Privacy policy

Last updated: October 1, 2026

Stilk (stilk.app) lets people plant a virtual tree or flower and care for it together. This policy explains what personal data we use, why, and the choices you have. We don’t sell your data and we don’t show ads.

1. Who is responsible

The data controller is:

  • Pablo Guardiola
  • C/ Pla 8, 08980 Sant Feliu de Llobregat, Barcelona, Spain
  • contact@stilk.app

2. What we collect

  • What you write: plant names, dedications, messages and the display name you choose. Anyone with a plant’s link can see them, so please don’t include sensitive information.
  • Care activity: when a plant is watered or weeded, and by whom.
  • Account: when you arrive we create a guest account (a random identifier kept in your browser). If you sign in, we also store your email address and, with Google or Apple, the account identifier and name they share with us.
  • Payments: handled by Stripe on the web, and by Apple or Google (through RevenueCat) in the apps. We receive your email (Stripe), the product, amount, currency, country and payment status — never your card details.
  • Notifications: if you allow notifications in the iOS or Android app, a device token and your app language, so we can tell you when someone leaves a message on, waters or weeds a plant in your garden, or when it reaches a milestone. Otherwise, if you signed in with an email, we email you about messages and milestones instead (you can stop these emails from the link in each one). You choose which of these you get in the app.
  • Analytics: pages visited and actions such as planting, sharing or watering; device, browser, operating system, language, approximate location derived from your IP address, and a pseudonymous identifier.
  • Technical data: IP address and request logs kept by our hosting providers for security.

3. Why we use it and on what legal basis

  • To provide Stilk (plants, gardens, accounts, sign-in emails, message notifications): performance of our contract with you (GDPR art. 6.1.b).
  • To process payments and meet tax and accounting duties: contract and legal obligation (art. 6.1.b and 6.1.c).
  • Analytics to understand and improve Stilk: your consent in the EU, EEA, UK and Switzerland (art. 6.1.a); elsewhere our legitimate interest in improving the service (art. 6.1.f). You can say no or change your mind at any time.
  • Security, abuse prevention and content moderation: legitimate interest (art. 6.1.f).

4. Who we share it with

Only with providers that help us run Stilk, under contracts that protect your data:

  • Supabase — database and sign-in.
  • Vercel — website hosting.
  • Stripe — payments on the web.
  • RevenueCat — records in-app purchases in the iOS and Android apps.
  • Google — Google Analytics for Firebase, Google sign-in if you use it, and in the Android app, Google Play for purchases and Firebase Cloud Messaging for notifications.
  • Apple — Sign in with Apple, in-app purchases and push notifications in the iOS app.
  • Resend — sending sign-in and message emails.

Some of these providers are in the United States. Transfers are protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. We may also disclose data when the law requires it.

5. How long we keep it

  • Plants, messages and accounts: while they exist, or until you ask us to delete them.
  • Guest accounts that have been inactive for a long time may be deleted.
  • Payment records: as long as tax and commercial law requires (up to 6 years in Spain).
  • Analytics data: up to 14 months.

6. Your rights

You can delete your account and its data at any time from the apps (Account → Delete account) or at stilk.app/delete-account: your messages, profile, gardens, purchases records and devices are deleted, and plants you planted stay for the people caring for them, without your name. You can also ask to access, correct, delete, restrict or transfer your data, object to its use, and withdraw consent at any time, by writing to contact@stilk.app. If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or your local authority.

7. Children

Stilk isn’t meant for children under 14 unless a parent or guardian agrees and helps.

8. Cookies and similar technologies

Necessary (always on)

  • Sign-in session (sb-…-auth-token): keeps you signed in to your garden.
  • Language (gt_lang): remembers the language you picked.
  • Account switch (stilk-guest, 15 minutes): moves your guest plants into the account you sign in to.
  • Browser storage: your cookie choice, unsent drafts and small preferences.

Analytics (optional)

  • Google Analytics for Firebase (_ga, _ga_*, up to 2 years, plus a Firebase identifier in browser storage): counts visits and how Stilk is used. In the EU, EEA, UK and Switzerland these are only used if you accept them.

The payment page (checkout.stripe.com) is run by Stripe and uses Stripe’s own cookies.

9. Changes

If we change this policy we’ll update the date above, and tell you on the site if the change is important.