use cookies only to keep you signed in and to keep the session secure. Your browser also stores small preferences locally, such as which onboarding tips you have dismissed.

We do not use advertising, analytics or third-party tracking cookies, which is why the site has no cookie consent banner. Blocking essential cookies will prevent sign-in from working.

Account and design data is kept while your account is open.

Deleted designs are retained, not erased. Deleting a design marks it as deleted and removes it from your lists and exports while preserving it for audit and recovery. Use account deletion (below) to remove content permanently.

Two consequences worth stating plainly, because neither is obvious. A deleted design still exists on our systems until the account is deleted — so if you delete a design to remove a client’s information, it has been hidden rather than erased. And because the export covers what is live, deleted designs are not included in it. If you need a copy of one, or need it genuinely erased before you close the account, email hello@trytrowel.com and we will do it by hand.

Usage, billing and security logs are kept as long as needed for operations, accounting and legal requirements.

One thing survives account deletion, by design. When a free trial starts we store a one-way cryptographic hash of your email address — never the address itself — so that the same person cannot delete an account and immediately claim another free trial. The hash cannot be turned back into an address, cannot be used to contact you, and is never shared; it can only confirm whether an address someone already holds has had a trial. It is the sole reason a returning visitor may be offered a subscription without a further trial period.

Everything else associated with a deleted account is erased, including the two records that are not attached to your organization and would otherwise be missed: any feedback or support messages you sent us, and the email address recorded when the account was created. One narrow exception: the signup attempt itself leaves a row holding the IP address it came from and the time, and we keep that row — with your email address removed from it — because it is what stops one person opening accounts in bulk. It is not linked to you by name or address after deletion, but an IP address is not nothing, so we would rather say it than call the record anonymous.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, to data portability, and not to be discriminated against for exercising them. You have these controls directly in the product:

• Access and portability — export your designs, plant data and every AI preview image at any time from the Exports screen, on every plan. Designs you have deleted are not in the export; see section 9 for how to get those.
• Correction — edit your design and plant data directly in the app. Your own name and email address are not editable in the app today: ask an administrator of your organization, or email us, and we will change them.
• Deactivate account (Settings → Danger Zone) — a reversible pause. Your data is preserved and an administrator can restore it.
• Delete account permanently (Settings → Danger Zone) — erases the organization, every design in it, and every member’s login. This is an administrator action and it deletes the whole organization, not one person. If you want only your own access removed, ask an administrator to deactivate you instead. It cannot be undone. See section 9 for the single hashed value retained afterwards to prevent repeat free trials.

You can also email hello@trytrowel.com and we will respond within the time the applicable law requires. We may need to verify your identity first. If you are a member of an organization, some requests must be made through its administrator, who controls that account.

Transactional email is required to operate the account and cannot be switched off while it is open. We do not send marketing email without consent.

Data is encrypted in transit. Every database query is scoped to your organization and enforced at the database layer, so one organization cannot read another’s data. Access to production systems is limited to those who need it, and AI keys and other secrets are held server-side only and never exposed to the browser.

No system is perfectly secure. If we discover a breach affecting your personal information we will notify you and any regulator as the law requires.

Trowel is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We will post updates here and change the effective date. For material changes we will give notice by email or in the app.

Privacy questions, or to exercise any right above: hello@trytrowel.com.

See also our Terms of Service.