Privacy Policy

1. Who is responsible for your data

MyGrowthStories is an independently operated plant collection and journaling service based in Sweden.

The service is operated by Oskar Myllergård, who is the data controller for personal data processed through MyGrowthStories.

For privacy questions or requests, contact:

2. Information collected

MyGrowthStories collects and processes information needed to provide, maintain, secure, and improve the service.

Account information

When you create and use an account, the service stores:

• Your chosen username
• Your email address
• Your password in securely hashed form
• The date your account was created
• Your email-verification status
• Your account and public-profile settings

An email address is required when you create an account. It is used to verify your account, help protect access to the service, support password resets, and send essential account-related messages.

Temporary verification and password-reset tokens may also be generated and stored in hashed form together with an expiry time so that these account-security features can operate.

Collection content

The service stores the information you choose to add to your plant collection. This may include:

• Plant names and collection identifiers
• Notes, dates, measurements, and tags
• Provenance, locality, acquisition, and propagation information
• Uploaded photographs
• Lineage and relationships between plant records

Plant records are not normally personal data by themselves. However, photographs, notes, or other content may contain personal information if you choose to include it.

Technical information

When you access MyGrowthStories, the server automatically records limited technical information, including:

• Your IP address
• The date and time of the request
• The requested page or resource
• Browser and device information
• Referring-page information, when provided
• Response status and related technical information

This information is used to operate the website, investigate technical problems, prevent misuse, and protect the service and its users.

Information you send by email

If you contact MyGrowthStories by email, the service may process your email address, username, message, and any other information you choose to provide.

Never send your password by email.

3. How information is used

Information is processed for the following purposes:

• Creating and managing your account
• Verifying your email address and account
• Providing password resets and essential account-security messages
• Saving and displaying your plant collection
• Providing collection exports and account-management tools
• Displaying profiles and plant stories that you choose to make public
• Maintaining the security, reliability, and availability of the service
• Diagnosing errors and technical problems
• Responding to support, privacy, and general enquiries
• Improving the operation and usability of the service

MyGrowthStories does not sell your personal data.

Your account information and collection content are not used for third-party advertising.

4. Legal bases for processing

Providing the service

Account information, including your email address, and collection content are processed because this is necessary to provide the service you request when you create and use an account. This includes verifying accounts, securing access, and providing password-reset functionality.

Legitimate interests

Technical information, security logs, and limited service-usage information may be processed where necessary for the legitimate interests of operating, securing, troubleshooting, and improving MyGrowthStories.

Legal obligations

Information may be processed or retained when necessary to comply with applicable law, enforce legal rights, or respond to a valid legal request.

Your choices

You control whether your collector profile and individual plant stories are made public.

Public-profile and public-story settings can be changed through the service.

5. Cookies and authentication

MyGrowthStories uses essential cookies or session identifiers to keep you signed in, protect your account, and provide access to authenticated parts of the service.

These technologies are necessary for the service to function and are not used for advertising or tracking.

MyGrowthStories does not currently use analytics, advertising trackers, or non-essential tracking cookies.

6. Public profiles and shared stories

Your account and collection are private unless you choose to make parts of them public.

If you enable a public collector profile, your username and information from your public collection may be visible to anyone who visits the profile. Your account email address is not displayed as part of your public collector profile unless you separately choose to include it in public content.

If you make a plant story public, its photographs, notes, measurements, provenance, locality, and other included information may be visible through its public page.

Public information may be copied, saved, screenshotted, indexed, or shared by other people outside the control of MyGrowthStories.

Do not include private, sensitive, or identifying information in content you choose to publish publicly.

You can make a plant story private again or disable your public profile through the service. Copies previously made by other people or services may remain available elsewhere.

7. Hosting and service providers

MyGrowthStories is hosted on infrastructure provided by IONOS SE in Germany, within the European Economic Area.

The hosting provider may process account data, collection content, uploaded files, and technical logs as necessary to host and operate the service.

Email delivery is provided through Purelymail. Purelymail may process email addresses and message-delivery information when MyGrowthStories sends account verification, password-reset, security, or support emails, and when you correspond with MyGrowthStories by email.

Domain, DNS, certificate, network, and similar infrastructure providers may process limited technical information where necessary to deliver and secure the website.

Service providers are not permitted to use MyGrowthStories account or collection data for their own advertising purposes.

8. International data transfers

MyGrowthStories is operated from Sweden and its application server is hosted in Germany.

Where a service provider processes personal data outside the European Economic Area, appropriate safeguards will be used where required by applicable data-protection law.

9. Server logs

MyGrowthStories uses Nginx server logs to operate, secure, and troubleshoot the service.

These logs may contain IP addresses, request times, requested pages, browser or device information, referring-page information, response codes, and related technical information.

Server logs are rotated daily and are normally retained for approximately 14 days before being deleted through the normal log-rotation process.

10. Backups

MyGrowthStories creates an automated backup each day.

These backups include the service database and uploaded files.

The three most recent automated backup sets are retained. Deleted information may therefore remain temporarily in a backup until the backup is replaced through the normal daily backup cycle.

Backups are used for security, recovery, and protection against accidental data loss. They are not used as active copies of deleted accounts.

11. Data retention

Account information, including your email address, and collection content are generally retained for as long as your account remains active.

Temporary verification and password-reset information is kept only for as long as needed for the relevant verification or reset process and according to its configured expiry time.

Support correspondence may be retained for as long as reasonably necessary to respond to the enquiry, maintain support records, resolve disputes, or meet legal obligations.

Server logs are normally retained for approximately 14 days.

The three most recent daily automated backup sets are retained.

Information may be retained for longer where required by law, necessary to establish or defend a legal claim, or required to investigate fraud, abuse, or a security incident.

12. Exporting your collection

You can download an export of your collection through Account settings.

The export may include your plant records, entries, measurements, notes, tags, provenance information, and other collection data stored by the service.

13. Deleting your account

You can permanently delete your account through Account settings.

Account deletion removes your account information, including your email address, associated collection records, and uploaded files from the active service.

Deleted information may remain temporarily in the three most recent automated backups until those backups are replaced through the normal daily backup cycle.

Public copies previously saved, copied, or shared by other people may remain outside the control of MyGrowthStories.

For assistance with an account or deletion request, contact contact@mygrowthstories.com and include your username. Never send your password by email.

14. Your data-protection rights

Depending on the circumstances and applicable law, you may have the right to:

• Request information about how your personal data is processed
• Request access to your personal data
• Ask for inaccurate personal data to be corrected
• Request deletion of your personal data
• Request that certain processing be restricted
• Object to processing based on legitimate interests
• Receive certain information in a portable format
• Withdraw consent where processing is based on consent

These rights are not absolute and may depend on the circumstances and legal basis for the processing.

To make a privacy request, contact contact@mygrowthstories.com and include your MyGrowthStories username.

Where there are reasonable doubts about your identity, additional information may be requested to confirm that the request relates to your account.

15. Complaints

Please contact MyGrowthStories first if you have a question or concern about how your personal data is handled.

You also have the right to submit a complaint to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or another competent data-protection authority.

16. Security

Reasonable technical and organisational measures are used to protect account information and collection content against unauthorised access, alteration, loss, or disclosure.

Passwords are stored in hashed form rather than as readable plain-text passwords. Verification and password-reset tokens are also stored in hashed form.

No online service can guarantee absolute security. You are responsible for choosing a strong, unique password and keeping it confidential.

17. Children

MyGrowthStories is not specifically directed at children.

Contact contact@mygrowthstories.com if you believe a child has provided personal information through the service inappropriately.

18. Changes to this policy

This Privacy Policy may be updated when the service, its providers, its data-processing practices, or applicable legal requirements change.

The date at the top of this page will be updated when changes are published.

Material changes may also be communicated through the website or within the service where appropriate.

19. Contact

For privacy questions, data requests, or concerns about this policy, contact: