TomatoScout Privacy Policy

1. Information we collect

You can browse much of TomatoScout without creating an account.

If you create an account or use member features, we may process the information described below.

Account information

We use your email address and authentication information to create and secure your account and allow you to sign in.

Authentication is provided through Supabase Auth. If you choose to sign in using Google or Apple, those services are also involved in authenticating you.

Your email address is not displayed publicly and is not stored as part of your public TomatoScout profile.

Profile information

Your TomatoScout profile may include:

• your display name;
• biography;
• profile picture;
• country and region;
• growing experience; and
• display preferences.

You can choose whether your profile is public or private.

If your profile is public, information you choose to include in it can be viewed by other visitors. If your profile is private, your profile information is not publicly accessible.

Making your profile private does not make contributions that you have deliberately published, such as a tomato review, private. Where a private-profile user publishes a review, TomatoScout limits the public author information and does not provide a link to the private profile.

Growing information

You can record information about your tomato growing, including growing setups, varieties grown, growing conditions, dates, yields, fruit weights, disease or problem observations and other growing information.

Your private growing records are not publicly accessible.

If you publish a review, selected information relevant to that review may become public. This can include information such as country or region, growing environment, growing method, year, plant numbers, yield, fruit weight, first-ripe information and structured disease or problem observations.

Free-text disease and problem observation notes are treated as private growing information and are not made available through the public review data.

Location information

You may provide location information to improve growing context and recommendations.

This can include country, region and climate-zone information and, where you choose to provide it, a what3words address or latitude and longitude.

Precise location information such as what3words addresses and coordinates is private. It is not included in public profiles or public review snapshots.

If you use functionality involving a what3words address, relevant information may be processed through what3words to provide that feature.

Reviews and community contributions

If you publish a tomato review, the review becomes public.

It may include ratings, sensory assessments, flavour tags, written review text, structured growing observations and a coarse snapshot of the conditions in which you grew the tomato.

If you have a public profile, your public identity may be associated with your review. If your profile is private, TomatoScout limits the author information displayed and does not expose your private profile.

We may also process information you submit when suggesting corrections or reporting reviews or photographs. These submissions are not normally public.

Saved information and personalisation

If you use features such as Saved tomatoes or Saved searches, we store the information necessary to provide those features.

This information is private to your account.

Saved searches may include the criteria and growing context that you deliberately save.

TomatoScout does not currently create behavioural advertising profiles or maintain a history of pages you browse for advertising purposes.

Photographs

If you upload a photograph, we may store the image together with information necessary to manage it. This can include its associated variety, grow or review, uploader, dimensions, file hash, moderation status, source, photographer or copyright information, licence and permission information, and attribution.

Uploaded photographs are processed to remove embedded metadata such as EXIF and GPS information before storage.

Photographs intended for public use are subject to moderation.

Additional terms concerning ownership of photographs and the permissions you give TomatoScout when submitting them are contained in our Terms of Use and, where applicable, in the specific photo permission presented when you submit a photograph.

2. Why we use your information

We use personal information where necessary to:

• create, provide and secure TomatoScout accounts;
• provide profiles and member features;
• save your growing information, saved tomatoes and saved searches;
• provide personalised tomato matching and recommendations based on information you choose to provide;
• publish reviews and other contributions you choose to make public;
• process and moderate photographs, reviews, reports and corrections;
• maintain the quality, provenance, security and integrity of TomatoScout and its variety database;
• prevent, detect and investigate misuse;
• respond to enquiries and privacy requests;
• meet legal obligations; and
• send optional TomatoScout marketing communications where you have explicitly agreed to receive them.

Depending on the activity, our lawful basis for processing personal information may be:

Contract — where processing is necessary to provide account features or services you have requested.

Legitimate interests — where reasonably necessary to operate, protect and improve TomatoScout, moderate contributions, prevent misuse, preserve appropriate community evidence and maintain the integrity and provenance of TomatoScout’s information.

Consent — where you have made a specific optional choice, such as agreeing to receive marketing communications.

Legal obligation — where processing is necessary for us to comply with applicable law.

Where we rely on legitimate interests, we consider whether those interests are proportionate and balanced against your interests, rights and freedoms.

Where we rely on consent, you can withdraw it.

3. Marketing emails

Creating a TomatoScout account does not automatically enrol you in marketing.

You may separately choose:

“Email me occasional TomatoScout news, growing ideas and useful tomato recommendations.”

If you opt in, we record your choice, when it was made, where it was made and the version of the consent wording you agreed to.

You can withdraw your marketing consent through your account settings.

Marketing consent is separate from necessary account, authentication and security communications. Withdrawing marketing consent does not prevent us or our authentication provider from sending communications necessary to operate or secure your account.

You do not have to agree to marketing to use TomatoScout.

4. Public information

Some TomatoScout features are intended to create useful information for the wider growing community.

Information you deliberately publish, particularly reviews, may therefore be visible to anyone using TomatoScout.

Making your profile private does not automatically remove reviews or other contributions you have chosen to publish. It does prevent visitors from using those contributions to access your private profile.

Please do not include personal information in public review text or other public contributions unless you are comfortable making it public.

5. Account deletion

You can delete your TomatoScout account through My Garden → Account and privacy.

Account deletion removes private account information including your profile, precise location, private growing information, saved tomatoes, saved searches and marketing-consent records.

Private, unapproved photographs associated with your account are also removed.

Some contributions that have already been published may be retained in anonymised form where reasonably necessary to preserve useful community information.

For example, a published tomato review may remain available after account deletion, but its association with your account is removed. It is displayed as being from “A former TomatoScout grower”, without a link to your former profile.

Where structured disease or problem observations form part of legitimate published review evidence, those structured observations may also remain in anonymised form.

Free-text disease and problem observation notes are private and are cleared when the account is deleted.

Approved public photographs may also be retained where appropriate under the permissions applying to those photographs. Account associations are removed where appropriate.

Certain correction, moderation, reporting and audit records may be retained where reasonably necessary to maintain provenance, investigate misuse, resolve disputes or understand changes made to TomatoScout’s data. Personal identifiers are removed or minimised where they are no longer necessary.

Deleting your TomatoScout account also deletes the associated authentication account.

6. How long we keep information

We keep account and private user information while your account remains active and while the information is reasonably necessary to provide TomatoScout.

When you delete your account, information is deleted or anonymised as described above.

Abandoned temporary photograph uploads are normally cleared after six hours.

Published community contributions may be retained in anonymised form after account deletion where reasonably necessary to preserve useful community evidence and database integrity.

Correction, moderation and audit records may be retained where reasonably necessary for provenance, security, abuse prevention, dispute handling and maintaining the integrity of TomatoScout’s data.

For report-abuse prevention, TomatoScout may retain a hashed fingerprint derived from technical information associated with a report. The fingerprint is cleared 12 months after the report is resolved. The underlying moderation record may be retained where reasonably necessary.

Infrastructure providers may maintain security and operational logs according to their own applicable retention arrangements.

7. Browser storage and similar technologies

TomatoScout currently uses a small amount of browser storage to operate the service and remember preferences.

This includes:

• authentication storage used to keep members securely signed in;
• a preference remembering your chosen measurement units; and
• a short-lived preference remembering the state of parts of the interface.

TomatoScout may also use cookies, local storage or similar technologies for Google Analytics and Google AdSense, subject to applicable consent choices. These advertising and analytics technologies are provided by Google and its advertising partners, as described in the Advertising and analytics section.

Our website fonts are served directly by TomatoScout rather than being loaded from Google Fonts.

If we introduce further technologies that require additional information, choices or consent, we will provide these as required.

8. Advertising and affiliate links

TomatoScout may be funded partly through advertising and affiliate relationships.

We may include links to retailers or other third parties. Some of these may be affiliate links, which means TomatoScout may receive a commission if you make a purchase after following the link.

Where content or links have a commercial relationship, we will identify this appropriately.

Commercial relationships do not determine TomatoScout’s community ratings or the personalised Match results generated from your preferences and growing conditions.

Affiliate and advertising partners may operate their own websites and services and process information under their own privacy policies.

Advertising on TomatoScout is provided by Google AdSense. Google and its advertising partners may use cookies or similar technologies, subject to applicable consent choices, as described in the Advertising and analytics section.

If we introduce further advertising, affiliate technology or other services that involve additional cookies, tracking or processing of personal information, we will update this Privacy Policy and provide any information, choices or consent mechanisms required before that processing takes place.

9. Advertising and analytics

TomatoScout uses Google AdSense to display advertising and Google Analytics to understand how the site is used.

Google and its advertising partners may use cookies, local storage, IP addresses and similar technologies or identifiers to serve, measure and improve advertising and to provide analytics.

Advertising may be selected using information such as the content of the page being viewed and the visitor’s approximate location. Where the visitor has given the required consent, Google and its partners may also use information to provide personalised advertising.

Visitors in the UK, European Economic Area and Switzerland are given choices about the use of their data through Google’s consent management platform. Visitors can consent, decline consent or manage their individual choices.

Visitors can change their advertising and cookie choices later using the “Privacy and cookie settings” control on TomatoScout.

TomatoScout does not provide Google with members’ email addresses, precise garden coordinates, What3Words locations, private profile information or review text for advertising targeting.

Google Analytics is used to measure website usage, such as pages viewed, traffic sources, general geographic information, device information and interactions with the site. Analytics respects the consent choices collected through Google’s consent management platform.

10. Who provides services to TomatoScout

We use specialist service providers to operate TomatoScout. These currently include:

Supabase — authentication, database and file-storage infrastructure.

Lovable — application infrastructure and services associated with the operation and development of TomatoScout, including authentication-related integration.

Cloudflare — domain, network and related infrastructure services.

what3words — used when you choose functionality involving a what3words address.

Google and Apple — involved where you choose the corresponding sign-in method.

These organisations may process limited personal information where necessary to provide their respective services.

Some providers or their infrastructure may process personal information outside the United Kingdom. Where international transfers of personal information occur, we use or rely upon the applicable safeguards required by UK data-protection law.

You can contact privacy@tomatoscout.com if you would like further information about safeguards relevant to our processing.

We do not sell your personal information.

11. Security

We use technical and organisational measures intended to protect personal information.

Private account information is subject to authenticated access controls. Database access rules restrict private records to their owners or authorised administrative functions.

Photograph storage is private and public photographs are served through controlled application routes.

Uploaded images are type- and size-limited, re-encoded and processed to remove embedded metadata.

No internet service can guarantee absolute security, but TomatoScout is designed to minimise unnecessary collection and exposure of personal information.

12. Your data-protection rights

Depending on the circumstances and the lawful basis involved, UK data-protection law may give you rights to:

• ask for a copy of personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase personal information;
• ask us to restrict certain processing;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

Some rights are subject to legal conditions and exceptions and do not apply in every situation.

You have the right to object to processing based on our legitimate interests in appropriate circumstances.

Many items can be changed or deleted directly through your TomatoScout account. You can also delete your account through Account and privacy.

For other privacy or data-rights requests, contact privacy@tomatoscout.com.

If you are unhappy with how we handle your personal information, please contact us so that we can investigate.

You also have the right to complain to the UK Information Commissioner’s Office.

13. Children

TomatoScout is a specialist tomato-growing service intended for growers generally and is not designed specifically for children.

We do not collect age or date-of-birth information simply to use the service.

We will keep this position under review. If evidence indicates that TomatoScout is being accessed by children in circumstances that require additional protections, we will review our practices and implement appropriate measures.

14. Changes to this Privacy Policy

We may update this Privacy Policy as TomatoScout develops, including where we introduce new features, service providers, marketing, analytics, affiliate technology or advertising.

We will update the Last updated date when the policy changes.

If a change materially affects how we use existing personal information, we will provide appropriate information and, where required, obtain consent before the new processing begins.

15. Contact

TomatoScout is operated by:

Gareth Browning, trading as TomatoScout
United Kingdom

General enquiries:
hello@tomatoscout.com

Privacy and data-rights enquiries:
privacy@tomatoscout.com