Pantree Privacy Policy

This Privacy Policy explains how The People's Pantree, a California nonprofit public benefit corporation (Pantree, we, us, or our) handles personal information through its websites, applications, garden-planning tools, community, and other features actually provided to you (the Service).

A Provider is a third party supplying part of a feature or receiving information for a function described here. Providers do not all have the same legal role. Some process information for Pantree; others, including services you use directly, have their own relationship with you and their own obligations.

This Policy is a notice of information practices and Pantree commitments. It is not, by itself, consent to optional processing or authorization for a payment. The Terms of Service are available at https://pantree.earth/terms.

1. Scope and contact

The Service is offered in the United States. The information processed depends on the feature and client you use. The web application has features, including family records, AI, wallets, and transactions, that are not currently available in the native iOS client. Describing a feature here does not mean it is offered on every device.

Send privacy questions and requests through available account controls or to:

The People's Pantree, a California nonprofit public benefit corporation
4520 South Peachtree, Balch Springs, TX 75180
hello@pantree.me

This Policy concerns Pantree's processing. It does not replace the terms governing an independent authentication, payment, conversion, or other service you use directly, and that distinction does not excuse Pantree's own responsibilities.

2. Information we collect and its sources

2.1 Accounts and eligibility

We process information you provide and information generated during authentication and account use, including your name or display name, email address, account and Provider identifiers, authentication and session information, account status, settings, and adult-status self-attestation. Sign-in uses email and Provider-based authentication rather than a conventional Pantree password account.

Pantree does not currently have an account date-of-birth or age-band collection flow, guardian-linking flow, or separate Teen-assent flow. If you contact us about age, eligibility, a guardian relationship, or a rights request, we may receive the information you provide and request proportionate information needed to handle that matter. A dependent record's age information is separate from account-age verification.

2.2 Dependent family records

An adult may maintain a dependent record for family garden planning. The existing record fields include a nickname, age band, optional birth year, and notes. The record has no login and does not authorize the dependent to use the Service.

Use only a non-identifying nickname and broad age band. Do not add a birth year or unnecessary information about a child to the optional fields, including health information, school, schedule, contact details, a photograph, or precise location. A record already containing such information may still contain it until it is edited or deleted; the existence of this instruction does not mean the fields technically reject that information.

These records are processed through Pantree's hosting and storage systems. Do not copy them into AI inputs, community posts, messages, listings, or transactions. Information entered into those other features is subject to their corresponding processing and disclosure, and this Policy does not claim that every route automatically filters dependent information out.

2.3 Gardens, addresses, and location

We process addresses or coordinates you submit, map selections, watershed and approximate location, and garden information such as plants, climate, soil, sun, water, structures, site constraints, and planning preferences.

A typed address or coordinates reach MapTiler or Mapbox for geocoding before Pantree applies its location-cloaking treatment. A coarser watershed display does not keep the submitted location from the geocoder. Exact garden information is not made anonymous merely by displaying a coarser location, and photographs or descriptions may separately identify the property.

2.4 Photos, files, community activity, and messages

We process uploaded photos and files, captions, technical upload information, profiles, posts, comments, likes, bookmarks, Pulse contributions and votes, listings, session details, bookings, messages, attachments, and related activity. We also process reports, blocks, review requests, and enforcement records.

The Pantree web app removes embedded metadata from photos before upload, but this does not remove identifying details visible in the image, and a file uploaded another way may retain its metadata. Photos and audio uploaded to community features, profiles, and listings are stored at web addresses that anyone holding the address can open without signing in. Do not upload a file you would not want seen by someone who obtains its address. Files uploaded for garden design are stored with access restricted to your account.

Direct messages are stored on Pantree's servers under participant access controls and are not end-to-end encrypted. Information may be accessed for necessary support, moderation, safety, security, legal process, or incident response. A participant may copy a message outside Pantree.

2.5 Membership, marketplace, and session information

We process membership and entitlement status, billing contact information, Provider customer and transaction identifiers, limited payment-method information received from a Provider, amounts, fees, taxes, renewal and cancellation status, refunds, disputes, listings, orders, bookings, and seller or host information.

Stripe processes membership payments made on the web, including through pantree.earth. Payment credentials supplied in a Provider's payment flow are processed by that Provider. Pantree also receives information needed to identify the purchase, administer access, reconcile payments, and handle support or disputes. This Policy does not describe an Apple-billed membership purchase as a current Pantree feature.

2.6 Wallets and digital assets

Wallet-related processing may include wallet addresses and usernames, Provider identifiers, displayed balances, network and asset information, transfer requests, transaction references, fees, conversion-session status, eligibility or identity-verification status, and security, recovery, support, and dispute information. A conversion Provider may collect identity documents and payment information directly in its own flow.

Public blockchain records can expose wallet addresses, balances, transactions, and counterparties permanently. A username-directory entry or other disclosure linking you to an address can make that public history easier to associate with you. Deleting a Pantree account does not erase a blockchain record. This Policy does not characterize the wallet as self-custodial or state that Pantree lacks control over it.

2.7 Artificial intelligence

AI processing includes prompts, wizard answers, garden and site constraints, plan context, chat text, generated output, feedback, usage or credit records, and related cost, safety, and error information. Anthropic receives text and context for generation and chat. Voyage AI receives retrieval-query text for embeddings. The described plan-generation flow does not send garden photographs to a model for visual analysis.

Using an AI feature sends the inputs described above to these Providers to produce the result. AI features are optional. If you do not want your inputs sent to these Providers, do not use the AI features; account, community, safety, support, privacy, and deletion functions do not depend on them. Pantree will not send your information to a different AI Provider, or for a materially different purpose, without first telling you and obtaining any permission the law requires.

Pantree's permission to process identifiable inputs and outputs is limited to delivery, security, investigation of a reported malfunction or abuse, and a specifically disclosed, bounded safety or quality evaluation. It does not authorize general-purpose or reusable-model training, advertising, sale, or unrelated product improvement. An evaluation requiring human review must disclose its purpose, information, reviewers, Provider involvement, access and retention limits, and refusal or withdrawal consequences before that additional use.

This limit on Pantree's permission is not a representation that the AI Providers' own terms exclude every training, human-review, or retention practice. Pantree does not promise zero retention, no Provider training, a fixed Provider deletion period, or deletion from every Provider system when you delete an account. Do not submit confidential information or information unnecessary for the garden task.

2.8 iNaturalist

For an eligible adult who connects iNaturalist, Pantree processes connection status, an OAuth authorization token, authorized account information, and public observations. The token is stored in encrypted form for the connection. The integration is read-only: it does not create, edit, or delete iNaturalist observations and does not use iNaturalist material for model training or AI retrieval or generation.

Disconnect through available settings or request disconnection at hello@pantree.me. Pantree will stop future use of the connection and delete or disable its stored token. Public observations may remain available independently from iNaturalist, and limited security or transaction-related connection records may remain where necessary.

2.9 Our websites

The pantree.earth website lets you join a waitlist, use a savings calculator, request a detailed report, start a membership checkout, book a consultation, and make a contribution. For these, we process the email address, ZIP code, address, lawn size, and other details you enter, your IP address, the plan you select, and checkout and booking status. Stripe processes card payments. Cal.com processes consultation bookings and the details you give it. A contribution in USDC is made through Coinbase's Base Account directly to a Pantree wallet address and is recorded on the Base network; Coinbase collects your name and email address for it and shares them with Pantree. Contributions sent to our other published cryptocurrency addresses are recorded on their public networks.

2.10 Technical, support, and safety information

We process information generated by Service use, such as IP address, browser or device information, operating system and app version, request and authentication events, performance and error information, session and security records, rate-limit or cache entries, and notification-registration information. Diagnostic records may include technical context associated with an error; this Policy does not promise that all logs are free of personal information.

The iOS app supports device-token registration, but Pantree does not currently have a push-notification sender. A token's registration is not a representation that notifications are being sent.

When you contact Pantree or submit a report, we process your correspondence, contact details, relevant identifiers and evidence, actions taken, and information needed to investigate, respond, preserve safety, or meet legal obligations. Copyright and intimate-image requests may include a signature, locator, contact information, authorization information, and statements supporting the request. Do not email another copy of intimate or suspected unlawful imagery when identifiers are sufficient.

We may also receive information from authentication, payment, wallet, mapping, and other Providers; counterparties; reporters; rights holders; public sources; public blockchains; and legally authorized authorities. We use it only for the relevant purposes described here.

3. Why we use information

We use personal information to authenticate and support accounts; provide the features you request; manage memberships, transactions, and service entitlements; apply settings; respond to safety and rights requests; prevent fraud and unauthorized access; troubleshoot failures; and meet applicable legal, accounting, transaction, and dispute obligations.

Operational reliability and safety work is not permission to build a reusable corpus of identifiable User Content or train a general-purpose or reusable model. Optional AI evaluation remains subject to Section 2.7. Precise home location, private messages, dependent information, wallet information, and AI inputs may not be repurposed for unrelated advertising merely because they support a Service feature.

Service restrictions may result from account status, eligibility rules, rate limits, reports, security signals, or Provider decisions. You may ask Pantree to review a restriction through hello@pantree.me. This does not promise that every decision is automated, that every decision receives an independent reviewer, or that Pantree can overturn a Provider's separate decision.

4. Recipients and disclosures

4.1 Other users and requested actions

Posting, messaging, listing, booking, connecting a Provider, or initiating a transaction discloses information to the audience or recipient involved in that action. Counterparties may receive information needed to perform a transaction. Sharing a wallet address or a precise property detail can reveal more than the immediate item shared. Review the feature and available audience settings before acting.

4.2 Providers

The following identifies Providers for the described functions. It does not mean every Provider receives every user's information or that every function is available in the iOS app.

Hosting and communications Providers necessarily process information for the corresponding Service requests or records. Independent payment, conversion, authentication, and other Provider relationships may also involve the Provider's own legal, security, and account obligations. These roles do not transfer Pantree's own duties to the Provider. This Policy does not promise identical retention, processing locations, or deletion capabilities across Providers.

4.3 Safety, legal obligations, and organizational changes

We may disclose information when reasonably necessary to comply with law or valid legal process, respond to an emergency, report legally reportable conduct, protect a person, prevent fraud or security harm, enforce applicable rules, or establish or defend a claim. We will limit disclosures to what is appropriate for the matter and may notify an affected user when lawful and safe.

A copyright counter-notice may be provided to the claimant with the information the legal process requires. Intimate-image requester information is not automatically disclosed to the uploader. Sensitive reports, private communications, and information concerning a child require particular care; an account relationship does not itself authorize disclosure.

Information may be disclosed in a proposed or completed organizational transaction subject to confidentiality, purpose limits, and required notice or consent. A change of operator does not, by itself, authorize new advertising, training, or other materially different uses, or release responsibility for earlier processing.

5. Public information and access controls

Public content may be indexed, copied, retained, or reshared by others. Pantree cannot promise to erase copies outside its control or public blockchain history.

For messages, “private” describes participant access controls; it does not mean end-to-end encryption, immunity from necessary support or safety access, or inability of a participant to copy the material. Do not infer that a photo or file is private solely because it was uploaded from an account screen. Review its feature context and available sharing controls.

Location cloaking reduces the precision of a displayed location; it does not erase an address already sent to a geocoder or identifying information visible in other content.

6. Youth and family privacy

Pantree's minimum account age is 13, and every account for ages 13 through 17 requires a verified Guardian relationship, separate Guardian authorization, separate membership payment by that Guardian, and the Teen's own assent. Pantree does not currently provide the verification, linking, or Teen-assent flows or Teen-specific restrictions. An adult-status self-attestation is not proof that a user is an adult or has a verified Guardian. A Teen therefore cannot presently complete the requirements for an authorized account. Privy's current authentication route also has a 16-year minimum, which Guardian permission alone cannot override.

These are eligibility requirements, not a claim that technical controls prevent every ineligible signup. If a minor obtains access anyway, the information actually submitted or generated may be processed through the same features and Providers described in this Policy. That access is not parental consent, and Pantree will not use it to impose contractual obligations arising from the unauthorized signup. Privacy and safety obligations still apply.

A dependent record is adult-managed information about a child, not a child account. Its existing fields and limitations are described in Section 2.2. Adults must not let a child use their account or place dependent information into other Service features. The record does not establish that its subject is the person using the adult account, and it is not a parental-consent mechanism for direct use by a child.

If you believe a child under 13 is using an account, or an account is being used without a required Guardian relationship, contact hello@pantree.me with enough information to identify the account. Do not send unnecessary information or identity documents. When Pantree learns that an account is being used in violation of these requirements, it will restrict ordinary use, address further disclosures, and arrange appropriate deletion, subject to necessary legal or safety preservation. Information will not be retained simply to keep an unauthorized child account open.

Guardians do not automatically receive a Teen's private messages. Requests for access, correction, or deletion require verification of identity and authority appropriate to the request and consideration of the Teen's independent rights, other people's communications, confidential reports, and safety. A Guardian cannot erase a Teen's safety report or legal right merely by withdrawing permission. Necessary, lawful disclosures may still be made to protect a person or comply with law.

A minor may request removal of content the minor posted by emailing hello@pantree.me with the account and content identifiers. No Guardian permission is required to submit that request. Pantree will provide removal required by applicable law, subject to its exceptions. Removal does not ensure complete or comprehensive erasure, including of copies made by other people or records law requires to be preserved.

7. Retention

Pantree retains information only while reasonably necessary for the purpose for which it is processed, including provision of the requested feature, fulfillment, safety, security, legal obligations, and a specific dispute or claim. Retention is not permission for unrelated use.

A specific legal, safety, fraud, transaction, or litigation hold can extend retention. Backups and Provider systems may follow different deletion cycles. The seven-day account grace period is not a promise of complete deletion from every system within seven days.

8. Account deletion and disconnection

You may initiate deletion through the account controls. The ordinary account-deletion process includes a seven-day grace period before completion. Contact hello@pantree.me to request cancellation of a pending deletion, earlier removal, or help with a particular record. A legally required deletion is not postponed merely because the ordinary workflow has a grace period.

The process removes account and private data, disconnects integrations, and removes account identifiers from some public or counterparty records, subject to the retention limits above. A completion indication for the Pantree account is not proof that every Provider has erased every record. A Provider may retain information under its own legal obligations or an independent account relationship.

A request to delete a Pantree account is also a request to stop renewal of a Pantree-sold membership. The Terms explain refunds for unused paid access and other billing consequences. Cancellation must not wait for the grace period to end.

Account deletion can affect embedded-wallet access. Do not assume that the ordinary deletion process checks balances or protects recovery access. Contact hello@pantree.me before initiating deletion involving value, a pending transaction, or unresolved recovery. Requesting deletion is not consent to forfeit value or irreversibly destroy recovery access, and a warning does not waive Pantree's responsibility for unauthorized loss. Resolution of wallet-specific matters must be separated from deletion of other data that does not need to be retained for those matters or another lawful purpose.

9. Choices, rights, cookies, and tracking

You may use available controls or contact hello@pantree.me to request access, correction, deletion, withdrawal of a permission, or review of a decision. Statutory rights and exceptions depend on the applicable law, information, processing, and operator; this Policy does not represent that every state privacy statute applies to Pantree.

We may ask for information reasonably necessary to verify identity or authority, including an authorized agent's or Guardian's authority. We will not require more information than reasonably needed. A denial will include an explanation and an appeal route when law requires. You may also request reconsideration at the same email address. Exercising a good-faith privacy right will not result in unlawful discrimination.

Available profile, sharing, location, connection, and notification controls affect the corresponding feature, not copies already obtained by others or immutable blockchain records. Withdrawal stops future processing that requires the withdrawn permission; it does not undo a completed disclosure or require destruction of a record law requires to be kept.

Pantree will not sell personal information for money or use User Content for advertising. The web application's identified dependencies contain no advertising or third-party analytics SDK. This limited statement does not establish that every marketing page, cookie, Provider, or embedded service is free of collection across websites.

Authentication and other Provider services may use cookies, local storage, or similar technology. Browser controls can restrict these technologies and may affect Service functionality. Pantree does not offer a verified response to browser “Do Not Track” signals across every Service surface. Do not rely on that signal to prevent the disclosures described here. Other parties may collect information over time or across other services through their own technology or direct relationship with you; this Policy does not certify their practices. A legally applicable opt-out request or preference signal retains whatever effect applicable law gives it.

10. Security and processing locations

Pantree uses account and message access controls and technical protections for Service information. No system guarantees complete security. The sensitivity of home information, private communications, family records, and wallet-related data is not reduced merely because a feature is described as private or protected.

Report a suspected compromise to hello@pantree.me. Do not send passwords, private keys, seed phrases, or one-time codes through ordinary support. Pantree will provide incident notices where required by law.

A United States offering is not a commitment that all processing or storage remains in the United States. Providers may process information where they operate. This Policy does not promise a particular Provider processing region or a United States-only data location.

11. Changes to this Policy

The current Policy and its effective date are available at https://pantree.earth/privacy. Pantree will retain prior effective versions and provide the applicable version on request.

Pantree will give notice of a material change through an available account contact or a prominent Service notice. A new operator, materially different purpose, new third-party AI disclosure, or expanded use requiring permission will not be authorized merely by posting a changed Policy. Pantree will obtain the permission required before that change in processing. Earlier information will not be used inconsistently with an applicable earlier commitment merely because this Policy changes.

12. Contact

The People's Pantree, a California nonprofit public benefit corporation
4520 South Peachtree, Balch Springs, TX 75180
hello@pantree.me

Use this contact for privacy, youth, deletion, and security matters. The Terms of Service contain the complete copyright-complaint and nonconsensual intimate-image removal instructions. An intimate-image removal request is not a copyright complaint; do not send another copy when a locator is sufficient.