Privacy Policy

This Privacy Policy explains how Native Refuge (“Native Refuge,” “we,” “us,” or “our”), the trade name of a California limited liability company, collects, uses, and shares information when you visit nativerefuge.com and use our native-plant report service (the “Service”). By using the Service, you agree to this Policy.

Information we collect

• Account information. When you create an account we collect your email address. If you sign in with Google, we receive your name and email from Google. We use Supabase to manage sign-in; passwords are stored in hashed form, and we never see your Google password.
• Property information. To generate a report you provide a property address, drop a map pin, or enter coordinates. The location is geocoded by Mapbox and associated with the reports you generate. The address you type is also sent to the U.S. Census Bureau’s public geocoder, which we use as a second opinion on where Mapbox placed you — and, where the two agree, as the only coordinate we are permitted to keep. To describe the site we then send those coordinates — and only the coordinates, never your name or email — to three public government data services: the USDA Natural Resources Conservation Service, for soil; the U.S. Geological Survey, for elevation and mapped surface water; and CAL FIRE, for its fire hazard zone map, which Esri’s ArcGIS Online hosts for it. When the USGS elevation service is down, we read elevation from public terrain map tiles on Amazon Web Services instead, which are told only the map tile, an area about five miles across, not your point. Everything else — climate, ecoregion, watershed, county and the plant data itself — is looked up in our own database and leaves nothing. None of these services is told who you are.
• Payment information. Purchases are processed by Stripe, which collects and handles your card details directly. We do not receive or store your full card number. We retain a record of your purchases (amount, date, and the email tied to the purchase).
• Communications. If you email us (e.g., hello@nativerefuge.com), we receive your message and contact details. We also send you transactional email about your purchase — the link to your report. Both are handled through our email provider (Zoho).
• Preview links. If you ask us to email you a link back to a free preview, we store that email address with the preview so we can send you the link, and we keep the preview longer (see Data retention below) so the link still works if you come back when planting season arrives. Reply to that email to be removed. We do not sell or share this address.
• Technical information. Our hosting and security providers (Vercel, Cloudflare) automatically process limited technical data such as IP address, browser type, and request logs to operate and secure the Service. To limit abuse, we also record the IP address of each report request and delete it after 30 days.

How we use information

• To generate, deliver, and store your reports and account.
• To process payments and provide customer support.
• To operate, secure, debug, and improve the Service.
• To comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use it for third-party advertising.

How we share information

We share information only with the service providers that help us run the Service, and only as needed to provide it:

• Supabase — database and authentication (stores your account and reports).
• Vercel — application hosting.
• Stripe — payment processing.
• Mapbox — geocoding and map imagery for the location you enter.
• Google — only if you choose to sign in with Google.
• iNaturalist and Wikimedia Commons — plant photographs load in your browser from these two sources, so they see the request. Our referrer policy limits what they receive to the site name, not the page you are on.
• U.S. Census Bureau — the public geocoder we check addresses against. It receives the address you type, and nothing else about you.
• Cloudflare — DNS and content delivery / security.
• Zoho — email delivery: our support inbox, and the emails that send you your report link after a purchase or your preview link when you ask for it (we send your email address, the place name, and the link).

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.

Cookies & tracking

We use only the essential cookies required to keep you signed in (set by our authentication provider). To understand overall traffic we use Vercel Web Analytics, which is cookieless — it counts aggregate page views and visits without cookies, without cross-site tracking, and without collecting information that identifies you personally. We do not use advertising or cross-site tracking cookies.

When you arrive through a link that names a campaign, or from another website, we note that campaign or that website’s name — never the page you came from, and nothing about you — in your browser for the rest of your visit, and record it with any preview you create or credits you buy, so we can tell which links bring people here. It is cleared when you close the tab. With each preview we also keep its county (for example, Los Angeles County), never the address, so we can count where previews come from after the preview itself is deleted.

We don’t track you across other sites, and no third party tracks you across sites through ours, so there is nothing for a browser’s “Do Not Track” signal to switch off; we treat every visit the same way whether or not it sends one.

Data retention

We keep your account and purchased reports for as long as your account is active or as needed to provide the Service. Unpurchased report previews are automatically deleted about 14 days after they are created. If you ask us to email you a preview link, we keep that preview — and the email address you gave us — for about 90 days instead, so the link still works if you come back when planting season arrives. You can ask us to delete your account and associated data at any time by emailing hello@nativerefuge.com — this removes your reports and the addresses tied to them. We may retain limited records (such as transaction records) where required for legal, accounting, or fraud-prevention purposes.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of the “sale” or “sharing” of personal information. Native Refuge does not sell or share your personal information. California residents have these rights under the CCPA/CPRA. To exercise any right, email hello@nativerefuge.com from the address associated with your account. We will not discriminate against you for exercising your rights.

Security

We use reputable providers and reasonable safeguards to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to this Policy

We may update this Policy from time to time. We will revise the “Last updated” date above, and material changes will be reflected on this page.

Contact

Questions about this Policy? Email hello@nativerefuge.com.