Privacy Policy

Last updated: August 10, 2026

Your privacy matters to us. This Privacy Policy explains how Nimera collects, uses, stores, and protects your personal data when you use our garden planning application.

1. Introduction

Nimera ("we", "us", "our") is an online garden planning service operating at nimera.garden, established within the European Union. Nimera is the data controller for the personal data described in this policy. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws wherever you are in the world.

By using Nimera, you acknowledge that you have read and understood this Privacy Policy. If you have questions about our data practices, you can reach us at [email protected].

2. Data We Collect

We collect and process the following categories of data:

Account Data

  • Email address (used for authentication and communication)
  • Hashed password (we never store passwords in plain text)
  • Language preference and display settings

Garden Data

  • Seed inventory and plant variety information
  • Garden layouts and canvas designs
  • Task schedules and calendar entries
  • Journal entries and notes
  • Harvest records and yield data
  • Tool and equipment inventory
  • And other data you create within the Service

Location Data

Garden coordinates (latitude and longitude), only if you choose to set a garden location for weather data. This is entirely optional, can be removed at any time, and requires your explicit consent. Garden coordinates are personal data under the GDPR and are treated accordingly. We apply the principle of data minimization: we collect only the coordinates needed to deliver weather data for your specific location, and do not use them for any other purpose.

Media

  • Photos and images you upload to any part of the Service

Technical Data

  • Browser type and version (in standard server logs)
  • IP address (in server logs for security purposes, and used transiently for the measurement described under Usage Data; not stored long-term)

Usage Data

We measure how the Service is used, with analytics software we run ourselves on our own servers in the European Union. It sets no cookies, sends nothing to any third party, and cannot follow you to other websites.

  • Pages visited, which sections of a page came into view, buttons clicked, and how long a page was read
  • Country, browser, operating system, device type, screen size and language, worked out from your request
  • Your IP address is used only in the moment — to work out the country and to group the requests belonging to one visit. It is never stored alongside this data.
  • If you are signed in, a pseudonymous identifier derived from your account — never your email address — so that we can tell one person's visits apart without learning who you are

3. How We Use Your Data

We use your data for the following purposes:

  • Providing and operating the Service, including storing your garden plans, seeds, tasks, and other content
  • Sending essential email notifications such as email verification, password reset, and account security alerts
  • Sending optional garden reminders and notifications (only with your explicit consent)
  • Displaying weather data for your garden location (only when you have provided location consent)
  • Generating garden statistics and insights within your account
  • Improving and maintaining the Service, including bug fixes and performance optimization
  • Measuring how the Service is used, in aggregate, so we can see which parts help and which get in the way

Automated decision-making and profiling: Nimera does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you, as described in Article 22 GDPR. All decisions that affect your account or data are made by humans.

Under the General Data Protection Regulation, we process your data based on the following legal grounds:

  • Contract performance (Article 6(1)(b) GDPR) — Processing necessary to provide the Service you signed up for, including storing your garden data, managing your account, and delivering core functionality.
  • Legitimate interest (Article 6(1)(f) GDPR) — Processing necessary for maintaining the security of our Service, detecting and preventing abuse, maintaining server logs for security incident investigation, improving application performance, and measuring how the Service is used, in aggregate, as described under Usage Data. We have balanced these interests against your privacy rights and determined they do not override your fundamental rights and freedoms. You have the right to object to this processing at any time (see Section 8).
  • Consent (Article 6(1)(a) GDPR) — Processing based on your explicit consent, specifically: optional email notifications and garden reminders, and providing your garden location coordinates for weather data. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Storage & Security

We take the security of your data seriously and implement appropriate technical and organizational measures:

  • Server location — All data is stored on Hetzner servers located in Falkenstein, Germany, within the European Union.
  • Media storage — Uploaded files (photos, images) are stored on Hetzner Object Storage, also located within the EU.
  • Password security — Passwords are hashed using bcrypt, a strong one-way hashing algorithm; we never store or have access to your plain-text password.
  • Authentication — JWT (JSON Web Token) authentication tokens are transmitted via httpOnly secure cookies, protecting against cross-site scripting attacks.
  • Encryption at rest — Database storage is encrypted at rest on the server.
  • Transport security — All data in transit is encrypted using TLS/HTTPS.

6. Third-Party Services

We use a limited number of third-party services to operate Nimera. Each service only receives the minimum data necessary for its function:

  • Brevo (email delivery) — A French company whose hosting servers are located within the European Union. Brevo processes your email address solely to deliver transactional emails (verification, password reset, notifications). Brevo may engage sub-processors outside the EEA under lawful transfer mechanisms. Brevo Privacy Policy
  • Cloudflare (CDN and DDoS protection) — Processes IP addresses as part of routing and protecting traffic to our servers. Cloudflare is a US-based company; however, data transfers are governed by Standard Contractual Clauses (SCCs) under Article 46 GDPR and the EU-US Data Privacy Framework, incorporated into Cloudflare's Data Processing Addendum. Cloudflare Privacy Policy
  • Open-Meteo (weather data) — Used to provide weather information for your garden. Open-Meteo is self-hosted on our own EU-based servers; no personal data is shared with any third party for this service.
  • Google Maps (optional garden location) — If you use the interactive map to set your garden location, the coordinates you select are transmitted to Google's servers for map rendering. We share only coordinate data with Google; we do not share your name, email address, or any other account information. However, garden coordinates may constitute personal data under GDPR when linked to your account. By using this optional feature, you agree to Google's Terms of Service and Google Privacy Policy. This feature is entirely optional and can be disabled at any time. Google Privacy Policy.

We do not sell, rent, or trade your personal data with any third parties.

7. Cookies

We use only strictly functional cookies that are essential for the operation of the Service:

  • Authentication cookie — A JWT token stored in an httpOnly, secure cookie to maintain your login session. This cookie cannot be accessed by JavaScript and is only sent over HTTPS.

We do not use:

  • Tracking or analytics cookies
  • Third-party advertising cookies
  • Social media cookies
  • Any form of cross-site tracking

Because we use only essential functional cookies, no cookie consent banner is required under the GDPR and the ePrivacy Directive.

We do measure how the Service is used, but without cookies and without any third party — see Usage Data above.

8. Your Rights

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

  • Right of access — You have the right to request a copy of all personal data we hold about you.
  • Right to rectification — You have the right to request correction of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") — You have the right to request deletion of your personal data.
  • Right to restrict processing — You have the right to request that we limit how we use your data.
  • Right to data portability — You have the right to receive your data in a structured, commonly used, and machine-readable format.
  • Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to object — You have the right to object to processing based on legitimate interests (Article 6(1)(f) GDPR). Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your rights and interests.
  • Right to lodge a complaint — You have the right to file a complaint with your local data protection supervisory authority.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days as required by GDPR.

9. Data Retention

We retain your personal data only for as long as your account is active and the data is needed to provide the Service.

When you delete your account, all associated data is permanently removed, including:

  • Account information (email, preferences, settings)
  • All garden data (seeds, plants, tasks, journal entries, harvest records, tool inventory)
  • All garden layouts and canvas designs
  • All uploaded media files (photos and images deleted from object storage)

Deletion is performed through cascading deletion of all related database records and removal of media files from object storage. This process is irreversible.

Server logs containing IP addresses are rotated and deleted automatically within 30 days.

Account data after a subscription ends. When your subscription ends you lose access to your garden. We keep your data for 3 months so you can subscribe again and pick up where you left off. After 3 months the account and its contents are deleted permanently. You can ask us to delete everything sooner at any time.

10. Children

Nimera is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at [email protected] and we will promptly delete the information.

11. Data Protection & Supervisory Authority

As a small-scale operator whose processing activities do not fall within the criteria set out in Article 37 GDPR (no large-scale systematic monitoring, no special category data processing on a large scale), Nimera is not required to designate a Data Protection Officer (DPO).

If you are located in the European Union, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence. A full list of EU supervisory authorities is available at the European Data Protection Board website. If you are located outside the EU, you may have similar rights under your local privacy laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

[email protected]

For data protection inquiries, you also have the right to contact the supervisory authority in your country of residence.