Privacy Policy

The protection of your personal data is important to us. We process personal data only within the framework of applicable law — in particular the Swiss Federal Act on Data Protection (revFADP) and the EU General Data Protection Regulation (GDPR) for users in the EU.

This privacy policy explains what data we collect, how we use it, and what rights you have.

3.1 Newsletter signup

When you sign up for the newsletter, we collect:

• Email address — to send you the monthly newsletter
• Timestamp of signup
• IP address — temporarily for rate limiting (not permanently stored)

Signup uses double opt-in: you receive a confirmation email and are only added to the newsletter list after clicking the confirmation link.

3.2 Server logs

Each request to our website automatically captures:

• IP address (anonymized)
• Date and time
• Page visited
• HTTP status code
• Browser and operating system

These data are used exclusively for technical and security purposes and are deleted after 7 days.

3.3 Analytics

We measure website usage with OpenPanel (server: api.openpanel.dev). Your browser sends page views and anonymous events, for example completing a planner step or clicking a partner link (see "Affiliate programs"). The events contain no names and no email addresses. Our integration code sets no cookies for this. During transmission, technically required connection data such as the IP address is generated and processed by OpenPanel. In addition, we count redirects via /go/... on the server using a daily-changing, non-reversible hash of IP address and browser identifier; we do not store the IP address itself. This server-side counting is skipped when "Do Not Track" or "Global Privacy Control" is active.

3.4 Planner — optional email entry

After creating your annual plan, you may optionally provide your email address to receive a copy of your plan and later sowing and frost reminders. The address is stored in our database (table email_capture). The reminder function uses a double opt-in process: you will first receive a confirmation email; reminder emails are only sent after you click the confirmation link. We use Resend as our data processor for email delivery (see section 4.1). You may withdraw your consent at any time and request deletion of your address by emailing hallo@erntezeit.app.

3.5 Partner attribution

Via partner links (/partner/<name>) we associate a voluntary email submission with the respective partner. The partner slug is stored in the database as an attribution attribute and is not shared with third parties.

3.6 Bot protection (Cloudflare Turnstile)

The forms for bed creation, newsletter, contact, reminders and the Bed Starter are protected against automated access by Cloudflare Turnstile. Your browser loads a script from Cloudflare (challenges.cloudflare.com), and Cloudflare processes technical data such as IP address and browser characteristics to detect bots. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). More information: cloudflare.com/privacypolicy.

4.1 Resend (email delivery)

For email delivery (confirmation emails, newsletter) we use Resend (Resend Inc., USA). A Data Processing Agreement (DPA) is in place with Resend. Your email address is transmitted to Resend to enable delivery.

resend.com/legal/privacy-policy

4.2 Infomaniak (hosting)

Our website is hosted by Infomaniak Network SA, 25 Rue Eugène Marziano, 1227 Geneva, Switzerland. All data is stored exclusively in Switzerland.

infomaniak.com/de/datenschutz

4.3 Stripe (payments)

We use Stripe for payment processing. Payment data is processed directly by Stripe — we never store credit card data. A DPA is in place with Stripe.

stripe.com/ch/privacy

We process your data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): newsletter signup
• Contract performance (Art. 6(1)(b) GDPR): use of the service
• Legitimate interest (Art. 6(1)(f) GDPR): security, logs

• Newsletter emails: until unsubscribe
• Server logs: 7 days
• User data: until account deletion, max. 3 years after last activity

You have the following rights regarding your personal data:

• Access — what data we have stored about you
• Rectification — correct incorrect data
• Erasure — request deletion of your data
• Restriction — restrict processing
• Objection — object to certain processing
• Portability — receive data in a machine-readable format
• Withdrawal — withdraw consent at any time

For any request: hallo@erntezeit.app

You also have the right to lodge a complaint with the competent data protection authority:

Switzerland: Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch

EU: the competent supervisory authority in your EU member state.

Our website uses no tracking or advertising cookies. Usage measurement with OpenPanel (see section 3.3) sets no cookies in our integration. Your browser remembers that you closed the cookie notice in local storage (localStorage), not in a cookie.

The website itself sets the following cookies. None of them is a tracking or advertising cookie, and no cookies from advertising partners are set.

• NEXT_LOCALE: remembers your language setting (DE/EN/FR/IT). Duration: session, until you close the browser. Technically necessary: yes.
• better-auth.session_token (prefixed __Secure- in production): keeps you signed in, only with an account. Duration: 30 days, renewed on use. Technically necessary: yes.
• better-auth.session_data (prefixed __Secure- in production): short cache of your session data, only with an account. Duration: 60 seconds. Technically necessary: yes.
• er_anon_plan: remembers the plan you created without an account so you can find it again and later transfer it to your account. Duration: 30 days. Technically necessary: yes.
• er_merge_done and er_merge_blocked: one-time notice after signing in about whether your anonymous plan was transferred. Duration: 30 seconds. Technically necessary: yes.
• er_partner: assigns you to a partner after you open a partner link (/partner/...) (see section 3.5). Duration: 30 days. Technically necessary: no.
• er_inspired_<bed ID>: only set when you click "inspired" on a public bed; prevents the same bed from being counted several times by you. Duration: 1 year. Technically necessary: no.
• er_email_skipped: set when you skip the optional email prompt in the planner so it does not reappear. Duration: 30 days. Technically necessary: no.
• er_email_captured: set when you enter your email address in the planner so the prompt does not reappear. Duration: session. Technically necessary: no.

In addition, your browser stores a few settings in local storage (localStorage), not in cookies: the dismissed cookie notice, the planner draft, the currency chosen on the pricing page and other notice settings. This data does not leave your browser.

We apply technical and organizational measures to protect your data:

• HTTPS / TLS encryption (mandatory, as .app domains are HSTS-preloaded)
• Hashed and signed tokens (no plain-text passwords)
• Servers in Switzerland (Infomaniak Jelastic, Geneva)
• Regular backups

We reserve the right to adjust this privacy policy as technical or legal requirements change. The current version is always available on this page.

With the Bed Starter you can have your shopping list sent by email and, if you like, receive seasonal tips. This section explains what happens to your data.

Data we store

When you request a list, we store:

• email address and chosen language
• your answers in the Starter and the shopping list calculated from them (mail content)
• timestamps of the request, confirmation and sending
• proof of consent: time, consent(s) given (list, seasonal tips) and version of the consent text

Purpose

Sending you the shopping list you requested. The list is only sent after you have confirmed via double opt-in (click on the link in the confirmation email).

You only receive seasonal tips (about once a month in spring) if you tick the separate, unticked-by-default box and also confirm the subscription via double opt-in. You get the list without seasonal tips as well.

Note: Sending of seasonal tips has not started yet. Until then you will not receive any tips emails. Your consent stays on record and you can withdraw it at any time.

Legal basis

Your consent. For users in Switzerland the revised Swiss Data Protection Act (revDSG) applies; for users in the EU, Art. 6(1)(a) GDPR. Consent for the list and consent for seasonal tips are requested separately. We keep a log as proof of consent (Art. 7(1) GDPR).

Recipients and processors

We use Resend to send emails (see section 4.1); hosting is with Infomaniak in Switzerland (see section 4.2). We do not pass this data on to anyone else.

Retention

• Unconfirmed requests: the confirmation link is valid for 48 hours. The record is deleted 14 days after the request.
• Mail content (your answers and the list): cleared 14 days after sending, or after a definitively failed send.
• Request metadata (without mail content): deleted 90 days after completion.
• Address without active seasonal tips: deleted 90 days after the last request.
• Address with active seasonal tips: until you withdraw. After withdrawal it is kept for another 90 days as an unsubscribe marker and then deleted.
• Proof of consent: 3 years from the last entry for your address.

On request we delete your data earlier (email to hallo@erntezeit.app). The proof of consent remains only to the extent required to document consent.

Withdrawal

Every email contains an unsubscribe link. With it you can withdraw your consent at any time with one click; alternatively, an email to hallo@erntezeit.app is enough. Withdrawal takes effect for the future.

The email with your list contains no affiliate links. Partner links exist only on the website (see section "Affiliate programs").

We use partner links from Amazon (Amazon Associates) and the Awin network to recommend products in blog posts and in the Bed Starter. If you buy through one of our links, we may receive a small commission. The price you pay does not change. When you click a partner link, we send an anonymous event ("affiliate_click") to OpenPanel: product identifier, placement on the page, language and, for Awin links, the merchant, but no personal data. After the click, the respective partner (Amazon or Awin and the merchant) records the purchase under its own privacy policy. We make recommendations based on our own garden-bed experience, not because of a higher commission.

On the website, including the Bed Starter, we use partner links to Amazon (Amazon Associates) and to the affiliate network Awin. If you buy from a retailer through such a link, we may receive a commission. The price you pay does not change. By clicking you leave our website: the data generated (e.g. IP address and time of the click) is processed by the respective partner under its own privacy policy, and cookies may be set.