Privacy policy

Atlas-Flora is a plant atlas optimized for speed and privacy. Below is a plain-language explanation of what data is processed while using the site, and why.

Data controller

The data controller (within the meaning of the GDPR) for atlas-flora.com is MattLogic. For any data-related questions, contact [email protected].

User account (optional)

Using the atlas — including favorites, notes, and the watering plan — does not require an account. By default that data stays only in your browser (see below). You may, however, optionally sign in with Google if you'd like your favorites, notes, and watering plans to sync across your devices. Without signing in the site works fully — signing in is purely a convenience, not a condition of use.

Data stored locally in your browser (without an account)

When you're not signed in, features such as favorite plants, plant notes, and the watering plan (available under "My") are stored exclusively in your browser's local storage (localStorage) on your own device. This data is never sent to any server — we have no access to it and never store it anywhere beyond your device.

From the "My" page you can export this data to a file (backup) or permanently clear it at any time — you're fully in control of it.

Data stored in your account (once signed in)

If you choose to sign in with Google, we store on our server (a Cloudflare D1 database, European Union region):

• your Google account identifier, email address, and display name — received from Google at sign-in to recognize and secure your account;
• your favorite plants, notes, and watering plans — the same data that would otherwise stay in your browser.

We never collect your password — authentication is handled entirely by Google, and we never see your password. We do not profile you, show ads, or share this data with third parties for marketing. The legal basis is performance of the service you request — syncing your data (Art. 6(1)(b) GDPR) — and your voluntary consent given by signing in (Art. 6(1)(a) GDPR), which you can withdraw at any time by deleting your account.

Keeping you signed in (session token)

To keep you signed in between visits, once you sign in we set a single technical cookie (af_refresh). It is necessary for sign-in to work, marked HttpOnly and Secure (inaccessible to page scripts, sent only over HTTPS), and does not serve tracking or advertising. It disappears when you sign out. The short-lived API access token is held only in the browser tab's memory — it disappears when the tab closes and never reaches persistent storage.

Processors

To provide the service we use two trusted providers, each processing data only as needed for its function:

• Cloudflare — site hosting and the account database (D1) in the EU region;
• Google — the "Sign in with Google" provider (data reaches Google only when you yourself choose to sign in).

Server logs and hosting

The site is hosted on Cloudflare's infrastructure. Like any web service, standard technical access logs are recorded (IP address, timestamp, requested URL, browser type) — used solely for security and troubleshooting, never combined with a user profile or used for profiling.

Cookies and analytics

The site does not use any tracking cookies or analytics tools (Google Analytics, Meta Pixel, or similar). The only cookie that may be set is the technical session cookie described above (af_refresh) — it appears only if you choose to sign in and is necessary to keep you signed in (being strictly necessary, it requires no consent under the GDPR).

Preferences such as dismissing the notice banner are stored in localStorage, not in a cookie, so they never leave your browser.

Search

The site's search feature (Pagefind) runs entirely in your browser — search queries are never sent to an external search service or stored.

Your rights

You have the right to access, rectify, erase, and port your data:

• Access and portability — on request (by email at the address above) we'll provide a copy of the data stored in your account.
• Erasure (right to be forgotten) — if you have an account, the "Delete account" button on the "My" page permanently and irreversibly erases your entire account from our server, including favorites, notes, watering plans, and sign-in data. Data stored locally, without an account, you can remove at any time by clearing this site's data in your browser settings.
• For any other data questions, reach out at the address above. You also have the right to lodge a complaint with a supervisory authority.

Changes to this policy

If the scope of data processing changes (e.g. analytics or another sign-in provider is added), this page will be updated with a new date at the top.