Last updated: 26 July 2026 (2)
Buurtuin ("the app", "we") is a community app for allotment and kitchen gardeners. This policy explains what we collect, why we're allowed to, how long we keep it, and what you can do about it. We keep it short and honest.
Buurtuin is run by Nick Nitert, a private individual in the Netherlands, who is the controller of your personal data under the GDPR.
Contact: Buurtuin.App@gmail.com
Under the GDPR we have to name a lawful basis for each thing we do. Here it is.
Only if you make an account — it's optional, you can browse anonymously.
Either way you also get a user ID that links your content to you. If you never make an account, you get an anonymous ID and nothing else.
Basis: contract — we can't give you an account, or keep your posts across devices, without it.
Posts, photos, captions, comments, swap listings, events, plot-directory listings, plant and photo suggestions, community jobs or help requests you create, and which garden you've joined.
Basis: contract — this is the service you asked for.
Your task choices (done, tomorrow or not relevant), the community jobs you join, and likes or ratings you give. These are linked to your user ID so the app can remember your choices and show accurate helper, like and rating counts.
Basis: contract — these choices provide the task and community features you asked to use.
Content you post is checked automatically (see "Automated moderation" below). If you report someone, we store the report, what was reported, and who reported it.
Basis: legitimate interest — a community app has to be able to deal with abuse. We think that's fair to you: it protects you too, and reports are never shown to the person reported.
A push-notification token for your device.
Basis: consent — you opt in when your device asks, and you can turn it off any time in Settings or in your device settings.
When the app crashes we receive a crash report: device model, OS version, and where in the app it happened. It doesn't contain your posts or your messages.
Basis: legitimate interest — an app that crashes and never tells us is worse for you than one that does.
If you allow location access, the app asks your phone for its position and sends it — rounded to two decimal places, about a kilometre — to Open-Meteo to fetch your local forecast. We never receive your exact position, we don't store any position, and the request carries no name, no user ID and nothing that links it to your account. Open-Meteo does see the IP address your phone connects from, as any website you visit would.
Say no and the app works normally; you just don't get the weather tip.
Basis: consent — your phone asks, and you can withdraw it any time in your device settings.
Your favourites, plant notes, garden layout, harvest log and app settings (theme, language, text size) live in your phone's local storage. They never reach our servers, and they're gone when you uninstall.
The list of people you've blocked is stored with your account, so that blocking someone actually sticks — reinstalling the app, or signing in on another phone, no longer un-blocks them. It holds their user IDs and nothing else.
Nobody else can read it, including us in the app: it's readable only by you. The person you blocked is never told.
Basis: contract — blocking is a feature you asked for, and one that only works if it's remembered.
We do not collect your precise location (see the weather card above — it's rounded and never stored), your contacts, or payment details. We do not show ads, and we do not sell or share your data with advertisers. We do not use your content to train AI models. We use no analytics and no tracking of any kind.
Posts, captions and comments are checked automatically by software the moment you post them, and photos are checked by automated image analysis. Content the check flags is hidden without a person seeing it first. Content is also hidden automatically once several different people report it.
This is automated, and it gets things wrong sometimes. You can ask a human to look at it — email Buurtuin.App@gmail.com and Nick will review it himself.
We use Google (Google Ireland Limited and Google LLC) to run the backend. Google processes your data on our behalf, under a data processing agreement and its own terms: https://firebase.google.com/support/privacy
We also use Open-Meteo (Open-Meteo, Germany) for the weather card only. It receives a rounded location and your device's IP address, and nothing else — no account, no name, no identifier. It is a separate controller for that request, under its own privacy terms: https://open-meteo.com/en/terms
That's the complete list. There are no other companies, no advertising networks and no analytics providers.
Your data is stored in the European Union — Firestore in eur3, Storage and our server functions in europe-west1 (Belgium).
Google may still transfer some data to the United States, for example for crash reporting or support. For those transfers Google relies on the EU–US Data Privacy Framework and on the European Commission's Standard Contractual Clauses. Ask us if you want the details.
About abuse reports: these are deliberately not erased when you delete your account. If they were, anyone could wipe the record of their behaviour by deleting and re-registering. We keep them on the basis of our legitimate interest in keeping the community safe. They contain the reporter's user ID and the reported content.
Settings → Delete account. This permanently deletes your profile, posts, photos, comments, swap listings, events, plot listings, plant suggestions, your push token, and the image files themselves — not just the links to them. It also removes your task choices, community-task participation, likes, ratings, event attendance and poll votes from content that remains.
It's immediate, and it can't be undone. The only thing that survives is abuse reports, as explained above.
Under the GDPR you have the right to:
Email Buurtuin.App@gmail.com for any of these. We'll respond within one month.
You can also complain to a supervisory authority. In the Netherlands that's the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl). You don't have to ask us first.
Buurtuin isn't for children under 16, and you confirm you're 16 or older when you start. If you believe a child has given us personal data, email us and we'll delete it.
If you photograph other people at your allotment, please ask them first. You're responsible for what you upload, and anyone in your photos can ask us to remove them.
We may update this policy; the "last updated" date will change. Significant changes will be announced in the app.
Questions? Email Buurtuin.App@gmail.com.