Privacy policy · Bladwijzer garden guide

In short: we keep what is needed to make Bladwijzer work, we show no ads, we sell nothing and you can export or delete everything. The details are below.

1. Who is responsible?

Bladwijzer is operated by Jani Van Quaethem, Aalter. For questions about your data: [email protected].

2. What data, for what purpose and on what legal basis?

Information	Purpose	Legal basis
Username, name, password (only as an encrypted hash), email address if you provide it, the secret key for two-step verification if you turn it on (encrypted), and for a passkey only the public key (your fingerprint or face never leaves your device)	Your account, logging in, security, notifications and a new password if you forget it	Contract
Logging in with Google or Apple: which service, the fixed code the service gives your account, the email address the service passed on, when you linked it and when you last logged in that way	Letting you log in or create an account with Google or Apple, if you choose to	Contract
Observations: species, date, place, notes and photos	Your guide, the map and the booklet	Contract
Scans: the suggested species, the confidence, a small version of the photo and your location if you share it with the app	Seeing how recognition works and is used, tracking down errors and improving the site	Legitimate interest
Gardens: plot boundaries, the location and details of your plants, prunings, who you invite and with which role	Your garden, the pruning schedule and working together	Contract
Tree surgeons: company details, service area, services and certificates	The list of tree surgeons	Contract
Jobs: the request, messages, attachments, the work order and the report	Following up a request to a tree surgeon	Contract
A professional’s team: who they invite (email address) and with which role, which jobs someone is assigned to and who worked how many hours	Sharing out work within a team and keeping track of hours per person	Contract
Your recipe book: recipes you save, write or import from a website, with the link to the original	Your recipe book and the harvest times in your calendar	Contract
Shared recipes: a recipe you share, with your name and your photos (for everyone, including on a page with all your shared recipes), your comments and photos on other people’s recipes (for everyone, with your name) and your stars (only in the average)	Sharing, rating and discussing recipes with other gardeners	Contract
Hire: the equipment you put online (with photos and a location rounded to about a kilometre), bookings, messages and reviews	Hiring, hiring out and lending equipment	Contract
Questions to the neighbours: your question with photos and a place rounded to about a kilometre, and your answers	Asking and answering questions nearby	Contract
Open gardens: your open garden (description, photos, accessibility, the approximate location and the position rounded to about a kilometre, the address or meeting point and the exact position), the days and time slots, who signed up (how many and a note), garden trails and reports	Organising and visiting open garden days and garden trails	Contract
Moderation: who you blocked, and a suspension by the administrator (reason, end date, who suspended and when)	Preventing abuse and spam in the Nearby section	Legitimate interest
Businesses without a profile: name, address, phone, email and website, as published on their own website or in OpenStreetMap	Suggesting a tree surgeon or landscape gardener nearby	Legitimate interest
Email preferences and emails sent (to whom, subject, when, successful or not)	Sending emails and showing that you gave consent or unsubscribed	Contract, consent (newsletter)
Neighbourhood email: whether you want it and since when, the place it’s centred on (rounded to about a kilometre), the distance, the sections and when the last one went out	Emailing you every week with what’s new near you	Consent (neighbourhood email)
Garden Report: whether you gave consent, and when you gave or withdrew it	Counting your garden data anonymously in the annual Bladwijzer Garden Report, only in totals by region	Consent (Garden Report)
Sharing suggestions: whether Bladwijzer may suggest sharing, and for each suggestion the moment, the text, what you did (shared, later or nothing) and the context in broad groups (time of day, weekday or weekend, phone or computer, app or browser, push notifications on or off), kept for 13 months	Now and then suggesting that you share a new species, a milestone or a badge, at a moment and with a text that works, without overwhelming you; you can turn it off under Account › Privacy	Legitimate interest
Technical data: when you were last active, error reports (without email addresses, tokens or IP addresses), your IP address for a short time to prevent abuse	Security, usage figures and fixing errors	Legitimate interest

You only receive the newsletter if you sign up for it. Tips and reminders about your own garden (such as the monthly pruning reminder) are on by default; you can turn them off with one click. At the bottom of every email there is a link to your email preferences, and you can always change them in Account.

You only get the weekly neighbourhood email if you turn it on yourself in Account, separately from the newsletter. It shows what others have already made visible nearby (listings, activities, work days in discoverable community gardens, open gardens, equipment and questions), never your own items, and it doesn’t give anyone your location or email address.

You only get the monthly Garden jobs this month email if you turn it on yourself when signing up or in Account (off by default, separate from the newsletter). It’s the same for everyone, in your language, and uses no data from your gardens; we store when you turned it on and when the last one was sent.

For the annual Bladwijzer Garden Report, your garden data only counts if you switch this on yourself under Account (off by default, separate from the newsletter). The species and form of your plants, your vegetables, your rain barrel and compost bin, the nature score, the species you identified, your challenges, open garden days and work days then count towards totals by region (Flanders, Brussels, Wallonia or the Netherlands). Never your name, email address, address, where your garden is, photos or notes, and never a single garden on its own: a figure is only shown when it covers at least 10 gardens from 10 different gardeners. You can withdraw your consent at any time; you are then no longer counted in new reports. A report that has already been published contains only totals and stays online.

If your visit comes from an AI assistant (ChatGPT, Perplexity, Claude, Copilot or Gemini), it only counts towards a daily total per assistant. That shows us how people find Bladwijzer. We keep no IP address, no cookie and nothing about who you are or which pages you view.

3. Who sees your data?

You, and whoever you give access yourself: people you share a garden with, the tree surgeon you send a request to, or anyone with the link if you share your guide. A shared guide never shows your GPS coordinates.
Tree surgeons appear in the list with the details they enter themselves, visible to logged-in users.
A team member of a professional sees the jobs assigned to them (a planner sees all of the team’s jobs): the client’s name, the garden and where it is, the description, the plants, the attachments and the messages, never prices, quotes or invoices. The client sees the first name and the initial of the surname of whoever does the job.
Businesses without a profile appear in that list with their public details (from their own website or from OpenStreetMap), for logged-in users. A business can always ask to be hidden or removed, via the contact form.
Equipment you put online: logged-in users see it with your name, the location (rounded to about a kilometre) and your reviews as a lender. Only you and the other party see the messages and the details of a booking.
A question or answer you write is visible to logged-in users, with your name and, for a question, the place (rounded to about a kilometre) and the photos. A resolved question also appears on the species’ profile.
An open garden is visible to everyone, even without an account, with your name, the photos, an approximate location you choose yourself and the position rounded to about a kilometre. Only people who signed up for a day can see the address or meeting point and the exact position. Only the owner sees who is coming (name, number and note).
The administrator of Bladwijzer can view users, observations, scans and gardens (for a garden: its location, outline, owner and how many plants it holds, not the plants themselves), only to manage the site, fix errors and stop abuse.
The people you block are visible only to you, in your account; someone you block isn’t notified. The administrator sees how often someone was blocked, not by whom.
A notifiable plant disease (fire blight): the administrator sees the report with the name and e-mail address of the person who reported it and of the garden owner, the garden, the plant, the location, the description and the photos, to check that it was reported to the FASFC. What you e-mail to the FASFC, you send yourself.

4. Services we use

Bladwijzer runs on Server in Duitsland - DB in Finland. We also use these services:

ObsIdentify recognition (Observation International and Naturalis, the Netherlands): the photos you have identified go directly from your device to their recognition service.
Pl@ntNet (France), if enabled: your photos go through our server, without your name or account.
Email: we send emails via Microsoft 365 or another email service, which receives your email address and the content of the email.
Maps and aerial photos are loaded by your browser from OpenStreetMap, Digitaal Vlaanderen, the Service public de Wallonie and PDOK. They see your IP address when this happens, as with any website.
Addresses and plots are looked up with OpenStreetMap Nominatim, FPS Finance (CadGIS) and PDOK. They receive the search term or the location, not who you are.
Your garden soil is looked up by our server with the Soil Map of Flanders (DOV), the Walloon government (SPW) and SoilGrids (ISRIC). They only receive the location of your garden, rounded to about 100 m, not who you are.
The weather forecast for your garden: our server asks Open-Meteo for it. Only the location of your garden is sent, rounded to about 1 km, not who you are.
The buildings around your garden (for sun and shade): our server looks them up on OpenStreetMap (Overpass). Again, only the location of your garden is sent, rounded to about 100 m, not who you are. Your phone’s compass is only read in your browser.
Species information and photos come from waarnemingen.be and Wikimedia Commons; your browser loads the photos directly.
Error reports may be sent as notifications to GitHub (where Bladwijzer’s source code is kept) and Microsoft Teams, after email addresses, tokens and IP addresses have been removed.
Log in with Google or Apple, only if you choose to log in that way yourself. You then log in with Google (Google Ireland Limited) or Apple (Apple Distribution International), who pass on your name, your email address and a fixed code for your account. In doing so, they see that you use Bladwijzer. You can remove the link at any time in Account.
Buy Me a Coffee, only if you choose to give via Buy Me a Coffee yourself.
Google Analytics, only if you allow it in the bar at the bottom or on the Cookies page: which pages you visit, for how long, your type of device and browser, and roughly where you are (country, region). Google (Google Ireland Limited) sets cookies for this and may also process data in the United States, with the safeguards of the EU-US Data Privacy Framework. Secret codes in an address are removed. You can change your choice at any time.

We do not sell data and do not use advertising or tracking services. Data does not leave the European Economic Area, except where a service listed above does so with the safeguards required by the GDPR (such as the European Commission’s standard contractual clauses).

5. How long do we keep it?

Your account, guide, gardens and requests: until you delete them yourself or delete your account.
Photos you don’t save: deleted after 24 hours. Of a scan you don’t save as an observation, only the small version of the photo remains after 24 hours.
Login sessions: 60 days. Links for a new password: one hour (or 24 hours if the administrator creates one). Login links by email: 15 minutes.
Notifications and the log of sent emails: 180 days. Error reports: 90 days.
An invitation that nobody accepts: 90 days after the expiry date.
Who you blocked: until you unblock them. A suspension: as long as your account exists, even after it has ended, so the administrator can see repeated abuse.
If you delete your account, your scans remain only anonymously for statistics: without name or photos, with a location rounded to about a kilometre.
Your consent for the Garden Report, with when you gave or withdrew it: as long as your account exists. A published Garden Report contains only totals and stays online.

6. Your rights

You may access your data, have it corrected or erased, have its processing restricted, object to processing and take your data with you. Much of this you can do yourself: in Account you can export your guide (JSON), change your email preferences and delete your account with all its data. For anything else, email [email protected]; we reply within one month. If you gave consent (such as for the newsletter), you can withdraw it at any time.

If you are not satisfied, you can lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels) or, in the Netherlands, with the Autoriteit Persoonsgegevens.

7. Security

We store passwords only as a hash (scrypt). Connections are encrypted (HTTPS), keys and passwords for integrations are stored encrypted in the database, and you can turn on two-step verification. Logging in and password resets are rate-limited to prevent guessing. Should a data breach that poses a risk to you nevertheless occur, we will report it to the supervisory authority and to you.

8. Children

You can create an account from the age of 13. If you are younger, ask your parents to create an account with you.

9. Changes

If anything important changes in this policy, we will say so on the site and, if you have an email address, by email.