Privacy Policy

1. Introduction

Hortus ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use our platform for mapping native plant gardens and building pollinator corridors.

Hortus operates in both Canada and the United States. This policy covers users in both countries and outlines applicable rights under Canadian federal privacy law (PIPEDA) and applicable provincial legislation.

By using Hortus, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Username, email address, password
• Location Data: Property address, latitude/longitude coordinates (for mapping your garden)
• Garden Data: Plants you have added (species, quantities, planting dates)
• Messages: Communications you send to other users through our platform
• Profile Information: Optional bio, sharing preferences

2.2 Information We Collect Automatically

• Usage Data: How you interact with the platform (pages visited, features used)
• Device Information: Browser type, IP address, operating system
• Cookies: We use cookies for authentication and analytics

3. How We Use Your Information

• Provide and improve the Hortus platform
• Display your garden on the community map
• Generate community analytics (bloom coverage, species diversity, pollinator corridors)
• Enable you to message other users
• Send important updates about your account or the service
• Conduct research on urban biodiversity (anonymized data only)
• Provide aggregated data to conservation authorities and research institutions

4. How We Share Your Information

4.1 Public Information

The following information is visible to other Hortus users:

• Your username
• Your property location (approximate, shown on map)
• Plants you have added to your garden
• Your profile information (if you choose to add it)

4.2 Aggregated & Anonymized Data

We may share aggregated, anonymized data with:

• Research institutions studying urban biodiversity
• Conservation authorities tracking native plant adoption
• Municipal governments measuring environmental program impact

This data does NOT include your name, email, exact address, or any personally identifiable information. Example: "567 native plants were added in your region in January 2026" (NOT "John Smith planted 10 milkweeds").

4.3 We Do NOT Sell Your Data

We will never sell your personal information to third parties. Period.

5. Data Security

We use industry-standard security measures to protect your information:

• Encrypted connections (HTTPS/SSL)
• Secure password hashing
• Row-level security on database
• Regular security audits

Our infrastructure is hosted on Supabase and Vercel, which serve users in both Canada and the United States. Data may be processed in either country depending on server availability.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights & Choices

All Hortus users have the following rights, regardless of location:

• Access: You can view and edit your profile and garden data anytime
• Delete: You can delete your account and all associated data from Settings
• Export: You can download all your data as JSON from Settings
• Opt-out: You can opt out of non-essential emails
• Visibility: You can control who sees your garden (public/private) from Settings

All of these actions are self-service from your Settings page. For additional requests, email us at hello@joinhortus.ca

7. Your Rights Under Canadian Law

The Personal Information Protection and Electronic Documents Act (PIPEDA) gives Canadian residents the right to:

• Know what personal information we hold about you and why
• Access your personal information on request
• Challenge the accuracy and completeness of your information and have it amended
• Withdraw consent for the collection, use, or disclosure of your information (subject to legal or contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated

We only collect personal information for the purposes identified in this policy and with your knowledge and consent. You can withdraw consent at any time by deleting your account or contacting us.

8. Rights for US Users

Several US states have enacted comprehensive privacy laws. If you are a resident of one of these states, you may have additional rights.

California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act and the California Privacy Rights Act give you the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale or sharing of your personal information (we do not sell or share your data)
• Non-discrimination for exercising your privacy rights
• Correct inaccurate personal information
• Limit the use of sensitive personal information (we only use it for the purposes described in this policy)

To exercise any of these rights, email hello@joinhortus.ca or use the self-service options in Settings. We will respond to verifiable requests within 45 days.

Virginia, Colorado, Connecticut, and Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy laws have similar rights to access, delete, and correct personal information, as well as the right to opt out of targeted advertising. We do not engage in targeted advertising or profiling. You can exercise your rights by contacting us or using your Settings page.

9. Ecological Data Sources

Hortus references public ecological databases to provide plant and wildlife information. These sources do not receive your personal data. We use:

• VASCAN (Vascular Plants of Canada) for native plant data
• GloBI (Global Biotic Interactions) for wildlife-plant relationships
• iNaturalist for species observation data and photos

All ecological data is used solely to provide accurate plant recommendations and wildlife information within the Hortus platform.

10. Children's Privacy

Hortus is not intended for users under 13. We do not knowingly collect information from children. If you believe we have collected information from a child under 13, please contact us immediately.

11. Cookies & Tracking

We use cookies for:

• Keeping you logged in (Supabase authentication)
• Understanding how you use the platform (PostHog analytics, anonymous until you log in)
• Improving your experience (Vercel Analytics, aggregated, no personal data)
• Remembering your country preference (CA/US toggle)

You can disable cookies in your browser settings, but this may limit functionality.

12. Third-Party Services

We use the following third-party services:

• Supabase: Database and authentication, with infrastructure serving both Canada and the United States (see their privacy policy)
• Vercel: Hosting (see their privacy policy)
• OpenStreetMap: Map data (see their privacy policy)
• PostHog: Product analytics. We track page visits and key actions (e.g. signing up, adding a plant) to understand how people use Hortus and improve the experience. Person profiles are only created for logged-in users. PostHog data is hosted in the US. (See their privacy policy)

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the platform. Continued use of Hortus after changes constitutes acceptance of the updated policy.

14. Contact Us

Questions about this Privacy Policy? Contact us:

• Email: hello@joinhortus.ca
• Website: joinhortus.com